Privacy policy

Popcorn privacy notice

Version 2026-11-10. This notice explains what Popcorn does with your information under the Protection of Personal Information Act (POPIA). It is written to be read, not skimmed; it is short on purpose.

Who is responsible

Popcorn is operated by Rehoboth. Our Information Officer is Itumeleng Moagi, reachable at [email protected]. You may also complain to the Information Regulator (South Africa) at [email protected].

What we collect and why

Receipt photos and what we read from them. When you scan a till slip we store the photo and the line items we extract from it: store, date, items, quantities, prices, VAT codes and promotions. This is the service itself: we need it to show you your spending. Legal basis: necessary to provide the service you asked for.

Your account. Your email address and a sign-in code sent to it. No password.

Your sign-in record. Signing in creates a session, and with it we keep the internet address you connected from and which app or browser you used. It is there so that a sign-in that is not you can be spotted. Signing out on that device deletes that record, deleting your account deletes every one of them, and an expired session cannot be used again.

Corrections you make. When you fix a line we misread, we keep both versions. Corrections improve the reading of future slips.

Loyalty cards. If you add a store loyalty card, we keep its number and the kind of barcode it is, the store, and, if you add them, a name and a note and a photo of the card, so that anyone in your household can show the card at the till from their phone. Never a PIN or a password. We use it for nothing else and share it with nobody, not the store.

Your shopping list and the items you watch. Popcorn works out your household's list for the week from your slips, and keeps what anyone in your household adds to it or takes off it, and who did. If you ask Popcorn to watch an item, we keep the item, the price you want it under if you give one, and who asked, so that your household hears when it goes on special at a store you shop at. Anyone in your household sees both and can change them. We use them for nothing else and share them with nobody, not the stores.

Households — sharing your receipts with the people you shop with

A household is a group of people who shop from one budget. Each person signs in with their own email address; nobody shares a login. If you have never invited anyone or accepted an invitation, you are already a household of one — everything below about "your household" is simply about you, until you choose to share it with somebody else.

Everyone in your household sees the same receipts. That means the photos, the line items, the totals, the budget and the insights. Insights are the one thing not handed over at the moment a household changes: a member who joins later does not receive the household's earlier insights when they join, and the household does not receive the earlier insights that member arrives with. But every insight Popcorn writes from then on goes to everybody in the household — and when a new one is about the same thing as one of those earlier insights, that earlier insight can then reach members who had not seen it. It also means each receipt shows who scanned it, each correction shows who made it, and the budget shows who last changed it. Popcorn shows those attributions to the household and to nobody else. Any member can also delete a receipt, including one somebody else scanned — deleting it removes its photos too, for good.

Loyalty cards are shared too: anyone in your household can add one or remove one.

Joining a household hands its members the receipts you have already scanned, along with your line items, your budget and your categories. Where the household already has a budget for a month you also have one for, or its own rule for an item you have also categorised, theirs is kept and yours is dropped. Every receipt, line and correction of yours moves across untouched. Leaving does not take them back: the records stay with the household, because the people still in it are equally the subjects of those purchases. The screen where you accept an invitation says exactly what is about to move and what will be replaced before you tap, and tapping is how you consent to it. Export your data first if you would rather not.

The owner of your household can also remove you from it. The effect is the same as if you had left: you land in a fresh household of your own, and what you already scanned here stays here, with the household's record that you were the one who scanned it. Your name is not shown against it any more — Popcorn can put a name to a scan only for somebody who is in that household at the time — and only deleting your account takes the record itself off. Unlike leaving, this is not something you can export ahead of: it happens the moment the owner chooses, with no warning to you first.

If you delete your account, we remove your name from them and the household keeps them. Your own information — your email address, your name, your quiet hours, your phone's notification token, your consents — is erased, and your name comes off every receipt you have ever scanned, in every household you have belonged to, not only your current one. A household named after your first name — which is how Popcorn names one unless somebody renames it — is put back to "My household" if it carries on without you. Two things that identify you are not erased with the account, and "How long we keep things" below gives each of them its own window. An invitation sent to your email address belongs to the household that sent it, not to you, so your address stays in it until that invitation is deleted a few days after it is accepted, cancelled or expires. A sign-in code nobody used keeps the address it was sent to until a day after that code expires, and then the code and the address go together. What was bought is not erased either: those purchases are the household's own record, and the people still in it are equally the subjects of them, so the household keeps them, attributed to nobody — unless you are its last member, in which case the whole household, its records and its images are deleted with you. Leaving a household without deleting your account does not do any of this: you keep your account, and that household keeps its record of you as the person who scanned what you scanned there, even though your name is no longer shown against it to the people who remain.

