Your money stays yours.

Pocketbird is a local-first personal finance app: your data lives primarily on your device and is uploaded only if you enable and consent to cloud sync. The AI features run on your iPhone or iPad. There are no ads, no trackers, and your data is never sold. The full notice below explains everything under Thailand's PDPA.

• Your ledger lives on your device first; cloud sync is opt-in.
• The bank messages you paste in and the slips you scan are read by on-device AI, and your original photos are never uploaded.
• Connecting an AI assistant (like Claude) is optional, off by default, and revocable.
• Location is optional and off by default; you can delete all of it any time in Settings → Places.
• Export or delete everything, any time, in the app (PDPA).

We collect only what the app needs to function. Everything below syncs to the cloud only while cloud sync is on; otherwise it stays on your device.

• Account details — email; your password is stored hashed by the authentication system.
• Financial records — amounts, types, categories, tags, notes, dates, payment sources, accounts and transfers, pockets, trips, and the people or shops you record transactions with.
• Settings & goals — custom categories, savings pockets, budgets, recurring items, debts, credit-card limits and statement days.
• Your financial profile (salary, payday, goal) syncs with your account so a new device can restore it. Device preferences (notification, reminder, app-lock settings) stay on your device only.
• Slip/receipt photos and trip covers are stored, while sync is on, in a private storage area tied to your account (JPEG, size-capped) and are deleted with their records and your account.
• Consent records — purpose, policy version, timestamp; an append-only log that syncs whenever you're signed in so withdrawals reach every device.
• Group features require an account and the cloud-sync consent: the group name, your per-group display name, shared bills and your shares, shared-pocket contributions, and shared goals — the goal itself and, for each member, the share they took and the month their own plan expects it to be ready — are stored in the cloud and are visible to the other members of that group. The income, spending and balances behind that month are never shared.
• In-app feedback & feature votes (1.9) — if you send feedback, we store your message and topic with basic app context (app version, iOS version, device model, language), never your financial records; allowing a reply lets the developer answer once to your account email, which is not stored with the message. If you vote on candidate features, your vote is stored and others see only anonymous totals. Both are deleted with your account.
• Push notifications — if you use group features with notifications on, this device's Apple push token is registered with your account; the notification content (member names, bill/pocket titles, amounts) is delivered through Apple's push service, which may process it outside Thailand. The token is removed on sign-out and deleted with your account.
• Crash & hang diagnostics (2.0) — if the app crashes or freezes, a technical diagnostic report from Apple's MetricKit (app and iOS versions, device model, and the technical call stack) is uploaded when the app next opens so the problem can be found and fixed. These reports are deliberately not linked to your account: they carry no identifier and none of your financial data.
• Coarse usage statistics (2.0, switchable off in Settings → Share usage statistics) — event name, time, and app version only (for example that a transaction was logged or a recurring item was created): never amounts, notes, names, or anything you typed. Tied to your account so returning-use statistics can be computed, and deleted with it. Processed, together with crash diagnostics, on the basis of legitimate interest (PDPA Section 24(5)).
• Photo-library slip scanning (2.1, OFF by default — Settings → Slip Capture, via the iOS photo-library permission) — the app checks your new photos on this device for bank-transfer slips using on-device text recognition. Only a draft of a detected slip (amount, date, recipient, reference, recognized text) plus a small thumbnail is kept, on the device, until you import or remove it; photos that are not slips are discarded immediately, and your original photos are never uploaded, changed, or deleted. A slip you import becomes an ordinary transaction record.
• Invite friends (only when you share your code or enter a friend's) — your invite code, who invited whom (inviter account ↔ invited account), the invite's status, the ลูกนกน้อย points earned, spent or expired, and a log of code-entry attempts (time and result only, to stop code guessing). No IP address, location or device identifier is used to match invites. An inviter sees an invited friend only as the first letter of their display name plus a status. Stored in the cloud only and deleted with your account (points the other person already earned stay theirs, no longer linked to you).
• If you turn on Use places (off by default, under Settings → Places, using the iOS location permission), the app stores your places — name, kind (home, work, shop, market or other), coordinates, radius, the Apple Maps place id and category, mall or area, floor, the brand it belongs to and a starting category; an Apple Maps shop you pick, or one the app suggests and you save an entry with, becomes one of your places. It also stores where an entry happened: which place, and its precise coordinates with their accuracy in metres. Coordinates come from only three sources: one location reading when you open the Add screen for a new entry logged now; the location embedded in a receipt photo you choose to import and whose place you confirm; or the point iOS reports for a stop when you log a fuel fill-up from a reminder. With Approximate Location, the stored coordinates are coarse.
