Privacy Policy

Pockita is a personal-finance app built by a small team. We take your privacy seriously because we use the same tool ourselves. This page explains what we collect, why we collect it, and what we never do.

What we collect

We collect only the data we need to run the product:

• Account info: email address, display name, and your chosen avatar / theme preferences.
• Financial data you enter: transactions, accounts, budgets, recurring rules, and savings goals.
• Device push tokens: so we can deliver the notifications you opt into.
• Anonymous usage: basic crash and performance telemetry to keep the app stable.
• Voice recordings (only during voice quick-add): when you tap the microphone to log a transaction by voice, the short audio clip is transmitted for transcription. It is never stored on our servers and is not retained by the transcription provider - see the AI section below.
• Receipt photos (only when you scan a receipt): the photo is sent to OpenAI to read the receipt, used for that one request, and never stored on our servers.

How we collect it. All of the above is collected directly from you while you use the app (typing, tapping, speaking into the microphone, or taking or choosing a receipt photo). We do not buy data from data brokers, scrape your contacts, or pull from social networks.

How we use AI (third-party AI provider)

Pockita uses OpenAI (a third-party AI provider operated by OpenAI, L.L.C., San Francisco, USA) to power five features: voice and typed quick add, receipt scanning, AI chat, insight cards, and the monthly AI report. These features are off by default and you must explicitly consent in-app before any data is sent.

Explicit, in-app consent.The first time you tap an AI feature, Pockita shows a consent dialog that names OpenAI, says what is sent and what is never sent, and offers a clear “Allow” / “Don't allow” choice. No data is transmitted to OpenAI before you tap Allow.

What we send to OpenAI. Only what each feature needs:

• Quick add: the audio you record, or the text you type or dictate. Audio is sent to OpenAI for transcription. It is not stored on our servers and OpenAI does not retain it.
• Receipt scan: the photo you take or choose, used for that one request.
• AI chat and insight cards: your last 90 days of transactions (amount, date, merchant or note, category, and account name), your account names, types and balances, your budgets, and your category names. Chat also sends the recent messages of your conversation.
• Monthly report: that month's total spending and the previous month's, your top category, budgets you came close to or went over, and categories well above their usual level. No individual transactions and no name.

What we never send. Pockita never puts these in a model call:

• Your email address or the name on your profile.
• Passwords or sign-in tokens.
• Internal user and record identifiers.
• Data from any feature where AI is turned off.

In your own words (what you type, the text of what you say, and your merchant and category names), anything that looks like an email address, a long number, or a token is masked before the call.

Retention and training. Under our agreement with OpenAI, your data is notused to train OpenAI models. We use the OpenAI API with zero-retention enabled, which means prompts, audio, and responses are not stored on OpenAI's side. OpenAI provides privacy protections that are equivalent to or stronger than those described in this Privacy Policy; see OpenAI's Privacy Policy and the API Data Processing Addendum.

You're in control. You can revoke AI consent any time from Profile → AI consent. Revocation is immediate: every AI surface in the app (voice mic, chat, receipt scan, insight cards, monthly report generation) stops functioning until you opt back in, and no further data is sent to OpenAI.

Pockita's code calculates your budget status and monthly totals and gives them to the model, so it doesn't have to work them out. To answer other questions, chat reads your recent transactions and may add amounts up itself.

Where data is stored

Your data lives in Pockita's own PostgreSQL database, on a server we run with OVHcloud in Hillsboro, Oregon (United States). Only you, via your authenticated session, can read or write it: our API checks on every request that the data belongs to you. Everything between the app and our server is encrypted in transit, and our backups are encrypted at rest. Our team accesses the server only for support and reliability work.

Until September 26, 2026, Pockita's database was hosted by Supabase. A frozen copy of the data from that date stays with Supabase until we delete the old project.

Third-party services we share data with

Pockita uses the following processors to operate the app. Each is bound by a contract requiring privacy protections equivalent to or stronger than those described here.

• OVHcloud- hosts the server that runs Pockita's database, sign-in, and API, in Hillsboro, Oregon. Holds your account and all financial data you enter.
• Cloudflare, Inc. - stores our encrypted database backups (Cloudflare R2).
• Supabase, Inc.- hosted Pockita's database and sign-in until September 26, 2026. Keeps a frozen copy of the data from that date until we delete the old project.
• OpenAI, L.L.C. - AI processing for voice and typed quick add, receipt scanning, AI chat, insight cards, and the monthly AI report. See the AI section above for what is shared, when, and your opt-out.
• RevenueCat, Inc. - subscription management. Receives a hashed identifier and your purchase receipts; never your payment card.
• Apple Inc. and Google LLC - billing and push notification delivery on iOS and Android respectively. Receive your payment information directly (we never store it) and a push token if you opt into notifications.
• PostHog Inc. - anonymous product analytics and crash telemetry. We do not send your name, email, or financial data to PostHog.
• Resend (Plus Five Five, Inc.) - sends account and product emails. Receives your email address and what each email contains, such as your first name and, for billing emails, your plan and renewal date.
• Expo(650 Industries, Inc.) - delivers push notifications through Apple and Google. Receives your device's push token and the text of each notification.

What we don't do

• We don't sell your data. Ever.
• We don't share it with advertisers, brokers, or third parties beyond the processors listed above.
• We don't train AI models on your data. OpenAI doesn't either, per their API terms.

Your rights

You can, at any time:

• Export every transaction as CSV (Profile → Export CSV).
• Edit or delete any individual record from the app.
• Delete your account permanently (Profile → Danger zone → Delete account). This wipes your row and every piece of data tied to it.

Your legal rights (GDPR / UK GDPR / CCPA)

Depending on where you live, you have additional rights under privacy laws like the EU's General Data Protection Regulation, the UK GDPR, and California's Consumer Privacy Act. These include:

• Access: request a copy of the personal data we hold about you.
• Rectification: ask us to correct anything inaccurate.
• Erasure: ask us to delete your data (you can do this yourself in-app, or email us if you can't).
• Portability: get your data in a machine-readable format. CSV export covers transactions; for the rest, email us.
• Object / restrict: limit how we process your data, or opt out of specific uses.
• Lodge a complaint with your local data protection authority. For California residents, the rights to know, delete, correct, and not be discriminated against under CCPA apply.

We don't sell or share personal information for cross-context behavioural advertising under CCPA, so there's nothing to opt out of on that front. Email privacy@pockita.com to exercise any of these rights, we respond within 30 days.

How long we keep your data

We keep your data while your account is active. When you delete your account, we wipe it from our live database immediately. Any encrypted backups containing prior states roll off within three months. The frozen copy at Supabase (see above) is deleted with the old project. Aggregated, fully anonymous metrics (e.g. “X total users this week”) may persist beyond that.

International data transfers

Pockita is operated from the United States. If you use the Service from outside the US, your data is transferred to and processed in the US (and other countries where our processors operate). Where required, we rely on Standard Contractual Clauses or equivalent safeguards.

Subscriptions

Subscription billing is handled by Apple (iOS) and Google (Android) via RevenueCat. We never see or store your payment information.

Children

Pockita is not intended for users under 13. We don't knowingly collect data from children.

Contact

Questions, requests, or concerns: support@pockita.com.