Sending an email invitation reveals your first name and your household's name to that address, whoever is reading it. A code you read aloud or share yourself already lets whoever tries it see your household's name and how many people are in it, before they decide whether to join — that is what the decision is for — and it reveals nothing more than that until they do. A code expires in 24 hours, an emailed invitation in 7 days, and either can be used only once.

Pooling and training choices follow the person who scanned each slip, not the household. If you have opted out of the shared price index, your slips stay out of it even when somebody else in your household corrects them. If somebody in your household has opted in to something you have not, their choice applies to their slips and yours are untouched.

Who reads the receipt photo

Reading a photo into line items is done by a vision model. We send the photo through OpenRouter, pinned so that it is processed only by Anthropic. Both are operators under section 21 of POPIA, bound by written terms that prohibit using your data to train their models. We do not send your name or email with the photo.

Who sorts products into categories

To sort the products on your slips into categories, and to match store specials to those products, Popcorn asks a decision model run by TypeSafe, which we reach through OpenRouter. Both are operators under section 21 of POPIA. The model is sent a product's name as our shared catalogue spells it — a few normalised words and a pack size, such as "apples gala 1500g" — together with the list of categories or specials to choose from, and nothing else: never a receipt line as the till printed it, a photo, a price, a date, a store, your name, your email or anything that says which household bought it. The product names it was asked about and its answers are kept, without any link to you, so that its accuracy can be checked.

Popcorn also asks it which products in the catalogue are the same kind of thing, such as two names for one long-life milk; the list it chooses from is then other catalogue product names, in the same form.

Asking Popcorn a question

You can type a question about your household's shopping, such as "how much did we spend on meat in October?". To turn it into a search, Popcorn sends its words to a model operated by Anthropic, which we reach through OpenRouter — the same two operators under section 21 of POPIA that read the receipt photo, bound by written terms that prohibit using your data to train their models — and tells OpenRouter to use no provider that collects what it is sent. The words go exactly as you typed them, including any store, product, price or date you write in the question. With them Popcorn sends only today's date and the fixed list of things a search can name, such as its categories; it sends nothing from your household's slips, stores, shopping list or history, and not your name or your email. The model sends back only what to search for, and the answer is worked out on your phone, from your household's own slips. Popcorn does not keep your question and does not write it to its logs. So that nobody asks more than 30 questions a day, and Popcorn no more than 200 between everybody, the server counts how many you have asked today. It keeps that count in its memory, forgets it when the day ends, and its logs carry only the number, never who asked or what.

Who sends your sign-in code

Your sign-in code is emailed through ZeptoMail, a transactional email service run by Zoho Corporation. It receives your email address, the code, and your name if you have given us one, so that the email can greet you. It receives nothing about your receipts or your spending. It is an operator under section 21 of POPIA, bound by written terms, and uses what it receives only to deliver that email. It also sends a household invitation when you send one, through the same service: the address you type, your first name, your household's name, an invite code and a link — to an address that may hold no Popcorn account at all.

Where your information is stored

Our servers and database are in the European Union (Frankfurt). Your information is therefore transferred outside South Africa (section 72 of POPIA). The EU applies data-protection law that is at least as strong as POPIA.

The receipt photo, the email address and name used to send your sign-in code, the catalogue product names sent to be sorted into categories and to tell which products are the same kind, the facts sent to write the Sunday summary (the week and its dates, what the week cost and on how many slips, the month's spending so far and its budget, the product name and unit, the two prices and the shops behind the week's biggest price move, how many of the week's notes were acted on, and the one-line suggestion Popcorn wrote itself, with the kind of note it came from), the words of a question you ask Popcorn, and — when you send a household invitation — the recipient's address, your first name, your household's name, the invite code and the invite link, are also processed by the operators named above in the United States, outside both South Africa and the EU, under written terms that require the same protections (section 72(1)(b) of POPIA).

Pooled prices — on by default, you can opt out

Prices from receipts are added to a pooled price index (store, item, price, date) with nothing that identifies you. This is what lets Popcorn tell you where an item is cheaper. The pool cannot point back to you: the table has no user identifier at all. You can opt out at any time under Profile → Privacy; your receipts stay yours either way. The item in the pool is a compacted form of the description printed on the slip (letters and digits only, such as "COKE2L"), because that text is what identifies the product. It says nothing about you.

