Settings and your data

Everything you log in Pocketbird is written to your iPhone first. It works with no internet, and the cloud is an optional layer on top. Settings is where you decide how much of your data leaves the phone — and it holds the two buttons that can empty it.

Two rules run through the whole screen. Signing out does not merely sign you out — it erases this device back to a clean install. And withdrawing the cloud-sync consent stops all cloud processing of your money data at once: the app keeps working, it just stops talking to the server.

• The top of the screen is your account, then "Profile & Setup" / "โปรไฟล์และการตั้งค่า" — the salary, payday and reminder settings from first-run setup.
• "Privacy & Security" / "ความเป็นส่วนตัวและความปลอดภัย" holds App Lock and the PDPA consents; "Connected Apps" / "แอปที่เชื่อมต่อ" is the next row down.
• "Data" / "ข้อมูล" is sync, both exports, and the usage-statistics switch.
• The rest is "Display" / "การแสดงผล", "Siri & Shortcuts" / "Siri และคำสั่งลัด", "Feedback" / "ความคิดเห็น" and "About" / "เกี่ยวกับ" — plus the red delete row, which sits in a section of its own.

The first row of Settings is you: your avatar and your display name, with your email underneath. With no name set, the email becomes the main line and there is no subtitle. Tapping the row opens "My Profile" / "โปรไฟล์ของฉัน".

1. 1Settings → tap the account row at the top.
2. 2Tap the round avatar. A dialog offers "Choose New Photo" / "เลือกรูปใหม่", and "Remove Photo" / "ลบรูป" only when a photo already exists.
3. 3Type into "Your name" / "ชื่อของคุณ" under the "Display Name" / "ชื่อที่แสดง" section.
4. 4Tap "Save" / "บันทึก" in the top right.

• If Sign in with Apple is not linked yet, an Apple-branded "Continue" button appears, so you can add it and sign in without your password.
• If it is linked and you still have another method, you get a "Linked" / "เชื่อมแล้ว" row plus "Unlink Apple Account" / "ยกเลิกการเชื่อมบัญชี Apple", which asks for confirmation first.
• If Apple is your only sign-in method, no Unlink button is offered at all — an account must always keep at least one way in.
• Save is disabled until something actually changed. A failed save keeps the screen open and shows "Couldn't Save" / "บันทึกไม่สำเร็จ" rather than pretending it worked.

To change your password: Settings → "Account" / "บัญชี" → "Change Password" / "เปลี่ยนรหัสผ่าน". You fill in "Current password" / "รหัสผ่านปัจจุบัน", "New password (at least 6 characters)" / "รหัสผ่านใหม่ (อย่างน้อย 6 ตัวอักษร)" and "Confirm new password" / "ยืนยันรหัสผ่านใหม่", then tap "Update Password" / "อัปเดตรหัสผ่าน". The new password must differ from the current one, and your current password is verified by quietly re-signing you in.

Under "Display" / "การแสดงผล" there are only two rows, but the language one quietly decides how every date in the app is written.

Sync is what makes your ledger survive a lost phone and appear on a second one. It runs by itself: on launch, on every return to the app, after a save, when you sign in, and the moment the network comes back. The button in Settings is for when you want to be sure right now.

1. 1Settings → "Data" / "ข้อมูล" → "Sync with Supabase" / "ซิงก์กับ Supabase".
2. 2While it runs, a spinner and "Syncing…" / "กำลังซิงก์…" replace the status row.
3. 3When it finishes, "Last Synced" / "ซิงก์ล่าสุด" shows the date and time.

• One round pushes everything this device changed, then pulls everything newer from the server. That order is deliberate: the server sees your latest edits before it answers.
• When the same record was edited in two places, the later edit wins.
• Twenty tables ride sync — transactions, categories, tags, pockets, recurring rules, debts, trips, accounts, user settings, media assets, profiles, consent records, counterparties, pocket ledger entries, budgets, cycle overrides, holidays, recurring exceptions, account transfers and credit-limit groups.
• Slip and receipt photos and trip covers ride along as media assets, with the binaries in a private cloud bucket. Your profile avatar is not one of those — it travels on your profile row.
• While the app is open, signed in and cloud-sync-consented, a change made on another device wakes this one within about half a second and pulls it down.

Not everything travels. Appearance, app language, App Lock, every reminder and alert toggle, the group-activity push switch, the end-of-day cash check, Include Debts in Net Worth, the usage-statistics switch, your tab layout, your Summary card layout and your People pins are all device-only. They are preferences about this phone, not facts about your money.

