privacy, plainly
EFFECTIVE 2026-07-05 · COVERS POPPYJAM.COM, THE DESKTOP APP + THE POPPYJAM BUDDY EXTENSION
poppyjam is little desktop pets, not a data business. we collect the minimum it takes to remember who you are and what you own — and nothing is ever sold, shared for ads, or used to profile you. here's the whole story.
what we collect
- your email — if you make an account (sign-in is email + password via Supabase; we never see or store your password, only Supabase's auth service does).
- what you own — a list of which agents your account has claimed or bought (that's how they follow you across devices).
- things you deliberately save — in the Buddy extension, items you drag onto a pet (links, image URLs, text snippets, file names, plus the page they came from) go into that pet's stash on your device only. nothing is saved unless you drag it there, and the stash never leaves your browser — we never see it.
- a session token — while you're signed in, the standard "you're still you" token every login system uses. the extension shares it only with
poppyjam.comso the site and your buddy stay signed in together.
what we don't collect
no browsing history. no page contents. no analytics or tracking pixels. no ads, ever.
the extension's pets float on pages you visit, but they don't read them, and nothing about
where you've been leaves your browser.
where it lives
- your stash: always on your device (browser storage), signed in or not. it does not sync anywhere in this version — if stash sync ever ships, it'll be opt-in and this page will say so first.
- signed in: your email and owned-agents list live in our database (Supabase), protected by row-level security — your rows are readable by your account and nobody else's.
third parties (the complete list)
- Supabase — our database + sign-in infrastructure. your account data lives there.
- Lemon Squeezy — checkout, when you buy an agent. they process the payment as merchant of record; we never see your card. they send us your account id and what you bought, so we can hand you the agent.
- Google's favicon service — used only to display the little site icon next to links you've saved; the saved link's hostname is sent to Google when the icon renders.
- Vercel + Cloudflare — they host and serve the site, like they do half the internet.
deleting your stuff
- clear any pet's stash from the extension popup, anytime — it only ever lived on your device, so that's the whole job done.
- want your whole account gone? email hello@poppyjam.com and we'll delete it, everything attached to it included. no hoops.
changes + questions
if this policy ever changes in a way that matters, the date up top changes with it. questions, worries, or just want to say hi to the pets — hello@poppyjam.com ✦