In a shared household these choices follow the person who scanned each slip, not the household: your opt-out keeps your slips out of the pool even when another member corrects them, and a slip whose scanner has deleted their account is never added to the pool again.

Unless you have opted out of pooling, an answer you give about whether two products are the same kind of thing improves the matching for everyone; it carries nothing that says which household gave it, and the choice follows the person who answers, not the person who scanned the slip.

Anonymous usage analytics and screen recordings — on by default, you can opt out

To see where people get stuck, the app sends anonymous usage events to PostHog, a product-analytics service, hosted in the European Union. PostHog processes these events on our behalf as an operator under section 21 of POPIA, bound by written terms, and the data stays in the European Union. An event is a name such as "scan completed" with small facts about the action — how many sections a slip had, how long a read took, which kind of insight was opened. Besides those events, the app sends PostHog:

• which screens you visit, by the kind of screen ("receipt", "insights"), never which receipt, month or household;
• where you tap: the name Popcorn gives its main buttons, otherwise the names of the parts of the app under your finger, never the words on them;
• error reports: the type of error and where in the app's code it happened, never its message;
• recordings of the screen, in which all text, images, the camera view and charts are hidden on your phone before a recording is sent.

Events never carry an amount, a store, an item, a name, an email or anything printed on a slip, and neither do screen names, button names, error reports or recordings. All of these are tied to a random id created on your phone, not to your account; the id is thrown away when you sign out. PostHog keeps a recording for 30 days. You can switch all of this off at any time under Profile → Privacy → "Share anonymous usage and screen recordings": nothing more is recorded or collected from that moment, and a recording in progress stops; anything recorded before you switched off that has not been sent yet — usually no more than the last half-minute, longer if your phone was offline — may still be uploaded.

Aggregate comparisons

If you share pooled prices, your household's promo savings — from the slips of members who also share — are counted, together with every other household that shares, into one range per month ("most Popcorn households saved between R50 and R400"). The range is only computed when at least twenty households (which is at least twenty people) are in it, only two numbers and a count are ever produced, and no individual value is shown to anyone. Switching pooled prices off stops your own slips counting; your household stays in the count as long as another member still shares.

Notes Popcorn keeps for you

Popcorn writes your household short notes — a price that moved, a slip worth checking, a budget running fast, something you usually buy that is due, and a summary of the week on a Sunday. Some of these are worked out on your phone. The rest are worked out on our server on a schedule, from your household's receipts and the budget it has set: a few times a day the server reads the household's slips, works out what is worth saying, and writes one note to the household. In a shared household a note can be worked out from a slip somebody else scanned, and the same note can reach you as well as them — never anybody outside the household. Each member sees it, dismisses it and is pushed it separately, on their own quiet hours.

Your device notification token. If you turn notifications on, your phone gives us a device notification token from Expo's push service, and we store it so a note can reach you. It identifies the app on that phone and nothing else — no name, no number, no location. Expo, which delivers the message, is an operator under section 21 of POPIA. The token is deleted when you turn notifications off for that phone, when you sign out on it, and when you delete your account. If your phone tells Expo the app is gone, we stop using the token.

The Sunday summary. The words of the Sunday summary are written by a model operated by Anthropic, which we reach through OpenRouter, both operators under section 21 of POPIA. It is sent the week and its dates, what the week cost and on how many slips, the month's spending so far and its budget, the product name and unit, the two prices and the shops behind the week's biggest price move, how many of the week's notes were acted on, and the one-line suggestion Popcorn wrote itself, with the kind of note it came from. It is never sent your receipt lines, your photos, your email or your name. If the model is off or its answer does not check out against those totals, Popcorn writes the summary itself and sends nothing. The household gets one summary, not one per member: if anybody in it has this switched on, that week's totals are built from every member's receipts — including a member who has switched the brief off themselves, whose receipts still feed the model even though they will not receive the note.

Cheaper-elsewhere notes. When we tell you something is cheaper at another shop this week, that price comes from the pooled price index, and only where at least five separate observations of that product at that shop exist for the week. You are only ever told about shops your household has already been to and products your household has already bought. Nothing about who observed a price is stored or shown.

