Privacy Policy

Last updated: August 28, 2026  •  Effective date: May 17, 2026

This Privacy Policy explains how Kivrak Business LLC ("we," "our," or "the app") collects, uses, and protects information when you use the Pocus diary application on devices. Please read this policy carefully. By using Pocus, you agree to the practices described here.

Contact: support@pocusapp.com
Website: https://pocusapp.com

1. SUMMARY

Pocus is designed with privacy as a core value:

• Almost all of your personal data (diary entries, photos, videos, voice recordings, moods, memories) is stored ONLY on your device and is never transmitted to our servers. It leaves your device in only two cases: if you choose to share something yourself (Section 5.1), or through your own device backup, if you have one enabled (Section 2.1).
• We collect a small amount of anonymous, aggregated usage analytics through Firebase to understand how features are used, without ever knowing who you are or what you write.
• We do not collect your name, email address, phone number, location, or any other personally identifiable information on our servers. The name you enter when setting up the app stays on your device (Section 2).
• We do not sell data to third parties.

2. INFORMATION STORED ON YOUR DEVICE (LOCAL DATA)

The following data is created by you and stored exclusively on your device, inside the app's private storage directory. It is never uploaded to our servers.

• Diary entries: Text you write, mood selections, Q&A answers, Daily Spark responses.
• Media attachments: Photos, short video clips, and voice recordings you attach to entries.
• Memories: Core Memory albums and cover images you create inside the app.
• Forest progress: Your virtual forest state, tree inventory, and weekly cycle history.
• App settings and preferences: Theme, notification preferences, and other in-app settings stored with SharedPreferences (Android) or NSUserDefaults (iOS).
• Security credentials: If you choose to protect the app with a PIN, only a one-way cryptographic hash (SHA-256) of your PIN is stored in your device's OS-level secure storage (Android Encrypted SharedPreferences / iOS Keychain). The PIN itself is never stored or transmitted.
• Streak and Daily Spark history: Your journaling streak, plus a short list of the Daily Spark questions the app has already shown you, so that they are not repeated. These are the app's own prompt questions, not anything you wrote — your answers are saved as part of the diary entry itself.
• Profile: The name you enter when you set up the app and, if you choose one, a profile picture. Both stay on your device and are never sent to us.

2.1 Device Backups

If your operating system's backup feature is switched on, your device — not Pocus — may copy the app's local data into your own cloud account:

• iOS: diary entries, media attachments, and app settings are kept in the app's Documents directory, which Apple's iCloud Backup includes by default. If iCloud Backup or an encrypted computer backup is enabled, a copy of this data is stored in your personal iCloud account and can be restored to a new device.
• Android: Pocus disables system backup entirely, so no diary data is copied to Google's servers.

This is a backup of your own data, held in your own account, governed by Apple's privacy policy and controlled by your device settings. We have no access to it and receive nothing from it. You can turn it off for this app under iOS Settings → [your name] → iCloud → Manage Account Storage → Backups.

3. INFORMATION WE COLLECT

3.1 Anonymous Analytics

We use Google Firebase Analytics to collect anonymous, aggregated data about how the app's features are used. This helps us improve the product.

What is collected:

• Screen view events (screen name only, e.g., "DiariesScreen").
• Feature-usage events with small, non-identifying parameters. For example, when a diary entry is saved we record:
  • whether a photo was attached (true/false),
  • which mood you selected, if any (the mood label, e.g., "Happy"),
  • how many entries you have written so far (a running count),
  • how long the entry was (a character count — the number of characters only, never the characters themselves).
• Feature and milestone events, each named after the action it describes. The exact set changes as the app evolves; representative examples are entry_created, diary_entry_edited, photo_added, video_added, daily_spark_answered, memory_resurfaced, forest_tree_placed, tree_earned, onboarding_completed, pin_setup, paywall_viewed, and purchase_completed. Whatever the event, the rule below always applies: no diary content and no identifying information is ever attached to any of them.

What is NOT collected:

• The text of any diary entry, or any part of it.
• The content of any photo, video, or voice recording.
• Your name, email, or any other identifying information.
• No personally identifiable information is ever passed through our analytics code.

