Last updated: October 4, 2026
Poppet is operated by Occidental Capital Inc. (“we”, “us”, or “our”) in British Columbia, Canada. This Privacy Policy explains what personal information we collect, how we use it, who we share it with, and your rights regarding your own and your child's information.
This policy applies to our website and mobile application (together, the “Service”). It describes our information practices and should be read alongside our Terms of Service. Reading this policy or continuing to use Poppet does not replace consent where the law requires it.
Occidental Capital Inc. is responsible for personal information handled through Poppet. For questions about this policy, your data, or your privacy rights, use our privacy contact:
You do not need a paid subscription to make a privacy request. Section 11 explains your rights and how we handle requests.
We collect the following categories of personal information:
Child information is provided by adult account holders and authorized caregivers. Poppet does not ask children to use the Service or submit information directly.
We handle personal information with consent or another basis permitted by applicable law. Consent must cover the purposes and disclosures involved, particularly for sensitive child and health information. You must be a parent or legal guardian, or have their authority, to provide information about a child.
Optional AI features process information when you choose to use them. You can use manual logging without Photo Scan, Describe Meal, or AI meal planning. Section 13 explains how these features share information.
Where the GDPR or UK GDPR applies, the general legal bases for processing include:
Health information has additional protections. Where GDPR or UK GDPR applies, processing special category health data also requires a condition under Article 9, separate from the general legal bases above. Where processing relies on explicit consent, it must be provided by a person authorized to act for the child and can be withdrawn.
To withdraw consent or ask about a child's information, contact us using the details in Section 2. We will explain any effect on features that depend on that information and any records we must retain under applicable law. You can stop using optional AI features without closing your account.
We use personal information to:
We do not use your or your child's information for advertising, build advertising profiles, or sell personal information.
Poppet is designed for adults aged 18 or older. Child profiles are records maintained by adults, not accounts for children. Parents and guardians should ensure that caregivers they invite are authorized to view and enter the child's information, and should share only information needed for care.
If you believe a child has created an account, or a child's information has been entered or shared without appropriate authority, contact us. We will investigate and take appropriate steps to restrict access or remove information, subject to applicable law.
We share information in the following circumstances:
We do not provide personal information to advertisers or data brokers, or share it with third parties for marketing purposes.
How long information is kept depends on its purpose:
CSV and report exports in the app require a Plus or Premium subscription, or an active trial. You can delete your account on any plan. Paid reporting features do not limit statutory privacy rights or require you to subscribe to request access to your personal information.
Contact us for help with a privacy request or questions about retention. See our account deletion instructions for how to close your account. Section 6 of the Terms of Service explains how account deletion affects billing.
We use reasonable technical and organizational measures to protect information against unauthorized access, loss, alteration, or disclosure. These include account access controls, private photo storage, and protection of data in transit.
No method of internet transmission or electronic storage is completely secure. If a breach requires notice under applicable law, we will notify affected individuals and the relevant authorities as required.
Occidental Capital Inc. operates Poppet from British Columbia, Canada. Hosting, storage, email, payment, diagnostics, and AI providers may process information in Canada, the United States, or other countries where they or their subprocessors operate. Your information is not necessarily stored only in Canada.
Where applicable law requires safeguards for an international transfer, those safeguards must be appropriate to the transfer, such as an applicable adequacy decision or contractual safeguards. Contact us for details of transfers involving your information and the safeguards that apply.
Depending on applicable law, you may have rights to:
Contact hello@poppet.baby or use the contact form to make a request. We may need to verify your identity and authority to act for a child before releasing or changing information. A paid subscription is not required. Access requests are handled at no or minimal cost as permitted by applicable law; any permitted fee will be explained before it is charged.
We respond within applicable legal time limits, generally 30 days under Canadian privacy law or one month under GDPR or UK GDPR. Where a lawful extension applies, we will explain the reason and revised timing. If we cannot fulfil a request, we will explain applicable restrictions and available complaint options.
You may raise concerns with the Office of the Information and Privacy Commissioner for British Columbia, the Office of the Privacy Commissioner of Canada where applicable, or your local data protection authority, including the UK Information Commissioner's Office where UK law applies.
Poppet uses cookies and similar browser or device storage for functions such as sign-in, security, and remembering preferences. Disabling essential cookies may prevent parts of the website from working.
When Sentry diagnostics are enabled, the website can collect performance information and session replays showing navigation and interactions to help investigate errors. Text and input fields are masked in these replays. Mobile diagnostics can include crashes, device details, and a Poppet user identifier. These diagnostics are used for reliability and security, not advertising.
You can manage browser cookies and device permissions through your browser or operating system settings.
AI features: Photo Scan sends meal photos for analysis. Describe Meal sends your typed description or speech transcript and relevant child names for interpretation. Smart meal planning sends relevant child information, including name, age, texture stage, allergen information, preferences, recipes, and feeding history, to generate meal ideas. AI features are optional; manual logging remains available.
Configured AI providers can include Google Gemini, OpenAI, Anthropic, and Qwen. Which provider processes a request depends on the feature and configuration. Meal planning can use a configured fallback provider if the primary provider fails.
Poppet uses Google Gemini under Google's paid-service terms. Under those terms, Google does not use submitted prompts or responses to improve its products, but may retain them for a limited period for safety, abuse prevention, and required legal disclosures. This protection does not mean that every AI provider has the same retention or data-use terms. Other providers process requests under their applicable service terms and privacy arrangements.
These providers also have their own privacy terms for information they handle independently, such as their account, payment, or security records. Contact us for questions about the provider handling a particular feature. Poppet does not provide child or health information to advertisers or data brokers.
We may update this policy as the Service or our information practices change. Material changes will be communicated by email or through the Service at least 14 days before they take effect, unless a shorter period is required by law or an urgent security need. The updated policy will show a revised date.
Where a new purpose or disclosure requires consent, we will seek that consent before the new processing. Notice of a change or continued use of Poppet does not replace required consent.
Poppet operates from British Columbia, Canada. Applicable privacy laws may include British Columbia's Personal Information Protection Act (PIPA), Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), including where it applies to cross-border commercial activity, and other laws applicable to your information. GDPR or UK GDPR rights apply where those laws cover the processing.
Nothing in this policy limits mandatory privacy rights available to you under applicable law.
Made with care for parents everywhere