• The sync button is greyed out for exactly three reasons: you are signed out, a sync is already running, or cloud-sync consent is withdrawn — and the third case says so, with "Sync is off per your consent — turn it on in Privacy (PDPA)" / "ปิดการซิงก์ไว้ตามความยินยอม — เปิดได้ที่ ความเป็นส่วนตัว (PDPA)".
• If a record you have open is deleted from another device mid-sync, the screen swaps live to "This item is no longer available." / "รายการนี้ไม่มีอยู่แล้ว" instead of showing stale numbers.

There are two exports, and they answer different questions. The JSON file is everything you own, for keeping or for handing to another tool. The CSV is just your transactions, flat and ready for a spreadsheet. Both read straight from the phone, so both work with no internet.

• The JSON holds transactions, categories, tags, pockets, debts, trips, recurring rules and their exceptions, accounts, account transfers, credit-limit groups, counterparties, pocket ledger entries, budgets, cycle overrides, holidays, your user settings (salary, payday, goal, weekend adjustment, round-up config, default account, quick-log labels) and your display name.
• Signed in and online, it also attaches a social section: the groups you belong to, shop entries you wrote, shared bills you paid or created, your own bill shares, and your shared-pocket contributions. Offline, that one section is simply left out.
• Deleted data is never in the export, and the file is deterministic — the same data exports byte for byte the same, with collections sorted by id and ISO-8601 dates.
• What the file says it does not include: binary media (transaction photos, trip covers, your avatar, shop receipts), co-members' data, third-party customer and supplier names, group payment-channel details, the consent log, and device-only preferences.

• The CSV header is fixed and never translated: date, type, amount, category, note, payment_source, id, tags, account, trip, debt, installment_number, is_adjustment, counterparty, recurring, needs_review, my_share. New columns are appended at the end, so an old sheet keeps working.
• A subcategory renders as a path, Parent › Child; a top-level category renders as its bare name; an uncategorised row leaves the cell empty. Tags are joined with |.
• A link that points at something you deleted degrades to an empty cell rather than an error — except counterparty, which falls back to the name stored on the transaction itself, so a deleted person or shop still reads.
• Timestamps are written yyyy-MM-dd HH:mm:ss in the Gregorian calendar even on a Thai-language device, and the CSV is deliberately not field-complete — the JSON bundle is the full format.

Under Thai data-protection law you have to be asked before your data is processed, and you have to be able to change your mind. Settings → "Privacy & Security" → "Privacy (PDPA)" / "ความเป็นส่วนตัว (PDPA)" is that screen: every purpose, its current state, the date and time you last changed it, and the policy version it was agreed under.

• Flipping a toggle takes effect immediately, and a sync is requested at once so the change reaches the server as the final word. If that write fails you get a "Couldn't Save" / "บันทึกไม่สำเร็จ" alert — a change is never lost quietly.
• Every section shows "Last Changed" / "เปลี่ยนล่าสุด" with a date and time, and "Policy Version" / "เวอร์ชันนโยบาย".
• The consent log is append-only: a grant or a withdrawal adds a new record and nothing is ever edited or erased. That is what makes the history above trustworthy.
• The consent log syncs even when cloud sync is off. It is consent metadata, not financial data, and it has to reach the server so a withdrawal made on one phone stops every device you own.
• The policy version is currently 2.0. When it changes you are asked again — an old grant does not carry over to a new version.
• At the bottom sit "Read the privacy notice" / "อ่านนโยบายความเป็นส่วนตัว" and "Privacy Policy" / "นโยบายความเป็นส่วนตัว".

The first time you sign in, a full-screen gate collects this before any financial data is recorded — title "Consent (PDPA)" / "ความยินยอม (PDPA)". Nothing is pre-checked, and only two toggles appear there: the required one, and cloud sync. The two AI-assistant purposes are deliberately not on the gate — they are asked for by the connect flow and managed here afterwards.

• Leaving cloud sync off at the gate shows a calm, not-red note: your data stays only on this iPhone and cannot be restored if you switch or lose the phone — and you can turn it on later in Settings.
• An optional purpose you leave alone is recorded as not consented yet, not as a refusal — so a freshly installed phone can never override a grant you made on another device.
• The privacy notice, the Privacy Policy and the Terms & Conditions are all readable before you consent to anything.

Two more switches sit outside the consent screen. One keeps other people out of your ledger; the other decides whether anonymous counts of which features you use are collected at all.

