PockUp
Privacy Policy
Effective date:
- We collect only what PockUp needs to work: your account details and the entries you add.
- We don’t sell your data, we don’t show ads, and we don’t read your SMS, bank or UPI apps.
- All data between your device and PockUp is encrypted in transit (HTTPS/TLS).
- You can download your data at any time and delete your account, with all its data, from Settings.
1. Who we are
PockUp is a product of Zetway (“we”, “us”). This policy covers the PockUp website (pockup.in), the PockUp web app (app.pockup.in) and the PockUp mobile apps for Android and iOS. Zetway is responsible for your personal data as the data fiduciary under India’s Digital Personal Data Protection Act, 2023.
2. Data we collect
| What | Details | Why |
|---|---|---|
| Account | Name and email address. If you use a password, we store only a secure one-way hash of it. If you sign in with Google, we store your Google account ID. | To create your account and sign you in. |
| Your entries | Expenses and income you add: amount, category, description, date, whether it came from chat or an import, and the message you typed for that entry. | This is the core of PockUp: history, insights, answers and exports. |
| Follow-up questions | When PockUp needs more detail (for example a missing amount), it keeps your unfinished message for a short time until you reply. | To complete the entry. It expires automatically. |
| Reminder settings | Your time zone, reminder time and whether the daily summary is on. | To send reminders at the right local time. |
| Device token (mobile apps) | A push notification token and the platform (Android or iOS). | To deliver reminders and important notices to your phone. |
| Verification codes | One-time codes for verifying your email or resetting your password, stored only as hashes. They expire after 10 minutes. | To confirm it’s really you. |
| Technical data | IP address and basic request information, processed when you use PockUp. | To keep the service secure and to limit abuse, such as repeated failed sign-ins. |
What we don’t collect
- We don’t read your SMS, contacts, photos, bank accounts, UPI apps or cards.
- We don’t store your chat conversation on our servers. The recent chat shown in the app is kept only on your own device. We store the entries that come out of it.
- We don’t store voice recordings. See voice input below.
- We don’t use advertising or cross-site tracking.
Voice input
When you use the microphone, speech is converted to text by your device’s or browser’s speech recognition service (for example, Google’s speech services on Android or in Chrome, or Apple’s on iPhone and Safari). PockUp receives only the resulting text, never the audio. That conversion is handled under the speech provider’s own privacy policy.
3. How we use your data
- To provide PockUp: saving entries, answering your questions, showing history and insights, and exporting or importing files.
- To send the emails you need, such as verification codes and password resets.
- To send notifications you can control: the daily reminder and summary, and occasional important notices about PockUp.
- To keep PockUp secure, prevent abuse and fix problems.
We do not sell your personal data, rent it, or use it for advertising.
4. How the AI works with your messages
To understand messages like “tea 20, auto 120”, PockUp sends the text of your chat message and today’s date to our AI provider, OpenAI. We do not send your name, email or account details with it. We ask OpenAI not to store these requests, and under OpenAI’s API terms, data sent through their API is not used to train their models by default.
Many simple messages are understood directly by PockUp without calling the AI at all. Answers to questions such as “how much did I spend last month?” are calculated from your own entries in our database, not by the AI.
AI can occasionally misread a message. Every saved entry is shown to you straight away so you can edit or delete it.
5. Service providers we use
We share data only with providers that help us run PockUp, and only what each one needs:
| Provider | Purpose | Data involved |
|---|---|---|
| OpenAI | Understanding chat messages | The message text and today’s date |
| Google (Sign-In) | “Continue with Google”, if you choose it | Google confirms your name, email and account ID to us |
| Google (Firebase Cloud Messaging) | Delivering push notifications to the mobile apps | Device token and the notification text |
| Email delivery provider | Sending verification and password-reset emails | Your email address and the code |
| Cloud hosting provider | Running our servers and database | The data described in this policy, stored on our behalf |
We may also disclose data if Indian law requires it, for example in response to a valid legal order, or to protect the safety and rights of our users and of Zetway.
6. How we protect your data
- Encryption in transit: all traffic between your device and PockUp uses HTTPS (TLS).
- Password safety: passwords and verification codes are stored only as one-way hashes (bcrypt), never in plain text.
- Session protection: on the web, your session is kept in a secure, HttpOnly cookie that page scripts can’t read. You can sign out of all devices at once from Settings.
- Abuse protection: sign-in attempts and other sensitive actions are rate-limited.
- Limited access: only the people who operate PockUp can access production systems, and only when needed.
No system is perfectly secure. If a data breach affects you, we will inform you and the relevant authorities as Indian law requires.
7. How long we keep it
- Account and entries: for as long as you keep your account. When you delete your account, it and all its entries, settings and device tokens are permanently deleted from our database straight away.
- Follow-up questions: deleted automatically after a short time.
- Verification codes: expire after 10 minutes.
- Backups: if a copy of your data exists in a backup, it is removed when that backup expires. Backups are never used to restore a deleted account.
8. Your rights and choices
Under India’s Digital Personal Data Protection Act, 2023, and in line with good practice everywhere, you can:
- Access and download your data: export everything as Excel or PDF from Settings.
- Correct your data: edit any entry in History.
- Delete your data: delete single entries, or your whole account from Settings. See how to delete your account.
- Control notifications: change the reminder time or turn the daily summary off in Settings, or turn notifications off in your phone’s settings.
- Withdraw consent: stop using PockUp and delete your account at any time.
- Raise a grievance: contact us (below). If you are not satisfied with our response, you can complain to the Data Protection Board of India.
9. Cookies and local storage
This website (pockup.in) uses no cookies, analytics or trackers. It remembers your light or dark theme choice in your browser’s local storage.
The web app (app.pockup.in) uses a single essential cookie to keep you signed in. It also uses your browser’s local storage for your theme and your recent chat messages. We use no advertising or analytics cookies.
10. Children
PockUp is meant for adults. It is not directed at children under 18, and we do not knowingly collect their data. If you believe a child has created an account, contact us and we will delete it.
11. Where data is processed
Some of our service providers, such as OpenAI and Google, may process data on servers outside India. When this happens, we rely on providers with strong security commitments, and we only send the data each one needs.
12. Changes to this policy
If we change this policy, we will update the effective date above. If a change is significant, we will tell you in the app or by email before it takes effect.
13. Contact and grievances
For privacy questions, data requests or complaints, write to:
Zetway — PockUp Privacy
Email: support@pockup.in
We aim to reply within 7 days and to resolve grievances within the time Indian law requires.