• With sync on, places and entry coordinates are stored in the cloud like your other records, so the web app and your other devices can show them. A place you set to Keep on this device only never leaves the device, and neither do the coordinates of entries linked to it or inside its circle; switching an already-synced place to this setting removes its server copy and those coordinates from the server.
• If you turn on Place reminders, the app keeps a log of stays on this device only: stays at places you saved (never home or work) — arrival, departure, the place's point or the point iOS reported, and what the reminder did. Stays anywhere else are matched against your places and discarded. Each stay is deleted automatically 14 days after it ended. For trip suggestions (which also need a Home place) the device keeps the latest stay far from home — point, distance, city and country — until you are back or for at most 3 days without another far stay, the areas you told it not to ask about again (the newest 20), and your home country. A trip is created only when you tap Start Trip. Your place switches, per-place reminder choices and the day's reminder count also stay on this device, and all of this is erased on sign-out or Delete all location data.
• How the app reads location: only while Use places is on and iOS allows it — turning it off stops all reading at once. With While Using permission, the app reads your location once when you open the Add screen for an entry logged now (never for back-dated entries, edits, scanned or imported slips, widgets, or Siri actions that log without opening the app), and when you tap to use your current location while pinning a place. Always permission is requested only when you turn on Place reminders, after our own explanation: iOS then watches up to 20 of your saved places and reports when you end a stay, even while the app is closed, waking it only for those events. The app never tracks your location continuously, never runs a background location mode, never records a route, and reads no GPS position for reminders. Reminders are notifications created on your device, at most 3 a day across all kinds, and not sent during your Do Not Disturb hours.
• If you use the tax-deduction tracker, the amounts, income and people counts you type — for example how many children or parents you support and, for the care deduction, how many dependants have a disability — are stored in your financial profile and synced with your account while cloud sync is on. A count of dependants with a disability can reveal health information, so it is optional, you enter it yourself, and it is used only to work out your deduction. It is deleted with your account.
• If you share a receivable as a link (a 'you owe me' page), the app creates a public page at app.pocketbirdapp.com/s/ followed by a random code. It shows a snapshot of what you chose to show — the title, amount, optional due date and note, your display name and your invite code — to anyone who has the link, without an account. It never reads your live data, so a later edit does not change an old link. A link expires after 60 days and you can revoke it at any time; it is deleted with your account.
• If you turn on the calendar feed in the web app, it creates a private subscription link (an .ics address) to your Coming Up list. Calendar apps such as Apple, Google or Outlook fetch it without signing in, and the calendar provider may store the link and a copy of the events it prints — titles and dates, plus amounts only if you opt in. Anyone who holds the link can read what it prints, so treat it like a password. You can revoke or regenerate it at any time, which stops the old link at once; it is deleted with your account.
• A photo or logo you set for a person or shop in People is stored as one small square JPEG (up to 512 px) in the same private storage area, while sync is on, and is deleted when you remove it, delete or merge the person, or delete your account. Brand logos come from our own curated catalogue; no outside logo service is contacted.
• Shared pockets are online-only records shared with the people you invite, each as an owner, editor, contributor or viewer. Every member can see the pocket — its name, target, balance and every deposit, withdrawal and loan with the notes and display names on them — and a log of who joined, left or was removed, who invited whom, and who changed the pocket. When a member borrows from a shared pocket, a debt is created in that member's own records. When you leave, or delete your account, the link to your account and your display name are removed, while the pocket's entries stay for the other members.
• If you turn on news and offers notifications (a separate consent, off by default), the developer may send you announcements and offers by push. To send them at suitable hours, the app registers your time zone and quiet hours with this device's push token; the token and these settings are removed when you sign out and deleted with your account. You can turn it off at any time in Settings → Notifications.