• What a usage event contains is an event name and a few short, fixed-choice properties. Never an amount, a note, a name, or anything you typed.
• Events are spooled to a file on the phone and uploaded in batches of 50; an upload fires automatically once 25 are waiting, plus at launch and on returning to the app. The spool is capped at 500 events.
• Opening the app is counted at most once every 60 seconds, so flicking through the app switcher does not inflate the number. No third-party analytics kit is used anywhere in the app.
• Crash and hang reports are a separate thing and are not covered by this switch. They come from Apple's own diagnostics, carry no user id at all, and contain only app and OS versions, the device model, the crash metadata and the call stack. One report is capped at 200,000 bytes and at most 20 wait on the phone.

These are the two red buttons, and they share the same erase underneath. Sign Out empties this phone but leaves your cloud copy alone, so signing back in restores it. Delete Account & All Data deletes the cloud copy first and then empties the phone, and nothing comes back.

1. 1Settings → "Account" → "Sign Out" / "ออกจากระบบ".
2. 2Read the confirmation, titled "Sign Out?" / "ออกจากระบบ?": "Signing out erases everything on this device. Synced data comes back when you sign in again." / "การออกจากระบบจะลบทุกอย่างในเครื่องนี้ ข้อมูลที่ซิงก์แล้วจะกลับมาเมื่อคุณเข้าสู่ระบบอีกครั้ง".
3. 3Confirm. A full-screen "Signing out…" / "กำลังออกจากระบบ…" backdrop holds until the erase has finished, then the sign-in screen appears.

• Before anything is erased, a last sync is requested and waited on, so pending local edits reach the cloud; any spooled usage events go up; and this device's push token is deleted from the server.
• The erase then removes every local record of every kind, all sync bookkeeping, the widget on your Home and Lock screen, queued hand-offs from the widget and share sheet, every pending notification, the Spotlight index and the analytics spool — and re-seeds the default categories, exactly like a fresh install.
• Two things survive on purpose, because they belong to this install rather than to your account: which build this phone is running along with the update cards it has dismissed, and whether the App Store rating prompt has already appeared here.

Deleting is the PDPA erasure right, and it lives in its own section at the bottom of Settings: "Delete Account & All Data" / "ลบบัญชีและข้อมูลทั้งหมด", with the footer "If you're signed in, you must be online so cloud data can be deleted first." / "ถ้าล็อกอินอยู่ ต้องออนไลน์เพื่อลบข้อมูลบนคลาวด์ให้สำเร็จก่อน". Confirming means tapping "Delete Permanently" / "ลบถาวร"; the row then reads "Deleting…" / "กำลังลบ…" while it works.

• The cloud delete runs first: any Sign in with Apple grant is revoked, then your account row is deleted and the deletion cascades through every table.
• If that step fails — offline, for instance — you get "Couldn't delete cloud data (you must be online): %@" / "ลบข้อมูลบนคลาวด์ไม่สำเร็จ (ต้องออนไลน์): %@" and nothing local is touched. The app refuses to leave you with a wiped phone and a live cloud copy.
• Only on success does the phone erase, using exactly the same wipe as sign-out. With the consent log gone too, the app returns to the consent gate by itself.
• Records you created inside shared groups may survive, as the privacy notice explains — they are part of other people's history too.

The bottom of Settings is the channel to the developer and the record of what you are running. Feedback goes straight to a person who reads it; the vote board is where the next feature gets chosen; About tells you exactly which build is on your phone.

• "Vote on What's Next" / "โหวตฟีเจอร์ถัดไป" lists the features being considered. One tap votes, a second tap takes it back, and it is one vote per person per poll. The count is hidden while it is 0, so your first vote is what makes a "1" appear.
• "Rate Pocketbird on the App Store" / "ให้คะแนน Pocketbird บน App Store" opens the review form directly. It exists because the automatic in-app prompt is rate-limited by iOS and cannot take you there.
• "Version History" / "ประวัติเวอร์ชัน" lists every release newest first, with an icon, a headline and a one-line detail per change — all translated, including the month label. Only the version number itself renders verbatim.
• The "Version" / "เวอร์ชัน" row is read from the installed build, formatted as marketing (build) — 1.1.0 (110) — so it always matches what is actually on your phone.
• When a newer release exists, an "Update Available" / "มีอัปเดตใหม่" row appears here and cannot be dismissed. The card on the Home feed can be dismissed forever; this row is the permanent place to find the update.