Privacy Policy

Last updated: June 2026

Version: 1.2.0 (Feature Disclosure Update)

This Privacy Policy describes how JackiePoot Creations Ltd ("we," "us," or "our") collects, uses, and shares your information when you use the Cuppi mobile application (the "App").

1. OUR PRIVACY PHILOSOPHY

We believe your data belongs to you. Our App is designed with a "Local-First" approach, meaning we aim to process as much data as possible on your device rather than on our servers.

2. WHAT DATA WE COLLECT

A. Personal Data You Provide

• Account Information: When you register, we collect your email address and username.
• Profile Picture: An optional profile photo you upload, stored securely in Firebase Storage.
• Device Information: When you enable push notifications, we store your device model and iOS version alongside your notification token to ensure delivery compatibility.
• Subscription Data: Purchases are handled by the Apple App Store. We receive confirmation of your subscription status and an anonymous transaction ID to prevent fraud, but we do not see or store your credit card numbers or billing address.
• Authentication Data: If you enable 2-Step Verification, we process this via a standard authenticator app (TOTP). We do not collect or store your phone number for this purpose.

B. App Data (Cloud Sync)

To provide features like the Household Feed and multi-device syncing, the following data is encrypted in transit and synced to our secure servers located in the United Kingdom:

• Household names, unique Household IDs, member lists, member roles, and last-active timestamps
• Budget entries, transaction titles, household income/salary configurations, and budget line items with category and payer information
• Receipt scans, itemised lists, categorised spending, shop names, barcodes, and purchase locations
• Pet profiles: name, type, sex, breed, weight, date of birth, microchip number, veterinary clinic details, phone numbers, and notes
• Pet health records: medication schedules and dosage logs, health condition updates, and healing timeline records (PDF exports are available for 24 hours via a secure signed link, then permanently deleted)
• Pet insurance details: provider name, policy number, coverage amounts, excess, and renewal dates
• Birthday records: names, dates (including international format), gift ideas, and photos; and In Memoriam records (photos and memorial dates for deceased family members)
• Bin/waste collection schedules (council, postcode, collection days, and waste material types)
• Social feed posts: text content, images, GIFs, and links; emoji reactions; comments; and version history created when posts or comments are edited
• Link previews: when you include a URL in a feed post, our servers automatically fetch publicly available metadata (title, image, description) from that URL to generate a preview card
• Shopping lists, items, quantities, categories, and completion status; privacy settings for individual lists
• Monthly household summary drafts generated by the Companion feature
• Security event logs: a masked version of your IP address (the last two octets are replaced), your approximate city and country, the event type, and a timestamp - stored on a per-account basis
• Support tickets and messages you submit through the in-app support feature
• Feedback you submit voluntarily through the in-app feedback form
• In-app notification records and read timestamps
• Account deletion requests and data export requests

C. Automated Assistant Data ("The Companion")

The "Companion" is a feature that aggregates your household data (birthdays, bin schedules, pet medications, insurance renewals, and budget information) to generate a monthly household summary. Summaries are prepared automatically on the first of each month by our backend using deterministic code, and stored as draft documents within your household's data. We do not use your household data to train any machine learning models. You can control which data types are included in Companion summaries via the Companion settings screen.

D. Anonymous Usage Data (Analytics)

To help us improve Cuppi, we collect anonymous analytics regarding how you navigate the app. This contains no personally identifiable information. You can opt out at any time via the Privacy section in your Security Centre.

E. Biometric Authentication Data

If you choose to enable Face ID or Touch ID for the App, your biometric data is processed entirely by your device's operating system (iOS). We do not receive, store, or transmit your biometric data.

F. Security Event Geolocation

To help protect your account, when certain security-sensitive actions occur (such as registration, email changes, or password resets), we log an approximate location (city and country) by sending your IP address to a third-party geolocation service (ipwho.is). We store only the city/country result and a masked version of your IP address (the last two octets are removed). We do not store your full IP address.

3. HOW WE USE YOUR INFORMATION

We use your information solely to:

• Provide and maintain the Services
• Synchronise your data across your logged-in devices
• Generate automated household insights and notifications
• Manage your account, verify subscription status, and provide customer support
• Monitor for suspicious account activity and protect your account security
• Process and respond to your support tickets and feedback
• Generate and deliver Companion monthly household summaries

We process your data based on:

• Contractual Necessity: To sync your data and manage your subscription.
• Legitimate Interests: To secure the app, prevent fraud, improve the user experience, and monitor for account abuse.
• Consent: For anonymous analytics (adult users only).

4. SHARING YOUR INFORMATION

We do not sell your data. We only share information in the following limited circumstances:

• Google LLC (Firebase / Google Cloud): Data storage, authentication, cloud functions, push notifications, and crash reporting. Data is stored on servers located in the United Kingdom.
• Brevo (Sendinblue S.A.): Email delivery service. We share your email address and first name with Brevo to send account-related emails (welcome message, email verification codes, and password reset). Brevo processes this data on our behalf under a Data Processing Agreement.
• ipwho.is: IP address geolocation service used for security event logging. We send your IP address to this service to obtain your approximate city and country. Only the result (city/country) - not the raw IP - is stored by us.
• Apple Inc.: App Store processing and subscription management. Apple sends us subscription lifecycle notifications (renewal, expiry, refund, and revocation) via a secure server webhook.
• Legal Requirements: If required by UK law or to protect our legal rights.

5. DATA STORAGE AND SECURITY

Location: Your synced data is stored on secure servers located in the United Kingdom.

Encryption: We use industry-standard encryption (SSL/TLS) during transfer. Firebase encrypts all data at rest. Local caches on your device utilise iOS system-level File Protection, meaning they are encrypted at rest when your device is locked.

Retention: We keep your data for as long as your account is active. A 7-day grace period applies to account and household deletions - your data is retained for 7 days, during which you may cancel the deletion request. After the grace period, all data is permanently and irrecoverably deleted from our active servers.

6. YOUR RIGHTS (UK GDPR)

As a UK resident, you have the right to:

• Access / Correction: Request a copy of or correct your data.
• Deletion: Request that we delete your account (initiated directly within the App via the Security Centre). A 7-day grace period applies before permanent deletion.
• Restriction / Objection: Object to our processing or ask us to restrict it.
• Portability: Request a transfer of your data. You can request a full export of your data directly within the App (Security Centre → Data Export). The export ZIP file is available for download for 7 days, after which it is automatically deleted.

7. DATA CONTROLLER & CONTACT US

For the purposes of UK data protection law, the Data Controller responsible for your personal data is:

JackiePoot Creations Ltd Company Number: 17206871

Registered Office: 124 City Road, London, EC1V 2NX, United Kingdom

Email: support@cuppi.co.uk

ICO Registration Number: ZC143045

8. YOUR RIGHT TO COMPLAIN

If you feel we have not resolved a concern, you have the right to complain to the Information Commissioner's Office (ICO):

Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Helpline: 0303 123 1113 | Website: www.ico.org.uk