Privacy Policy

Last updated: June 28, 2026 • Effective date: May 17, 2026

This Privacy Policy explains how Kivrak Business LLC ("we," "our," or "the app") collects, uses, and protects information when you use the Pocus diary application on devices. Please read this policy carefully. By using Pocus, you agree to the practices described here.

Contact: support@pocusapp.com
Website: https://pocusapp.com

1. SUMMARY

Pocus is designed with privacy as a core value:

Almost all of your personal data — diary entries, photos, videos, voice recordings, moods, memories — is stored ONLY on your device and is never transmitted to our servers.
We collect a small amount of anonymous, aggregated usage analytics through Firebase to understand how features are used, without ever knowing who you are or what you write.
We do not collect your name, email address, phone number, location, or any other personally identifiable information.
We do not sell data to third parties.

2. INFORMATION STORED ON YOUR DEVICE (LOCAL DATA)

The following data is created by you and stored exclusively on your device, inside the app's private storage directory. It is never uploaded to our servers or shared with any third party.

Diary entries — Text you write, mood selections, Q&A answers, Daily Spark responses.
Media attachments — Photos, short video clips, and voice recordings you attach to entries. These files are saved in the app's sandboxed documents directory and are not accessible to other apps.
Memories — Core Memory albums and cover images you create inside the app.
Forest progress — Your virtual forest state, tree inventory, and weekly cycle history.
App settings and preferences — Theme, notification preferences, and other in-app settings stored with SharedPreferences (Android) or NSUserDefaults (iOS).
Security credentials — If you choose to protect the app with a PIN, only a one-way cryptographic hash (SHA-256) of your PIN is stored in your device's OS-level secure storage (Android Encrypted SharedPreferences / iOS Keychain). The PIN itself is never stored or transmitted.
Streak and Daily Spark history — Your journaling streak and a rotating list of past Daily Spark questions used to avoid repetition. No content is stored — only question identifiers.

All diary content and media are stored within the App's private sandboxed storage directory, which is not accessible to other apps. On iOS and Android, the operating system enforces app-level sandboxing that isolates this data from other applications.

3. INFORMATION WE COLLECT

3.1 Anonymous Analytics

We use Google Firebase Analytics to collect anonymous, aggregated data about how the app's features are used. This helps us improve the product.

What is collected:

Screen view events (screen name only, e.g., "DiariesScreen").
Feature-usage flags (anonymous boolean values), for example: "diary entry created" with flags: has_mood (true/false), has_photo (true/false), has_video (true/false), has_spark (true/false)
Event names such as: paywall_viewed, purchase_started, onboarding_completed, pin_setup, core_memory_created, forest_tree_placed, mood_selected, daily_spark_answered, diary_entry_edited, photo_added, video_added, forest_reward_claimed, purchase_restored.

What is NOT collected:

The text of any diary entry.
The content of any photo, video, or voice recording.
Your name, email, or any other identifying information.
No personally identifiable information is ever passed through our analytics code.

Firebase Analytics may automatically collect a pseudonymous device identifier (Firebase Instance ID) and general device information (OS version, device model, country/region) as part of its standard SDK operation. This is governed by Google's Privacy Policy: https://policies.google.com/privacy

You can opt out of analytics collection through your device's standard privacy settings (e.g., "Limit Ad Tracking" / "Ad Personalization" controls on iOS and Android).

3.2 Server Time Verification (Firebase Realtime Database)

To prevent date manipulation in the Forest gamification feature, the app reads the server clock offset from Firebase Realtime Database (.info/serverTimeOffset) once per calendar day. This read-only request:

Contains no personal data.
Returns only a time-offset number (milliseconds).
The database connection is closed immediately after the value is received.
No data is written to Firebase by this call.

3.3 In-App Purchases

We use Adapty to manage premium subscriptions. When you make a purchase:

Adapty processes the transaction through Apple App Store or Google Play Store on your behalf.
Adapty receives standard purchase metadata (purchase receipt, product ID, subscription status) as required by the respective app store.
This processing is governed by Adapty's Privacy Policy: https://adapty.io/privacy/

We do not have access to your payment card details. All payment processing is handled entirely by Apple or Google.

