Privacy Policy
Effective date: 2026-06-28 Last updated: 2026-09-29
1. Who we are
Pocketz (the "App") is operated by Michael Ostrovskii ("we", "us", "our"), based in Israel. You can contact us at [email protected].
Pocketz is a virtual ledger for tracking allowances, chores, points, screen time, and other family "currencies." Pocketz does not hold, process, or transfer real money. All balances are virtual entries within the App.
2. Our privacy-first design: no sign-up, minimal data
Pocketz is anonymous by default. You do not sign up, and you do not give us your name, email, or password to use the App.
When you first open Pocketz, the App generates a random, meaningless account
identifier (for example, anon_4f3c…) and stores a secret key on your device
(in the system Keychain/Keystore) so the App can sign you back in automatically.
We do not ask for, and by default do not hold, a real-world identity tied to that
account.
That identifier is still pseudonymous data, and so is your IP address. Under the GDPR, pseudonymous data counts as personal data, and we treat it that way.
2.1 What we collect by default
| Category | Examples | Purpose |
|---|---|---|
| Anonymous account ID | App-generated identifier (anon_…) |
Identifies your data on our server; not linked to any real-world identity |
| Display name (optional) | A nickname you may type (e.g. "Alex") | Shown in the App and in shared accounts; you choose whether to set one |
| Ledger data | Virtual balances, deposits, withdrawals, recurring rules, account and currency names | Core feature |
| Sharing data | Invite tokens, shared-user permissions | Account sharing |
| Device/session | Access and refresh tokens, revoked-token list, device name | Keeping you signed in; letting you see and sign out your devices |
| Security signals | IP address, stored in session and audit records | Rate limiting, abuse prevention and investigation |
| Server logs | Request path, response status, timing, and your device's user-agent string. No IP address, name or email is written to these logs | Operating and debugging the service |
| Diagnostics | Crash reports and error events (via Sentry), tagged with your anonymous account ID plus device model, OS and app version. No name, email, username or IP address is sent | Reliability |
| Subscription (only if you use Pocketz Plus) | Plan (free or Plus), subscription status, trial and renewal dates, and the App Store transaction identifiers Apple issues for your purchase | Granting Pocketz Plus features and keeping them in sync with Apple |
The display name is a nickname, not verified contact information. Please do not enter a full legal name or other identifying details you don't want shown to people you share an account with.
2.2 What we collect only if you turn on Backup & Sync (optional)
Anonymous accounts live on the device. If you want to recover your account on a new device, you can optionally link Sign in with Apple or Google Sign-In under the "You" tab. Only if you choose this do we receive and store:
| Category | Examples | Purpose |
|---|---|---|
| Provider identifier | The stable user ID ("sub") from Apple or Google | Recovering/recognizing your account on another device |
| Email / name from the provider | Whatever Apple or Google passes us (with Sign in with Apple, this may be a private relay address) | Linking the backup to your account |
If you turn this on and are also a member of someone else's shared account, the owner of that shared account can see the email address we received from Apple or Google.
You can use Pocketz fully without ever enabling this.
2.3 What we never collect
Payment card data (Pocketz Plus purchases are processed entirely by Apple; we never see your payment details), bank details, government IDs, biometric data (Face ID / Touch ID / PIN are handled on your device only and never sent to us), precise location, contacts, photos from your library, or advertising identifiers. We use no third-party advertising or cross-app tracking SDKs.
3. How we use the information
- Operate the App and provide the features you request.
- Keep you signed in and protect your account (rate limits, token blacklist, session management).
- Improve reliability through crash and error reporting.
- Grant Pocketz Plus features and keep your subscription status in sync with Apple, including the renewal and cancellation notices Apple sends us.
We do not sell your data, not use it for behavioral advertising, and not run behavioral analytics. We send no marketing email (anonymous accounts have no email to send to).
