The short version: we don't want your data.

You give us: your email (for sign-in and the emails in section 2), the first name you enter, the transactions you log, the envelopes, pay cycle, bills, instalment plans and goals you set up, what you add to a Together space you share, the text read from receipts and statements you scan or import (and a statement PDF, if you import one), any photo you attach to a goal or an instalment plan, and the feedback you send us.

We collect automatically: product analytics tied to your account (which screens you open and which features you use, whether a scan succeeded), with your email, name, language, region and currency on your analytics profile. Amounts appear only in rough bands, like 10 to 50, with one exception: older versions of the app sent the exact income you entered when you re-planned a cycle. Merchants and notes never appear. The country you're in, from the one you choose in the app or from your connection. Your subscription status from Apple or Google, through RevenueCat. Basic device and app details, like the app version and operating system.

We do NOT collect: bank credentials, SMS messages, contacts, precise location, browsing history, or your iPhone's advertising identifier without your explicit consent (you'll see an iOS prompt the first time an ad is due; denying it switches ads to non-personalized). On Android, the advertising ID is controlled in your phone's Settings, under Privacy, then Ads.

Your transactions and envelopes power your own app experience. Analytics help us understand which features people actually use. Crash reports that Apple and Google pass on, from phones set to share them, help us fix bugs.

We don't profile, score, or rank you. We never sell your transactions, envelopes, amounts, merchants or notes, and never share them with anyone for their own use. Apart from the person you share a Together space with, the one place any of it leaves our systems is the AI features in section 3, where Google processes it on our behalf to write an answer.

Emails. We email you your sign-in codes. Through 8xSend, our email service, we also send emails about your account and subscription, like a trial ending or a payment that failed, and, unless you turn off Product emails in Settings, tips, new features and occasional offers. 8xSend gets your email address, first name, language, country and plan, and events like signing up, starting or cancelling a subscription, or not logging anything for a while.

Measuring our own ads. When we advertise PocketPal on Facebook, Instagram or TikTok, we tell that network when someone installs or opens the app, signs up, finishes setup, logs a third expense, starts a trial or subscribes, so we only pay for ads that work. This is sent from every phone outside the regions named at the end of this paragraph, whether or not you came from an ad: it is how the network tells which installs its ads brought in. Meta is also told when a subscription renews; TikTok is not. Trial and subscription events can carry the plan's price. These signals carry a random install ID, basic device details (like the model and operating system), an advertising identifier where the phone makes one available, and, for Meta subscriptions, a scrambled (hashed) copy of your email and account ID so Meta can match it. We send TikTok no email or account ID at all. On iPhone, your advertising identifier, and the email and account ID Meta matches subscriptions with, are only shared if you allowed tracking. If you didn't, the network gets the event without them. None of your money data goes with it. Meta's software in the app also reports its own crashes to Meta. We don't send either network anything at all from phones set to a region or time zone in the EEA, the UK or Switzerland.

Four features use an AI model, Gemini Flash by Google. Each sends only what it needs, only when you use it:

• Receipt scanning. On-device OCR (Google ML Kit) reads the receipt on your phone; the photo never leaves it. Only the recognised text is sent, with the names of your envelopes.
• Statement import (PocketPal+). From a photo, it works like scanning: the text is read on your phone and only the text is sent, never the image. A PDF is sent to our server, which pulls out its text and discards the file; that text is then sent. A CSV is read entirely on your phone and goes to no AI at all. Nothing from the statement itself is stored, only the expenses you choose to add.
• Your cycle recap (PocketPal+). Totals for the current pay cycle, your envelope names and goals. No individual transactions, merchants or notes. We keep the recap Gemini writes so the same one isn't written twice; it is deleted with your account.
• Pal, the in-app assistant. Pal asks your permission once before anything is sent. Then, each time you ask something: your question, the last few messages, and a summary built on your phone of your envelopes, bills, goals and recent spending (names, amounts, shops and dates). Never your notes, receipt photos, name or email. We don't store your questions or Pal's answers on our servers; the conversation is saved only on your phone, and you can clear it at any time.

