Privacy Policy

What we collect

• Account details: your email address, your name if you give one, and your password (stored only as a secure hash). If you sign in with Apple or Google, we receive the email and name they share with us.
• Bank data: when you connect a bank, we receive your accounts, account numbers (IBANs), balances and transactions through Salt Edge. Access is read only: Pocket cannot move money, and we never see your bank login details.
• What you add: categories, notes, labels, pockets, budgets, debts, cash entries, income, goals, receipt photos and your profile photo.
• Household: if you invite a partner, the email address you invite. Members of a household see the data the household shares.
• Subscription: whether you have Pocket Plus, your plan and its renewal dates. Card and payment details stay with Apple or Stripe; we never see them.
• Device and technical data: your push notification token, an app install ID, your IP address, device type, app version and our server logs of your requests (including search terms you type in the app). Server logs are kept for 30 days.

We do not collect your location, your contacts or any health data. Face ID runs on your phone; we only learn whether it succeeded.

How we use it

• To provide Pocket: syncing your banks, categorising transactions, forecasts, budgets, reminders and sharing with your household (performance of our contract with you).
• To keep Pocket secure and working, and to fix problems (our legitimate interest).
• To send you emails about your account, and recaps, reminders and tips you can switch off at any time in Settings or from any email's unsubscribe link.
• To improve automatic categorisation: category corrections you make are shared with Salt Edge for that purpose.

Who we share it with

Only with the service providers that run Pocket for us, each bound to use the data only on our instructions:

• Amazon Web Services (servers, database and file storage in the EU).
• Salt Edge (a licensed account information provider that connects your bank).
• RevenueCat (manages Pocket Plus subscriptions; receives your Pocket user ID and purchase history).
• Apple (App Store purchases, Sign in with Apple and push notifications) and Google (Google sign-in, if you use it).
• Stripe and Link (payments for subscriptions bought on the web).
• Expo (delivers push notifications and app updates).
• Resend (sends our emails).

Some of these providers are based outside the EU. Where your data leaves the EU, it is protected by the European Commission's standard contractual clauses or an adequacy decision.

How long we keep it

We keep your data for as long as you have a Pocket account. When you delete your account, we delete your data straight away, and ask Salt Edge (your bank consents), RevenueCat and Stripe (your subscription record) and Apple (your Sign in with Apple token) to delete theirs. Where the law requires a record to be kept (for example, of a purchase), the store that sold it keeps it. Server logs are deleted after 30 days, and backups expire on a fixed schedule.

Your rights

You can ask us for a copy of your data, to correct it, to delete it, to restrict or object to how we use it, or to receive it in a portable format. You can also withdraw any consent you gave. Email hello@joinpocket.app and we will answer within one month. To delete your account, open Pocket and go to Settings, then Delete account. If you share a household, your partner keeps it and their own data; your bank connections, cash wallets and their transactions are deleted with your account.

You can also complain to a data protection authority, for example the Irish Data Protection Commission or the Croatian Personal Data Protection Agency (AZOP).

Security

All traffic to Pocket is encrypted. Your bank login happens on your bank's own page, and you can lock the app with Face ID.

Children

Pocket is not meant for anyone under 16.

Changes

If we change this policy, we will update the date at the top and, for important changes, tell you in the app or by email.