We do NOT collect national-ID card images, biometric identifiers, or other sensitive data under PDPA Section 26, except the optional dependant counts described above for the tax tracker. Location is collected only after you turn it on yourself; it is never used for advertising, never sold, and shared only as described under 'Cloud sync & cross-border transfer' and 'Processors'. Pocketbird has no access to your Messages app; a bank SMS reaches it only when you paste one in, and that text — like a scanned slip — is parsed by on-device AI. Your original photos are never uploaded; only a slip you choose to save keeps a small image copy on that transaction, which syncs privately to your account. There is no ad tracking and your data is never sold.

Processing is based on your consent (PDPA Section 19), asked per purpose before any financial data is stored:

• Store and process financial data on this device — required; the app cannot work without it.
• Sync data to the cloud — optional, off until you turn it on, revocable any time.
• Let a connected AI assistant read your data — optional, off by default.
• Let a connected AI assistant create and edit your data — optional, off by default, separate consent.
• Use places — fill in where you logged an entry, remember each place, place rules and the spending map — optional, off by default, set per device, revocable any time.
• Place reminders — optional, off by default, and the only feature that asks for the iOS Always location permission.
• News and offers notifications — optional, off by default, separate consent.

Every grant or withdrawal is recorded in an append-only log, so there is always an auditable history of what you consented to, which version, and when.

Location features are based on your consent (PDPA Section 19), given by turning on Use places and, separately, Place reminders yourself; our explanation is shown before every iOS location dialog. They fill in where you logged an entry, remember each place's usual category, account and amount, apply place rules (judged from the place saved with the entry, never your device's position), suggest a place for imported receipts, and power the spending map, place insights, price comparison between branches, and place answers in Ask Pocketbird (on device) or a connected AI assistant. Place reminders remind you to log after leaving a shop you visit often, recap missed logs in the evening, ask about starting a trip when you stay far from home, offer to log a fuel fill-up, and show a budget's remaining amount when you arrive at a place you usually spend it. Both are optional, off by default, set per device, and can be switched off at any time; everything else works without them.

If you enable cloud sync, your synced data is stored with our processor, Supabase Inc., whose database runs on AWS infrastructure in ap-southeast-2 (Sydney, Australia) — outside Thailand, under the Australian Privacy Act 1988.

Protections in place for this transfer: the destination is governed by the Australian Privacy Act 1988, every connection uses TLS with stored data encrypted at rest, and Row Level Security means your personal records are accessible only by your account (group records only by that group's members).

Apple Maps: with places on, the app sends coordinates to Apple's map service to find shops around a location reading or a receipt photo's location, to search a name or address you type, to name the area of an approximate location, to name the city and country of a stay at least 30 km from home (and your Home place once, to learn its country — the home area is never shown), to look for a fuel station where iOS reported a stop (only when a fuel reminder could actually be sent), and to draw map images. These requests carry no account or financial data, results you don't save as a place are not kept, and Apple handles them under its own privacy policy, possibly outside Thailand.

If you link one of your places to an entry of a shop you share, the shop's members can see that place (name and coordinates) while it is linked. Other members cannot link your places, and a place kept on one device is never visible.

You control the transfer: withdraw sync consent any time and the app immediately stops sending and pulling financial data. Data synced before a withdrawal remains in the cloud until you delete those records or your account.

If you create an access token to connect an AI assistant, the app can send your transactions (including where each one happened — its place and coordinates), your saved places, accounts, categories, receipts, the people and shops you record transactions with, pockets, balance, debts, holdings, recurring items, trips, tags, tax-deduction figures, price history and shop records to that assistant's provider so it can answer your questions. That provider may be located outside Thailand — for example Anthropic in the United States, which may not offer the same level of data protection as Thai law. Reading your data this way happens only when you turn it on and grant the 'AI assistant access' consent, and you can revoke the token or consent at any time.

If you also grant the separate 'AI assistant edits' consent, you can ask the connected assistant to create or change your own financial records — for example adding a transaction, receipt or recurring item, editing a category, account, person, holding, place or savings pocket, moving money between accounts, recording a shop entry, or moving money in a shop's wallet — and to delete a transaction, receipt or recurring item, on your instruction. Because it must find the right record before changing it, granting this also lets the assistant read those records. These changes are made by an assistant you chose and control, only while the connection is active, and only to the records you ask it to change. A place kept on one device only is never visible to an assistant, and an assistant cannot set that option. This consent is optional, off by default, and revocable at any time; the assistant never acts on its own or changes anyone else's data.

