Privacy

Last updated 8 November 2026

This page says what popamp.app keeps about you and why. There are no ads and no analytics, and we do not sell your data.

Who is responsible

The controller of your data is Oleg Gunyakov, Bulgaria. Write to [email protected] about anything on this page. Accounts are for people who are at least 16.

What we keep

• Your account: user name, email address, a one-way hash of your password (never the password itself), your notification setting, and when you signed up and last signed in.
• While you are signed in: your IP address and browser name, stored with the session. A session lasts up to 30 days and is erased after that, or sooner when you sign out from it or change your password.
• What you post: your uploads, comments and ratings, and any reports you send to the moderators.
• Limits against abuse: counters of attempts, stored as hashes of your IP or email address and erased after a day.
• Server logs: our web server keeps ordinary access logs (IP address, page, browser) for a limited time, to keep the site working and safe.

Why we may use it

• To provide what you asked for (GDPR Article 6(1)(b)): your account, your uploads, comments and ratings, and the email that goes with them.
• Our legitimate interest (Article 6(1)(f)) in keeping the site safe and free of abuse: sessions, attempt limits, server logs, the anti-spam check, moderation records and notices about comments on your work, which you can turn off.
• A legal duty (Article 6(1)(c)), where the law requires us to keep or hand over something.

What others can see

Your user name, your published work and your comments are public. Ratings appear only as an average, without names. Your email address is never shown. Moderators see the reports people send and keep a log of their own actions.

Cookies

Only the cookies the site needs in order to work: popamp_sid keeps a form's state between pages, popamp_auth keeps you signed in, and popamp_locale remembers a language you picked. The anti-spam check below may set its own.

Who else handles your data

• Cloudflare sits in front of the site, so your requests pass through it. Its Turnstile anti-spam check runs on the sign-up and password-reset forms.
• SMTP2GO delivers our email, so it receives your address and the message.
• Our hosting provider runs the server where all of this is stored.

Cloudflare and SMTP2GO may handle this data outside the European Union.

Email

We write to confirm your address, reset your password, pass on a moderator's decision about your work and tell you about new comments on it. You can turn the comment notices off on the account page.

Your choices

On the account page you can change your email address and password or delete your account. Deleting removes your name, email address, password hash and sessions. Your published work and comments stay under an anonymous name unless you ask us to remove them first. Backups may hold old data until they are overwritten.

You have the right to get a copy of your data, to have it corrected or erased, to restrict its use, to object to it and to receive it in a portable form. To use any of these, write to [email protected].

You may also complain to a data protection authority. In Bulgaria that is the Commission for Personal Data Protection, cpdp.bg.