4. Legal basis (EEA/UK users — GDPR)
| Purpose | Legal basis |
|---|---|
| Provide the App's features (anonymous account, ledger, sharing) | Performance of contract (Art. 6(1)(b)) |
| Optional Backup & Sync via Sign in with Apple / Google | Performance of contract; you choose to enable it |
| Pocketz Plus subscription status | Performance of contract (Art. 6(1)(b)) |
| Security, fraud prevention, rate limiting | Legitimate interests (Art. 6(1)(f)) |
| Crash/error reporting | Legitimate interests (Art. 6(1)(f)) |
5. Service providers
These providers process data on our behalf under contract (processors):
| Provider | Purpose | Region |
|---|---|---|
| Fly.io | Backend hosting and server logs | Frankfurt, EU |
| Neon (managed PostgreSQL) | Managed database and its backups | EU (Frankfurt) |
| Sentry | Crash & error reporting | EU (Germany) |
| Resend (transactional email only) | Transactional email, only where an email address exists | Global |
Apple and Google are not our processors. They act as independent controllers under their own privacy policies when they distribute the App, when you use Sign in with Apple or Google Sign-In (only if you enable Backup & Sync), and, for Apple, when you buy or manage a Pocketz Plus subscription. We verify their sign-in tokens and purchase records on our own server; we do not send them your ledger data.
6. Data retention
- Active accounts: retained while the account exists on our server.
- Deleted accounts: when you choose "Delete my account," your account, ledger data, shares, sessions and subscription record are deleted immediately. Audit records of past actions are kept only in anonymised form, with your account ID, IP address and any details removed. Deleting your account does not cancel a Pocketz Plus subscription; cancel it in your Apple ID settings.
- Security/session records and audit logs: retained for 30 days for abuse investigation, then deleted automatically.
- Backups: our database provider keeps restore history for 6 hours. We keep no other backups or snapshots, so deleted data is gone from every copy once that window passes.
Because anonymous accounts have no email or name, the practical way to delete your data is the in-app Delete my account action (under the "You" tab, in Danger zone).
7. Your rights
You may:
- Access the data we hold about your account.
- Correct inaccurate data (most fields, including your display name, are editable in-app).
- Delete your account and associated data (in-app, under "You").
- Receive a copy of your data in a machine-readable format (JSON), in-app under "You" → Download my data. It is free on every plan. If you can't use the App, email [email protected] and we will ask for details that let us find your account and confirm it is yours.
- Object to certain processing or lodge a complaint with your data protection authority.
For an anonymous account, the in-app controls are the fastest route. For anything else, contact [email protected]; we respond within 30 days. (Note: because we hold no real-world identity for anonymous accounts, we may be unable to locate your data from an email alone — please use the in-app controls where possible.)
8. Children
By default Pocketz collects no name, email, phone number, or other contact details from anyone, including children. The only identifiers we process by default are the random account ID and technical data (IP address, device details) described in section 2.1, used solely to run and secure the App. A child can use the App on their own device with an anonymous account, or be invited by a parent to a shared account, without providing personal data to us.
- The optional display name is a nickname and is not required.
- Backup & Sync uses Sign in with Apple / Google, which require an Apple/Google account governed by those providers' own age rules; it is an optional, opt-in feature.
- There is no chat/messaging, no photo upload of library images to us, no location collection, no advertising, and no behavioral profiling.
Because we do not collect personal information from children, the App is designed
to avoid the obligations that COPPA (US) and similar laws impose on services that
do. See COPPA_ASSESSMENT.md for our operational stance. If you believe a child
has provided us personal data, contact [email protected] and we will delete
it.
9. Security
We use industry-standard measures: TLS in transit; an app-held secret stored in the device Keychain/Keystore for anonymous sign-in; JWT access/refresh tokens with a server-side blacklist; rate limiting; security headers; and audit logging. No system is perfectly secure; we will notify affected users (where we have a way to reach them) of any breach within 72 hours where required.
10. International transfers
Our backend, database and crash reporting are hosted in the EU. Where data is transferred outside the EEA/UK (for example to our email provider), we rely on Standard Contractual Clauses or equivalent safeguards. Apple and Google process data under their own terms as independent controllers (see section 5).
11. Changes
We will notify you in-app of material changes at least 14 days before they take effect.
12. Contact
Michael Ostrovskii — [email protected]