Google processes these requests on our behalf. Google's terms for the paid Gemini API say that what we send isn't used to train its models, and that Google keeps it for a limited time only to detect abuse. For each request we record that it happened and what it cost, never what it said.

A savings goal or an instalment plan can carry a picture you choose from your photo library. Unlike a receipt, this one is uploaded and stored, because the whole point is that it is still there on your next phone. It is resized on your device before it is sent, and location and camera metadata are stripped.

These photos live in private storage. Nobody can read one without being signed in as you, enforced by the database rather than by our app code. If you share a goal inside a shared space, the picture becomes readable by the other members of that space, and only them.

Removing the picture deletes the file. Deleting your account deletes your own pictures; a picture on a shared goal stays with that space. We do not scan, analyse, or train anything on these images.

Now and then the app may invite you to a short interview about PocketPal, run by our research partner 8xResearch. It is optional and only starts if you tap it. You can answer by typing or by voice; the microphone is used only if you choose voice, and iOS or Android asks your permission first.

Your answers (and the recording, if you speak) go to 8xResearch so we can read them. They are tied to a random ID for this install, not to your account: we don't send 8xResearch your email, your account ID, or any of your money data. We use the answers only to improve PocketPal.

• Supabase, authentication, database (Postgres with row-level security), and private file storage for goal and instalment photos.
• Vercel, hosting for our backend API routes and this website, and the cookie-free visit counts on this website.
• Google (Gemini API), the AI features in section 3: receipt scanning, statement import, the cycle recap and Pal.
• RevenueCat, subscriptions: your purchases, tied to your account ID, email and name. It also passes subscription events to Meta (section 2).
• PostHog (EU), product analytics, feature switches and experiments, tied to your account ID, email and name.
• 8xSend, the emails in section 2: your email address, first name, language, country, plan and account events.
• Resend, sending our replies when you write to us through the contact form.
• Expo, delivering app updates: the app version and a random install ID, nothing about you.
• Google AdMob, advertising on the free tier (removed on Premium).
• Meta (Facebook and Instagram), measuring whether our ads lead to installs, sign-ups and subscriptions. Never your money data, and not used in the EEA, the UK or Switzerland.
• TikTok, measuring whether our ads lead to installs, sign-ups and subscriptions. Never your money data, no email or account ID, and not used in the EEA, the UK or Switzerland.
• 8xResearch, optional in-app research interviews (typed or voice answers). No email, account ID or money data.
• Apple / Google, payments and app distribution.

You can delete your account from Menu → Settings → Your data → Delete account; this erases your sign-in, your profile, and all your envelopes, transactions, pay cycles, goals, instalment plans and your own goal and instalment photos. Until then, we keep your data for as long as your account exists.

What remains after a deletion: a short record that the account was deleted (its account ID, email and plan), so a subscription that keeps billing can still be traced; daily activity counts, subscription revenue records and AI cost records that carry the account ID and nothing you logged; and any message you sent through the contact form. Analytics in PostHog and purchase history in RevenueCat are not deleted by this; email support@pocketpal.me to ask for that. 8xSend is told the account was deleted, so it stops emailing you and purges its copy of your data.

Deleting the app is not the same as deleting your account. Uninstalling removes PocketPal from your phone; your data stays in your account so a reinstall restores it. Use Delete account if you want it gone.

You can take your data with you at any time: Settings → Your data → Export transactions (CSV) writes every transaction you have ever logged, and it deliberately ignores the free tier's history limit. The data is always yours.

If you're in the EU (GDPR), Brazil (LGPD), or India (DPDP), these rights are guaranteed by law. Use the contact form if you need help.

pocketpal.me uses PostHog analytics, which sets a cookie to tell one visit from the next and records the pages you view and how you use the site, and Vercel Web Analytics, which counts visits without cookies. No advertising cookies. No cross-site tracking. The mobile app uses no cookies, it's an app.

PocketPal is for ages 18+. We don't knowingly collect data from anyone under 13.

If we change anything material, we'll notify you in-app before the change takes effect.

Privacy questions, data requests, complaints, use the contact form or email support@pocketpal.me. A human reads every message.