Privacy Policy

This policy explains how we handle data in the PocketPal Android app and on our public PocketPal and Wandera Labs websites. Features and recovery options can differ between app versions. Contact bewanderalabs@gmail.com with privacy questions.

Account and profile

Google Sign-In and Firebase Authentication use your account identifier, email, display name and available profile photo for authentication, profiles, backup association and household membership. Authentication providers also process connection and security information such as IP addresses. PocketPal does not request access to your Gmail messages, calendar or contacts. Drive access is limited to the app-data area used for PocketPal backups and Notebook sync.

Finance, planning and household records

Records you enter include budgets, expenses, income, debts, savings, recurring payments, notes and reminders. Core records are stored locally. Cloud backup sends an encrypted copy and backup metadata to Firebase. Family Sharing sends selected household records, member names and emails, roles, invitations, activity and receipt attachments to Firebase and makes shared records available to household members according to permissions. Shared household data is not covered by a promise of end-to-end encryption.

Camera, receipts and selected photos

The receipt scanner uses Google ML Kit to recognize text on your device; that scanner does not upload the receipt image for recognition. Saving the resulting expense can include it in later backups. If you separately attach a receipt to a shared household record, the image is uploaded to Firebase Storage for that feature. Profile photos and Notebook attachments are used when you select them. These are different from scanning a receipt locally.

Voice entry and audio notes

Voice expense entry requests microphone permission and uses your device's speech-recognition service. On-device-only recognition is not enforced: depending on your device and provider, audio may be processed by the provider's servers. The recognized text is used to create an entry. When Gemini is configured, that text may also be sent to Gemini for parsing. Notebook voice notes are recorded as local audio attachments. Files you choose to export or share are handled by the chosen destination. You can decline microphone permission and use typed entry instead.

Optional AI and currency conversion

When you configure Gemini with an API key and use its features, transaction text, recent spending, totals, limits and selected goals may be sent to Google Gemini for parsing or insights. This is not on-device AI. Google's API terms and your service configuration determine how those requests are handled. Currency conversion requests rates from an external provider using currency information and ordinary connection metadata, rather than your full transaction history.

Diagnostics, app activity and notifications

Firebase Crashlytics receives crash logs, stack traces, installation identifiers, device and app details, and diagnostic context to investigate failures. Firebase Analytics records app activity, including app opens and feature events. These records are not described as fully anonymous. Firebase Cloud Messaging uses installation identifiers and notification tokens for connected notifications. Premium does not automatically disable analytics, crash reporting or account services.

Ads and purchases

Ad-supported features use Google AdMob. Its SDK may collect and share advertising or other device identifiers, IP addresses (which can indicate approximate location), ad interactions and diagnostics for advertising, measurement and fraud prevention, subject to available consent and device settings. Premium removes the app's ads; it does not erase previously collected data. Google Play handles payment checkout. PocketPal handles purchase status, product identifiers, purchase tokens and Premium entitlement information, not your payment-card details.

Support and website visits

If you email us, we receive your email and the information you send so we can respond. Please do not send passwords, recovery secrets or backup files. Our website does not include an analytics or advertising script. Hosting providers still process ordinary request information, such as IP addresses, to deliver and protect the site. The canonical legal pages use local styles and system fonts without external font requests. Following links to Google Play or other services is subject to their policies.

Permissions we do not request

PocketPal does not request contacts, SMS, call logs, precise location or bank-login credentials. This does not prevent online providers from processing IP addresses or estimating approximate location. Photos and microphone access are used for the features described above, not claimed to be absent.

Current account-based backups

Current general backups use AES-256-GCM encryption before upload to Cloud Firestore, associated with your signed-in account. Current setup and supported restores use the same Google account without asking you to create a separate backup passphrase. This account-based design is not a zero-knowledge or end-to-end-encryption guarantee against the service operator. Protect your Google account and device access.