Firebase Analytics may automatically collect a pseudonymous device identifier (Firebase Instance ID) and general device information (OS version, device model, country/region) as part of its standard SDK operation. This is governed by Google's Privacy Policy: https://policies.google.com/privacy

Diagnostic data: Firebase Analytics also records a small number of basic technical signals as part of its standard operation — for example when the app is opened or closed and how long a session lasted. We do not use a separate crash-reporting or performance-monitoring service. These signals are anonymous, aggregated, and contain no diary content.

Your choices: analytics is enabled by default, and the app does not currently include an in-app switch to turn it off. Device-level advertising controls ("Limit Ad Tracking" on iOS, "Ad Personalization" on Android) restrict advertising identifiers, but they do not stop Firebase Analytics from recording the anonymous product events described above.

3.2 Server Time Verification (Firebase Realtime Database)

To prevent date manipulation in the Forest gamification feature, the app reads the server clock offset from Firebase Realtime Database. The value is held in memory for a short period and re-read once that cache expires, so the request may happen more than once during a long session. It is never saved to disk. This read-only request:

• Contains no personal data.
• Returns only a time-offset number (milliseconds).
• The database connection is closed immediately after the value is received.
• No data is written to Firebase by this call.

3.3 In-App Purchases

We use Adapty to manage premium subscriptions. When you make a purchase:

• Adapty processes the transaction through Apple App Store or Google Play Store on your behalf.
• Adapty receives standard purchase metadata (purchase receipt, product ID, subscription status) as required by the respective app store.
• So that anonymous product analytics and subscription funnels line up, the app also passes your Firebase App Instance ID to Adapty as an anonymous customer identifier. This is a random, app-generated ID — it is not your name, email, or account, it is never linked to diary content, and it is replaced if you reinstall the app.
• This processing is governed by Adapty's Privacy Policy: https://adapty.io/privacy/

We do not have access to your payment card details. All payment processing is handled entirely by Apple or Google.

3.4 Notifications

Pocus can remind you to write. There are two kinds of reminder, and they work differently:

• Daily reminders are created by the app on your device. They are scheduled locally, work without an internet connection, and involve no server.
• Remote notifications are sent by us through Firebase Cloud Messaging, for example to tell you about a new feature. To deliver them, Firebase assigns your installation a pseudonymous device token. This token identifies the installation, not you: it is not linked to your name or email, and it is never used to access diary content. Your installation is also subscribed to a single general broadcast topic ("all_users"), which lets us send the same announcement to everyone without keeping a list of individual tokens.

Some reminders can include a photo from your own diary — for example a "one week ago today" memory. The image is read from your device and drawn into the notification locally; it is never uploaded. Because notifications can be visible on a locked screen, you can switch this off with the "Photo Previews in Notifications" setting, which leaves the reminder text intact. Remote notifications sent by us never contain your content.

Pocus asks for notification permission when the app first starts, so that reminders can be offered from the beginning. Nothing is sent unless you grant that permission, and you can withdraw it at any time in your device settings, which stops both kinds immediately. Firebase Cloud Messaging is governed by Google's Privacy Policy: https://policies.google.com/privacy

3.5 When You Contact Us

If you email us — at support@pocusapp.com, or at hello@pocusapp.com through the feedback option in the app's rating prompt — we receive whatever you put in that message, including your email address. We use it only to reply to you, and we do not add it to any marketing list.

The rating prompt itself opens your app store's standard review dialog. Any review you leave is handled by Apple or Google, not by us, and is not linked to anything in this app.

4. DEVICE PERMISSIONS

The app requests the following permissions. Most are requested only when you first use the corresponding feature; notification permission is requested when the app first starts. You can revoke any permission at any time in your device settings.

The app does NOT request access to:

• Your camera (live capture).
• Your contacts.
• Your precise or approximate location.
• Bluetooth or nearby devices.
• Health or fitness data.

5. DATA SHARING AND DISCLOSURE

We do not sell, rent, or trade your personal data.

We share limited, non-personal data only with the third-party service providers described in Section 3 (Firebase, Adapty), and only as necessary to provide the in-app features you use.