Your data is kept for as long as you use the app. Deleted records are first marked as deleted so the deletion reaches all your devices, then erased permanently and automatically — in the cloud after 90 days, and on the device 30 days after the deletion has synced.

An entry's coordinates are kept as long as the entry. You can remove the location from one entry (the entry stays), delete a place (its entries stay, without the place; its name and coordinates are wiped at once and the record is purged on the schedule above), or merge duplicate places. Delete all location data (Settings → Places) clears, on the server and on this device at once, every entry's coordinates, every place, the stay log, waiting reminders and the reminder and trip memory — your money entries all stay. It needs a connection (if the server can't be reached nothing is deleted), and a place kept on another device only must be deleted on that device.

When you delete your account, your personal data — in the cloud and on the device — is deleted immediately, including your photos in private storage. Records you shared with a group stay with that group so other members' records remain intact; the link to your account and your display name are removed.

• Withdraw consent — Settings → Privacy (PDPA).
• Access & export — Settings → Export Data: a portable JSON bundle of your financial records (transactions, categories, tags, pockets, debts, trips, recurring items, accounts, people, places, budgets) and a CSV of transactions; group data has its own export.
• For location: withdraw by switching off Use places or Place reminders in Settings → Places, or in iOS Settings; the JSON export includes your places (device-only ones too) and each entry's place, coordinates and accuracy, the transactions CSV has place, latitude and longitude columns, and the stay log is in the JSON exported from that iPhone or iPad only; erase per entry, per place, or with Delete all location data; keep a place on this device only to stop it reaching the cloud.
• Object / restrict — turn off cloud sync and use the app on-device only.
• Erase — Settings → Delete Account & All Data.

You also have the right to lodge a complaint with Thailand's Personal Data Protection Committee (PDPC).

Supabase Inc. processes synced data (Postgres database, authentication, and private media storage) under its standard service terms; its cloud infrastructure provider, Amazon Web Services, hosts the infrastructure. Apple processes Sign in with Apple, delivers push notifications (Apple Push Notification service) and answers map searches (Apple Maps — the coordinates of each search only); its on-device frameworks power Siri, widgets, the AI features, and iOS region and visit monitoring for place reminders without sending your data to us. Aside from these, no third party receives your data except a service you choose to connect or subscribe with yourself — for example, an AI assistant you link to your account, which receives only the data you ask it to read (see 'Cloud Sync & Cross-Border Transfer'), or a calendar app you subscribe to your calendar feed.

The service providers Supabase itself uses (per the list Supabase publishes) that are relevant to hosting are Amazon Web Services (our region: Sydney), Cloudflare, Google, and Fly.io.

• Cookies: necessary cookies keep the site working and are always on. Preferences (theme/language), analytics, and marketing cookies run only after you allow them — today the site ships no third-party scripts at all, so nothing loads even if allowed.
• Proof of consent: when you make a cookie choice, we record the choice, method, policy version, and a salted hash of your IP address as PDPA proof-of-consent — kept in server logs, not a database.
• Web sign-in: signing in on this site (for example to approve an AI-assistant connection) uses the same Supabase account as the app; only the anonymous/publishable key is used on this host.
• Pocketbird on the web (app.pocketbirdapp.com): the coarse usage statistics described above also apply there, with the same switch (Settings → Share usage statistics, on by default). On the web they are one event per visit recording the device type (Android, iPhone/iPad, or computer), whether it was opened from the home screen, and the campaign tag of the link that brought you (for example, from this website) — never the full browser identifier, amounts, notes, or names. An account created on the web also stores that device type and campaign tag with the account.
• Maps on the web: the Places map in the web app loads map images and tiles for the visible area from Apple's MapKit JS service, so your browser sends that area to Apple and Apple handles it under its own privacy policy, possibly outside Thailand. No account or financial data is included.
• Hosting: the site is self-hosted by the developer and served through Cloudflare's network (transport only).