Privacy notice

Who operates Pocket

Aryan Jathar. Intended launch market: India. Contact: aryanjathar0723@gmail.com. Grievance contact: Aryan Jathar — aryanjathar0723@gmail.com.

What stays on your phone

Pocket stores card name, issuer, number, holder, expiry, CVC/CVV, selected network, favorite, chosen finish, creation time, and explicit no-expiry/no-security-code choices. Number, expiry, and CVC are required when saving unless you confirm that the card has no expiry or security code. These support card reference, search, and display. CVC is hidden by default and is not included on the virtual card or in search. There is no card PIN or OTP field. Front and back scan photos are temporary input and are not saved in the wallet. Original gallery photos are not deleted. Photos saved by earlier versions remain encrypted until their card or the wallet is deleted.

Processing and permissions

Camera access is requested only to photograph a card. The system photo picker gives access to the selected image. Separate front and back sections use local OCR. Clear card outlines may be aligned automatically, with focused expiry/CVC reads, contrast processing, and orientation retries; no manual cropping is required. Camera capture may take two quick temporary photos for comparison, while upload reads the selected photo. Labels and corroborating reads help select card numbers, expiry dates, printed networks, and security codes. Card numbers pass a checksum check, which does not guarantee correctness. CVC suggestions use a security-code label, a standalone three-digit back code, or a four-digit Amex code above the front number; unresolved conflicts are left blank. Check every suggestion and correct it before saving. Pocket has no account server, analytics, ads, cloud sync, or payment processing. Android handles your device credentials and biometrics; Pocket does not store fingerprints, face templates, or your device PIN.

Security and retention

Android encrypts app-private data with AES-GCM and an Android Keystore wrapping key. Sign in with strong biometrics or your device credential. Sign-out clears the session; it does not delete cards. Background locking follows your selected delay, with the interface covered meanwhile. There is no foreground inactivity timeout. A photo-picker/permission round trip has a two-minute limit. Revealed CVC hides after 30 seconds, on leaving View card, or on backgrounding; this does not sign you out. Screenshot blocking and backup exclusions apply to Android.

Your control and deletion

Edit or remove a card from its details page. Settings → Delete all wallet data removes the local wallet and key after confirmation and device authentication. You can withdraw from local processing by deleting the wallet and uninstalling. Uninstalling or clearing app data loses cards; there is no recovery. For privacy questions or grievances, use the publisher's contact once configured. Do not send card photos, numbers, CVV, or device PIN in a support request.

Support and privacy enquiries

If you email aryanjathar0723@gmail.com, the publisher receives your email address, message, and any attachments through Gmail. This information is used to answer your enquiry, investigate a reported problem, or handle a privacy request. Send only the app version, phone model, steps, and error description; never send card details, card photos, CVC/CVV, PINs, or OTPs. Support messages are kept only as needed to resolve the enquiry and meet applicable legal obligations. You may request correction or deletion by emailing the same address. The publisher cannot inspect, recover, or remotely delete your local wallet.

Website and browser

The landing site has no analytics or advertising cookies. Its hosting provider may keep request logs such as IP addresses. Hosting provider: Vercel. Hosting request-log retention: Vercel Hobby; no log drains are enabled. Pocket does not export website request logs. Vercel's runtime-log viewer has a 1-hour retention window for Functions and Middleware; this static website uses neither. Vercel may separately retain infrastructure and security data for the purposes and periods described in its Privacy Notice (https://vercel.com/legal/privacy-notice); that data is not covered by the runtime-log viewer limit.. The browser wallet is for development only. It uses a CryptoKey and encrypted IndexedDB in the browser profile, without device authentication. Browser OCR is not included. Clearing site data removes it.

Updates

Notice version 4, 12 October 2026. This update describes front/back scanning, CVC suggestions, required printed details, and network choices. Existing users review this updated notice once; their saved cards are preserved. Changes in hosting, support, analytics, or cloud features require this notice to be updated before those features are enabled.