Older passphrase backups

Older backups may still require the passphrase originally used to create them. A successful legacy restore can migrate future general backups to account-based recovery. Keep the original passphrase until you have confirmed a successful restore and new backup; we cannot promise recovery of an old backup when its required passphrase is unavailable.

Security and its limits

PocketPal uses encrypted local storage for supported records, secure device storage for sensitive keys, and secure connections for its connected services. Exports, attachments, household sharing and AI requests have their own handling described here; not every file or transfer is an encrypted backup. No system can guarantee absolute security or recovery. Do not store bank passwords, full card numbers or identity documents in notes.

Storage locations

• Your device: finance records, settings, local Notebook content, selected media and temporary files.
• Google Firebase: account records, encrypted general backup versions and metadata, shared household records and receipt files, messaging, diagnostics and analytics.
• Your Google Drive app-data area: Notebook sync and older general backups used for migration. Deleting Drive data alone does not delete Firebase records.
• Your chosen destinations: exported or shared files may remain wherever you save or send them.

Other recipients

Your device's speech provider may process voice recognition. The exchange-rate provider processes rate requests. Household members receive records you share, and email providers handle support correspondence. We do not sell personal data for payment. Advertising-related disclosures are described above rather than excluded by that statement. Information may also be disclosed where required by law, to address abuse or security incidents, or in a business transfer with notice where required.

Retention

Local records remain until deleted, reset or removed with the app. PocketPal automatically removes an inactive PocketPal login and its personal Firebase cloud data after two calendar months without server-observed use, subject to necessary legal, security and dispute records. Activity includes sign-in, refreshed Firebase sessions, foreground use synced by supported app versions and new financial backups. Connect to the internet while using PocketPal to keep your cloud account active; offline-only use cannot be observed by the server.

Existing accounts receive a fresh two-month observation window when this policy is activated. Cleanup runs daily, disables an eligible login and allows old sessions to expire before permanently removing personal backups (including versions), profile data and the PocketPal login. Local data and exported copies remain. Deleting the PocketPal login does not delete your Google account. Shared household records and receipts remain available to other household members; returning users may need a new household invitation.

Private Google Drive app-data backups are separate and remain under your own Google Drive controls. Shared referral records and minimal necessary security or dispute records may remain; completed cleanup markers expire after 30 days. Diagnostic, analytics, advertising and messaging retention depends on the relevant service and its settings. You can also request deletion through support. Contact us for the scope of a specific request.

• Use guest mode for local finance tracking, and sign out of connected account features when not needed. Guest mode does not itself turn off ads or diagnostics.
• Manage camera, microphone and notification permissions in Android settings; manage advertising choices through available app consent controls and Android ad settings.
• Choose what to share with a household and review its membership and permissions.
• Use available PDF or CSV report exports and local data controls in Settings.
• Request access, correction or deletion of account-linked data by emailing bewanderalabs@gmail.com from the Google email used with PocketPal. Specify account data, cloud backups or both. We verify the request before changing cloud records.

Deleting your PocketPal account does not delete your Google account. Support can process a verified request for the Firebase account record, general cloud backups and applicable account-linked data. Shared household records need separate review because other members may still use them. Necessary legal, security or dispute records, and copies held by other people, may remain. Uninstalling, clearing local data, signing out or revoking Google access does not automatically erase Firebase data or existing Drive backups. Manage PocketPal's hidden app data through Google Drive settings for Drive copies. Deletion requests do not cancel Google Play subscriptions; manage those separately in Google Play.

Your rights depend on applicable law. Contact us about access, correction, deletion or objections to processing. You may also have the right to contact your local data-protection authority.

Children

PocketPal is not directed to children under 13. If you believe a child has provided personal information, contact us so we can investigate and take appropriate action.

International processing

Google and other providers may process information outside your country, including outside Kenya. Their terms, applicable protections and the services used govern that processing. This policy does not claim universal certification or compliance with every country's laws.

Changes

We publish updates here with a revised date. The app and website link to this policy. Material changes will be communicated as required by applicable law.