Your control. Every family of note has its own switch, and you can set quiet hours and choose one daily summary instead of notifications as they happen, all under Profile → Concierge. Switching a family off stops new notes of that kind being drafted for you; it does not recall one already drafted before you switched it off, which can still reach you afterwards. In a shared household your receipts are still read to work out that family's note for as long as anybody else in it has the family on — a member with it off is simply never one of the people a note is drafted for.

Training images — off unless you opt in

Reading crumpled thermal paper is hard, and we would like to improve at it using real slips. A receipt photo can carry a loyalty number, the last digits of a card or a cashier's name, so we treat it differently from prices. Today Popcorn keeps no copies of receipt images for training at all — the switch in Settings records your choice for when it does. If that changes, copies will be kept only for people who opted in, only after the lines carrying those details are blacked out with a method we have checked works, and for at most 24 months from capture; you will be able to withdraw at any time and the copies will be deleted immediately. The text we extract from your receipts, without anything identifying you, is kept for improving the service while the household exists, which can outlast any one member's account. This choice, too, follows the person who scanned each slip, not the household.

How long we keep things

Your account: while it exists. Your household's receipts and their photos: while the household exists, which can outlast any one member's account — see Households, above. A loyalty card and its photo: until someone in the household removes it, or the household ends. Your household's weekly lists and what was added to them or taken off: twelve months from when each was written. An item you watch: until someone in the household stops watching it, or the household ends. Training image copies: none are kept today; if they ever are, 24 months and only with your opt-in.

Notes: twelve months from when the note was written, then they are deleted automatically whether you have read them or not. Your device notification token: until you turn notifications off, sign out on that phone, or delete your account. Your sign-in records: until you sign out on that device or delete your account. A sign-in code: a day after it expires, used or not, and the address it was sent to goes with it.

An invitation: deleted 7 days after it is accepted, cancelled or expires, whichever comes first, and the address it was sent to, if it was sent to one, and its code go with it — which is 14 days from when it was sent for an emailed invitation nobody ever uses, and sooner for every other ending. An invitation belongs to the household that sent it rather than to either person in it, so deleting your account does not delete one: an invitation addressed to your email address goes on this timetable instead, and your address can sit in it for a few days after your account is gone.

Usage events are not tied to your account and are not deleted when you delete it; the analytics service keeps them for one year.

Screen recordings: not tied to your account and not deleted when you delete it; the analytics service deletes them after 30 days.

Catalogue product names asked of the decision model, and its answers: kept without any link to you, for as long as the model is in use, to check its accuracy.

When you delete your account, everything tied to you personally is deleted, apart from the two things the timetable above gives their own windows: an invitation addressed to your email address, and a sign-in code nobody used. Your household's receipts and photos are not deleted, for the reasons given in Households, above, unless you are the household's last member, in which case they are deleted with it. Leaving keeps the household's record of who scanned what, because leaving does not delete an account — only deleting one takes that record off, and it comes off in every household you have belonged to, not only your current one. Pooled price rows remain because they contain nothing that identifies you.

Your rights

You can see everything we hold about you in the app, with the exceptions named below, correct it, export it (Settings → Export my data gives you a file with everything, including your whole household's receipts — not only the ones you scanned — and one-hour links to every photo among them, including the ones other members took, and your loyalty cards, with one-hour links to their photos), opt out of pooling, withdraw training consent, turn any family of notes off, and delete your account, all in Settings. You can also write to the Information Officer above.

Four things are deliberately left out of that file. Two are live credentials rather than facts about you: your phone's notification token, which delivers notifications to that phone, and the code on any invitation you have sent, which lets whoever types it into Popcorn join your household and see everything in it — and a file you may forward is the worst place to keep either. The invitations themselves are in the file: who you sent each one to, and what became of it. The other two are housekeeping — the short-lived copy Popcorn keeps of a scan while your phone might still retry it, which only duplicates a receipt the file already carries, and your sign-in record, which is described above and which the Information Officer will send you if you ask.

One thing you cannot reach through the app at all: if another household has invited your email address, that invitation is part of their records rather than yours, so it is in neither your export nor anything the app can show you. It is deleted on the timetable above; if you would rather it went sooner, write to [email protected] and we will remove it.

You can leave a household at any time from Profile → Household, unless you are its only member: leaving is not offered then, because it would abandon the household with nobody left able to reach it. Delete your account instead, and the household, its records and its photos are deleted with you.

Changes

If this notice changes in a way that matters, the app will show you the new version and ask you to accept it again before you carry on scanning.