4. DEVICE PERMISSIONS

The app requests the following permissions only when you use the corresponding feature. You can revoke any permission at any time in your device settings.

Permission	Platform	Why it is needed
Photo Library (read)	iOS & Android	To attach photos to diary entries or set a profile / cover image. Photos are saved locally only.
Video (read)	iOS & Android	To attach short video clips to diary entries. Videos are saved locally only.
Microphone	iOS & Android	To record voice notes attached to diary entries. Recordings are saved locally only and never transmitted.
Face ID / Biometrics	iOS & Android	Optional PIN-replacement security feature that lets you unlock the app with your biometric. Biometric data is handled entirely by the OS; Pocus never sees or stores it.
Internet access	iOS & Android	Required for: (a) reading the Firebase server clock for Forest date verification; (b) fetching Firebase Analytics events; and (c) Adapty subscription checks.

The app does NOT request access to:

Your camera (live capture).
Your contacts.
Your precise or approximate location.
Bluetooth or nearby devices.
Health or fitness data.

5. DATA SHARING AND DISCLOSURE

We do not sell, rent, or trade your personal data.

We share limited, non-personal data only with the third-party service providers described in Section 3 (Firebase, Adapty), and only as necessary to provide the in-app features you use.

We may disclose data if required to do so by law or in good faith belief that such disclosure is necessary to comply with legal process, protect our rights, or protect the safety of users.

6. DATA SECURITY

All diary content is stored within the App's private sandboxed directory, which is isolated from other apps by the operating system.
PIN hashes are stored using strong one-way hashing (SHA-256) in the device's OS-level secure storage (Android Encrypted SharedPreferences / iOS Keychain).
No diary content is ever transmitted over the internet.
Network requests to Firebase are encrypted using TLS/HTTPS.

We implement reasonable technical measures to protect your information. However, no method of electronic storage or transmission is 100% secure, and we cannot guarantee absolute security.

7. DELETING YOUR DATA

Because all personal data is stored locally on your device, you are in full control:

Delete all app data: Go to Settings > Security > Delete All Data inside the app, or uninstall the app from your device. Both actions permanently and irreversibly remove all diary entries, media, forest progress, and preferences from your device.
Delete individual entries: You can delete any diary entry or Core Memory album directly within the app at any time.
Revoke permissions: You can revoke photo, microphone, or biometric access at any time in your device's system settings without deleting your data.

Firebase Analytics retains anonymous event data according to Google's retention settings (typically 2 months to 14 months). Because this data is anonymous and not linked to you, individual deletion is not possible; however, disabling analytics on your device prevents future collection.

8. CHILDREN'S PRIVACY

Pocus is not directed to children under the age of 13 (or 16 in the European Economic Area). We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us at support@pocusapp.com and we will take steps to delete such information.

9. INTERNATIONAL USERS

Pocus is available globally. If you are located in the European Economic Area (EEA), United Kingdom, or another jurisdiction with data protection laws, please note:

The personal data relevant to you (diary entries, media, etc.) never leaves your device and is therefore not subject to cross-border transfer.
Anonymous analytics data processed by Firebase may be transferred to Google servers globally, subject to Google's Standard Contractual Clauses and Privacy Policy.
Adapty may process purchase data in its own jurisdictions as described in Adapty's Privacy Policy.

To the extent applicable, you may have rights under GDPR or similar laws to access, correct, or erase data we hold about you. Because Kivrak Business LLC holds no personally identifiable information about you, most such rights are satisfied by the local data controls described in Section 7. For any residual queries, please contact support@pocusapp.com.

10. CHANGES TO THIS POLICY

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this document. For significant changes, we will provide a notice within the app. Your continued use of Pocus after changes take effect constitutes acceptance of the updated policy.

We encourage you to review this policy periodically.

11. CONTACT US

If you have any questions, concerns, or requests regarding this Privacy Policy or your data, please contact us:

Company: Kivrak Business LLC
Email: support@pocusapp.com
Website: https://pocusapp.com

We will respond to all legitimate privacy inquiries within 30 days.