PocketSmart Privacy Policy

Last updated: October 19, 2026

This policy describes how PocketSmart handles information in the PocketSmart mobile application.

PocketSmart helps users plan spending, track expenses, and work toward savings goals. This Privacy Policy explains what information we collect, how we use it, and the choices available to you.

1. Information we collect

Depending on how you use PocketSmart, we may collect:

Account information: your name, email address, and account identifier. The current release does not request a phone number during signup.
Authentication information: your email and password are processed by Firebase Authentication. PocketSmart does not store or display your password in plain text.
Financial-planning information: allowance or budget amounts, spending frequency, balances, savings goals, target amounts, priorities, progress, expense amounts, merchant or expense names, and categories that you enter. This includes income and refund records and optional free-text expense notes.
Authentication and service metadata: Firebase Authentication processes IP addresses for security and abuse prevention, user-agent information such as SDK version and device platform, and the Firebase Android App ID (which identifies the app, not an individual device). Our use of Firebase Authentication and Google sign-in also associates authentication identifiers with your account.

PocketSmart does not ask for precise location, contacts, photos, camera, microphone, or bank-account credentials. Please do not enter full payment-card numbers, bank passwords, government IDs, or other highly sensitive information into free-text fields.

Optional Android SMS tracking: after you accept the in-app disclosure and grant Android SMS permission, PocketSmart processes new financial transaction alerts on your device, including while the app is closed. Supported alerts record expenses, income, and refunds and update your available balance. Message text and sender details are processed locally and are not uploaded to PocketSmart's Firebase database. Extracted transaction details, including amount, merchant, date, category, transaction reference, account suffix, and duplicate-detection identifiers, are saved to your account using Firebase.

Optional iOS Shortcut imports: after you agree in Profile, a user-created Apple Shortcuts Message automation can automatically forward matching new SMS messages to PocketSmart, including while the app is closed. Configure it for your bank sender or transaction keywords. Raw message text is processed on your device and is not uploaded. Transaction details including amount, merchant, date, category and duplicate-check identifiers are saved to your account using Firebase. PocketSmart cannot read your SMS inbox. This is optional: turn imports off in Profile and disable or delete the automation in Shortcuts to stop forwarding messages. Manual transaction entry remains available.

SMS access is optional. You can decline access, turn tracking off in Profile, revoke access in Android Settings, and enter transactions manually. Automatic tracking processes messages received after it is enabled; it does not automatically import older messages. You can separately choose to paste a transaction message and confirm its extracted details before saving a manual import. Pasted message text is also processed on the device.

This release does not provide user-to-user messaging. Local conversation previews left by earlier preview builds are removed by the in-app account-deletion flow or can be removed by clearing PocketSmart app storage in Android Settings.

2. How we use information

We use information to:

create and secure your account;
save and display your budgets, expenses, goals, and progress;
calculate balances, savings projections, and goal progress;
provide support and respond to requests;
maintain, troubleshoot, secure, and improve the app; and
comply with legal obligations and enforce our terms.

3. Services we use

PocketSmart uses Google Firebase Authentication and Cloud Firestore to provide sign-in and cloud data storage. Google sign-in is an optional alternative to email/password signup; deleting a Google-linked PocketSmart account does not delete your Google account or other Google services. Firebase may process information on our behalf, subject to its own terms and privacy practices. You can read Google’s privacy information at policies.google.com/privacy.

Some goal illustrations may be loaded from third-party image hosts, including Unsplash. Those services may receive normal technical connection information, such as your IP address. Their own policies apply to those requests.

4. How we share information

We do not sell your personal information and we do not use your financial planning data for advertising. We may share information only with:

service providers that host, secure, or operate PocketSmart;
professional advisers or authorities when legally required; or
a successor in connection with a merger, acquisition, or sale of assets.

5. Data retention and deletion

We retain your account profile and saved app records while your account is active. You can delete the account in Home > profile icon > Delete account, verify your identity, and confirm permanent deletion. Successful deletion stops SMS tracking, removes the active account profile, budgets, goals, transactions and SMS-derived review, processing, reference and merchant-rule records, and deletes the Firebase Authentication user. It also clears the saved app session, the local SMS queue, and this account's local conversation-preview records. Deletion does not remove messages from your phone's SMS app.

You do not need the app installed to request deletion. Email pcktsmart@gmail.com from your account email address with the subject PocketSmart Account Deletion Request. Support verifies ownership before deleting the associated account data. Do not send passwords or verification codes. See our account-deletion page for the full instructions and data categories.

We do not impose an additional waiting period on the active account records removed when in-app deletion completes successfully. If a connection interrupts deletion, retry to finish removing the remaining records. Email requests require ownership verification and support processing.

Service-provider retention is separate from removal of the active PocketSmart account. Firebase states that authentication information is removed from its live and backup systems within 180 days after user deletion is initiated, and logged IP addresses are retained for a few weeks. See Firebase's privacy and retention information. Deleted PocketSmart credentials cannot be used to sign in while provider-managed deletion is completing.

6. Security

We use reasonable administrative, technical, and organizational measures to protect information. No internet transmission or electronic storage system is completely secure, so we cannot guarantee absolute security.

7. Your choices and rights

Depending on where you live, you may have rights to access, correct, delete, or restrict the use of your personal information. Contact us to make a request. We may need to verify your identity before completing it.

8. Children’s privacy

PocketSmart is not intended for children under 13, and we do not knowingly collect personal information from children under 13. Contact us if you believe a child under 13 has provided personal information through PocketSmart.

9. Changes to this policy

We may update this policy when the app, its services, or applicable law changes. We will post the updated version on this page and update the “Last updated” date.

10. Contact us

For privacy questions or data-deletion requests, email pcktsmart@gmail.com.