Privacy Policy

Popcorn is operated by Redacted Studios Pte. Ltd., a company incorporated in Singapore (“we”, “us”). Under India’s Digital Personal Data Protection Act, 2023 (the “DPDP Act”), we act as the Data Fiduciary for your personal data, and you are the Data Principal.

For any privacy question, contact us at help@redacted-studios.com. Our contact details are in section 12.

• Account details — your name, email address, phone number, and password when you create an account.
• Challenge activity — the fan challenges you complete: trailers watched, posts shared, channels followed, and friends referred, along with the points you earn.
• Social-task proof — depending on the task, a link or handle you submit, or — if you choose to connect a social account — limited information from that platform needed to verify the task. [Confirm social verification method before launch]
• Device & usage data — device model, operating system, app version, in-app interactions, approximate region, IP address, and app identifiers.
• Communications — messages you send us for support or other requests.

We use your information to run your account, track fan challenges and award points, enter eligible points into prize draws, verify that tasks were genuinely completed, prevent fraud and abuse, respond to your messages, send service updates, comply with legal obligations, and improve the app. We do not use your data for purposes unrelated to Popcorn without telling you.

Under the DPDP Act we process your personal data on the basis of your consent, which you give when you create an account and use the app, and for certain legitimate uses permitted by law. You can withdraw consent at any time — see section 8.

Where the GDPR applies, our bases are consent, performance of our contract with you, our legitimate interests (such as preventing fraud), and legal obligations. California residents’ rights are covered in section 8.

We share personal data only with: service providers who host and run the app, send communications, and provide analytics; prize-fulfilment partners where needed to deliver a prize you win; and authorities or advisors where required by law or to protect rights and safety. If the business is ever transferred, data may move with it under this policy.

We do not sell your personal data.

Some challenges ask you to act on third-party platforms (for example, sharing a post or following a channel). Those platforms have their own privacy policies that govern your activity there. We receive only the limited information needed to confirm a task was completed, and we never post on your behalf without an action you take.

We keep your personal data while your account is active. When you delete your account, we delete or anonymise your personal data within 30 days, except where we must retain certain records to meet legal, tax, or fraud-prevention obligations.

Under the DPDP Act you can access and correct your data, request its erasure, raise a grievance, and nominate someone to exercise your rights. Under the GDPR you can additionally request restriction or portability, object to processing, withdraw consent, and complain to a supervisory authority. Under the CCPA, California residents can know, delete, and opt out of sale (we do not sell), without discrimination.

To exercise any right, email help@redacted-studios.com or use the Account & Data Deletion page.

You can delete your account at any time, either in the app (Profile → Settings → Delete account) or by submitting a request on our Account & Data Deletion page. That page explains exactly what is deleted, what we must retain, and the 30-day timeline.

Popcorn is for adults aged 18 and over. It is not directed to children, and we do not knowingly collect personal data from anyone under 18. If you believe a minor has used the app, contact us and we will remove the data.

We protect your data with encryption in transit, access controls, and other safeguards. No method of storage or transmission is completely secure. Your data may be processed in Singapore and other countries where our service providers operate; where required, we put appropriate safeguards in place for international transfers.

If you have a question or concern about how we handle your data, contact us using the details below. We aim to respond within 2 business days.

This policy is a store-ready draft maintained alongside our internal data inventory; it is not legal advice.