We may disclose data if required to do so by law or in good faith belief that such disclosure is necessary to comply with legal process, protect our rights, or protect the safety of users.

5.1 Content you choose to share

Some screens — your Memory Forest and your monthly / yearly Recap — include a share button. Tapping it renders an image on your device and hands that image to your operating system's standard share sheet, so you can send it to an app of your choosing (messaging, social, mail, or your photo library). A Recap image is generated from your own diary data, so treat it like any other personal photo you share.

• Nothing is shared unless you tap share and choose a destination yourself.
• The image travels directly from your device to the app you pick. It does not pass through our servers; we never see it and do not know that you shared it.
• Once it leaves Pocus, the receiving app's own privacy policy applies.

6. DATA SECURITY

• All diary content is stored within the app's private sandboxed directory, which is isolated from other apps by the operating system and covered by your device's own disk encryption while the device is locked.
• The diary files inside that sandbox are stored as ordinary data rather than being separately encrypted by the app. The PIN and biometric lock control access to the app itself; they do not encrypt the files.
• PIN hashes are stored using strong one-way hashing (SHA-256) in the device's OS-level secure storage (Android Encrypted SharedPreferences / iOS Keychain).
• Diary content is never transmitted over the internet by the app. The only exceptions are content you deliberately share yourself (Section 5.1) and your operating system's own backup, if you have enabled it (Section 2.1).
• Network requests to Firebase are encrypted using TLS/HTTPS.

We implement reasonable technical measures to protect your information. However, no method of electronic storage or transmission is 100% secure, and we cannot guarantee absolute security.

7. DELETING YOUR DATA

Because all personal data is stored locally on your device, you are in full control:

• Delete all app data: Uninstall the app from your device. This removes all diary entries, media, forest progress, and preferences from the device itself. Two things can outlive it. On iOS, the stored hash of your PIN lives in the system Keychain, which the operating system keeps after an app is removed and restores if you reinstall. And if you have a device backup (Section 2.1), a copy of your data remains in that backup until the backup is deleted or replaced. To erase everything, delete that backup in your device settings as well.
• Delete individual entries: You can delete any diary entry or Core Memory album directly within the app at any time.
• Revoke permissions: You can revoke photo, microphone, or biometric access at any time in your device's system settings without deleting your data.

Firebase Analytics retains anonymous event data according to Google's retention settings (typically 2 months to 14 months). Because this data is anonymous and not linked to you, individual deletion is not possible. Uninstalling the app stops any further events from being recorded.

8. CHILDREN'S PRIVACY

Pocus is not directed to children under the age of 13 (or 16 in the European Economic Area). We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us at support@pocusapp.com and we will take steps to delete such information.

9. INTERNATIONAL USERS

Pocus is available globally. If you are located in the European Economic Area (EEA), United Kingdom, or another jurisdiction with data protection laws, please note:

• The personal data relevant to you (diary entries, media, etc.) is never transferred to us, and so is not subject to any cross-border transfer on our part. If you have enabled your device's own backup (Section 2.1), that copy is processed by Apple within your own account, under Apple's privacy policy and your control.
• Anonymous analytics data processed by Firebase may be transferred to Google servers globally, subject to Google's Standard Contractual Clauses and Privacy Policy.
• Adapty may process purchase data in its own jurisdictions as described in Adapty's Privacy Policy.

To the extent applicable, you may have rights under GDPR or similar laws to access, correct, or erase data we hold about you. Because Kivrak Business LLC holds no personally identifiable information about you, most such rights are satisfied by the local data controls described in Section 7. For any residual queries, please contact support@pocusapp.com.

10. CHANGES TO THIS POLICY

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this document. For significant changes, we will provide a notice within the app. Your continued use of Pocus after changes take effect constitutes acceptance of the updated policy.

We encourage you to review this policy periodically.

11. CONTACT US

If you have any questions, concerns, or requests regarding this Privacy Policy or your data, please contact us:

• Company: Kivrak Business LLC
• Email: support@pocusapp.com
• Website: https://pocusapp.com

We will respond to all legitimate privacy inquiries within 30 days.