PocksyPrivacy Policy
Last updated: November 2026
This policy explains what Pocksy (“we”, “us”) does with your information when you use the Pocksy Android app (package com.pinakilab.expensetracker). Pocksy is an expense tracker for people in India. We wrote this to be read, so we keep it plain. If something here is unclear, email us at xpense.pinaki@gmail.com.
The short version
- Your expenses are stored in an encrypted database on your phone. We do not keep a copy on our servers.
- Pocksy reads transaction SMS on your phone to create expenses. The SMS text is not sent to our servers.
- We never ask for your bank login, card number, UPI PIN or OTP.
- We do collect limited usage and crash data to run and improve the app. This includes the amount of an expense in some events, and the brand of a merchant (for example a well-known shop or app) but never the name of a person you paid. Details are in section 3.
- We do not sell your data and we do not show ads.
1. Who we are
Pocksy is built and operated by an independent developer in India. You can reach us, and our grievance contact, at xpense.pinaki@gmail.com.
2. Information that stays on your phone
This is the core of the app. It is stored locally in an encrypted database (SQLCipher) and is not uploaded by us:
- Expenses and income you add or approve: amount, date, category, merchant or note, payment mode, tags.
- Transaction SMS. With your permission (
READ_SMS,RECEIVE_SMS), Pocksy reads messages that look like bank, card or UPI alerts. It reads them on your phone to find the amount, merchant and date. The message text itself is not sent to us. - Budgets, trips, splits and Khata entries, including names of friends you type in.
- Your profile name and settings.
- Location (optional). If you allow location, Pocksy can tag an expense with where it happened and show it on a map. Coordinates are stored in your local database. Turning off location permission stops this.
- Microphone (optional). If you use voice entry, Pocksy uses Android’s speech recognition to turn what you say into an expense. Android may process the audio using Google’s speech service according to your device settings. Pocksy does not record or keep the audio.
The app also asks to show notifications, for example to confirm a detected expense or to remind you about recurring ones. You can turn them off in your phone settings.
3. Information we collect
To run Pocksy and fix problems, the app sends the following to the services listed. These services process data for us under their own terms.
| What | Why | Service |
|---|---|---|
| Usage analytics: screens opened, buttons used, and actions such as saving an expense or approving a detected one. Some events include the amount, category and payment mode. Detected-SMS events include the amount and the merchant brand only; if the payee is a person, it is recorded only as “P2P transfer”, and unrecognised merchants are recorded as “Other”. A random ID generated on your device links these events. Your name is not included. | Understand which features work and fix the app’s parsing and categories | PostHog (servers in the United States), Firebase Analytics (Google) |
| Crash and performance reports: device model, Android version, app version, and the technical details of a crash | Find and fix bugs | Firebase Crashlytics (Google) |
| Account identifier: an anonymous Firebase ID, or your Google account ID if you choose to sign in with Google | Subscriptions, referrals, and restoring Pro on another device | Firebase Authentication (Google) |
| Subscription records: purchase token, product, renewal status | Unlock and restore Pro. Card and UPI payment details are handled by Google Play and never reach us. | Google Play Billing, Cloud Firestore |
| Referral data: your referral code, an optional public alias, whether your profile is public, and referral counts. Also the Play install referrer (the link a new install came from). | Run Refer & Earn and leaderboards | Cloud Firestore, Google Play Install Referrer |
| Push notification token | Deliver notifications | Firebase Cloud Messaging |
| Device and app information: app version, Android version, language, approximate region from your network | Compatibility and analytics | Firebase, PostHog |
We do not collect your SMS text, your bank or card details, your contacts, your photos or your exact location through these services.
4. Backup you control
If you turn on Google Drive backup, Pocksy saves a copy of your data into a private, hidden folder in your own Google Drive that only Pocksy can open (the “app data” folder). We cannot see it. You can turn backup off and delete the file from your Drive. You can also export or restore a file yourself on your device.
5. How we use information
- To provide the app: detect, categorise and show your expenses, budgets and reports.
- To process subscriptions and referrals.
- To measure how the app is used and to find and fix errors.
- To answer support requests.
- To meet legal obligations.
We do not sell personal data, we do not use it for advertising, and we do not use your transactions to profile you for lenders or insurers.
6. Sharing
We share data only with the services in section 3 (as our processors), if the law requires it, or to protect the app from fraud and abuse. If you share a card, report or invite link from the app, it goes where you send it. You control that.
7. Where data is processed
Our service providers (Google, PostHog) may process data outside India, including in the United States. We rely on the contractual protections those providers offer.
8. How long we keep it
- Data on your phone stays until you delete it, use “Clear all data” in the app, or uninstall Pocksy.
- Analytics and crash data are kept for as long as needed for the purposes above and then deleted or anonymised.
- Subscription and referral records are kept while your account or the programme is active and as needed for accounting and fraud prevention. You can ask us to delete them (section 10).
9. Security
Local data is encrypted on your device. Data sent to our providers travels over encrypted connections. No system is perfectly secure, so we also recommend using your phone’s screen lock. Pocksy supports a biometric lock in the app.
10. Your choices and rights
Under India’s Digital Personal Data Protection Act, 2023 and similar laws, you can ask to access, correct or delete your personal data, withdraw consent, and make a grievance. To do this:
- Use the controls in the app: change or revoke SMS, location, microphone and notification permissions in your phone settings; turn off Drive backup; use “Clear all data”.
- For data we hold on our servers (analytics, subscription and referral records), email xpense.pinaki@gmail.com with the referral code or account details shown in the app. We aim to reply within 30 days.
- Withdrawing SMS permission means Pocksy can no longer detect expenses automatically, but you can still add them by hand.
11. Children
Pocksy is meant for adults aged 18 and over. We do not knowingly collect data from children. If you believe a child has used the app, email us and we will delete the data.
12. Third-party links and services
The app may link to Google Play, Google Drive and your phone’s share sheet. Their own privacy policies apply once you leave Pocksy.
13. Changes to this policy
If we change how we handle data, we will update this page and the date above. For significant changes we will also tell you in the app.
14. Contact
Questions, requests or complaints: xpense.pinaki@gmail.com.