Privacy Policy

Poca Privacy Policy
Effective date: October 19, 2026

Poca is a personal photocard collection and display tool. Contact: support@pickrabbit.com.

Your collection
Your imported photos, card fronts and backs, original images, alternate images, album names, notes and effect settings are stored on your device. Scanning and rendering take place on your device. We do not upload these items to our analytics service or use them to train AI models.

Optional iCloud sync
Poca's free iCloud sync is enabled by default and can be switched off in Settings. When your device has a usable iCloud account, collection data and images are transferred to your private CloudKit database, operated by Apple under the iCloud terms applicable to your account. This uses your iCloud storage quota. The developer cannot browse this private database through the CloudKit developer console. Sync availability depends on your account, network, available storage and Apple services.
Switching sync off stops future transfers and keeps existing local and cloud copies. Deleting a card while sync is enabled also deletes that card from the synced collection after the undo period. Sync does not provide a history of deleted cards. Reinstalling or changing devices can restore only data that successfully reached iCloud, using the same Apple Account. To manage all app data stored in iCloud, use your device's Apple Account / iCloud storage settings. Data removed locally while sync is off will be reconciled when sync resumes.

Home Screen widget
If you add Poca's widget, a rendered front face of the card shown on Today is saved in a shared on-device App Group. The widget does not include your private memory text. The displayed card can be visible to anyone who can see your Home Screen. Remove the widget if you do not want that display.

Optional usage analytics
Usage analytics are off until you choose to enable them. If enabled, Poca sends app opens, effect exposures and selections, saved-effect events, export results, app-share initiation and basic save/export failure categories. Each event includes an event ID, random installation ID, random app-session ID, app version, UTC event time, source screen, effect identifier when relevant, and a count. The random identifiers are pseudonymous; they are not an Apple ID or advertising identifier. They allow us to count distinct installations and repeat usage, not to identify you by name. We do not include card images, album names, notes, photo-library contents, contacts, precise location or device advertising identifiers.
These events are processed by our Cloudflare Workers / D1 service. The service uses the connection IP transiently for abuse rate limiting; our application does not write the raw IP into the event database. Cloudflare may process connection and security data under its own policies. Network requests necessarily expose connection metadata to the service provider. Collection content is not sent to Cloudflare by the app.
Event detail is retained for up to 30 days, with daily deletion of older records; daily aggregate counts without installation/session IDs may be kept for product planning. A local retry queue is limited to 500 events and drops events older than 30 days. Disable usage analytics in Settings to stop future collection and clear queued events. Previously received events expire under that retention policy. To request earlier deletion, use the deletion action in Settings, which sends your random installation ID to delete matching event detail, or contact support. Analytics may be unavailable or delayed; it is not a complete activity history.

Permissions and sharing
Camera access is used when you choose to scan. Photo selection imports only items you choose. Saving copies to Photos requests the corresponding system permission. Recommend Poca opens the system share sheet with an app description and website link; it does not attach your private card image or notes. The destination you choose, including AirDrop or a messaging app, handles the shared information under its own terms. Poca records opening the share sheet only if usage analytics are enabled, not whether another person received the recommendation.

Data controls and transfers
You can edit and delete local cards, disable iCloud sync, manage iCloud storage, decline usage analytics and revoke camera/photo permissions in system Settings. Removing the app removes its local data, but does not by itself erase existing iCloud records or server-side analytics detail. Apple's and Cloudflare's infrastructure may process data in regions different from yours, subject to their applicable service arrangements. We do not sell collection content or analytics data, combine them with advertising profiles, or use analytics for cross-app advertising tracking.

Children and updates
Poca is not designed to solicit personal information from children. If you believe a child's personal data was sent to us, contact support. We will update this policy when processing changes and obtain additional consent where required. Material new uses of your data will not be introduced silently.