App privacy policy

This covers the pouchie app: your account, your photos and videos, and the people you share them with. The marketing website has its own, separate privacy notice.

The short version

  • Your photos and videos are stored encrypted, in the European Union, and decrypted on your own device when you view them in the app. The one exception: when you download a copy, our servers in the EU decrypt each file while sending it (section 12).
  • Only the people you put in a circle can see what you share with that circle. There is no public feed.
  • Location data is removed from every photo and video before anyone can view it.
  • We never sell your data, never use it for advertising, and never use it to train AI models.
  • Delete your account and your memories are permanently erased after a 30-day grace period.
  • If you hold your own account, we ask for an email address for account notices only. Once added, it can be changed but not removed. It is never used to sign in, and never for marketing without your separate consent. Guests are never asked for one.
  • If you hold your own account, you can download full quality copies of the photos and videos in your memories. The link goes only to your verified email, opening it needs a code sent to your phone, and our servers in the EU decrypt the files only while sending them (section 12).
  • Account holders also get a few optional tips by email and occasional posting reminders. Both can be turned off, and we never track whether you opened an email, or who opened or viewed a memory.

1. Who we are

pouchie is operated by JR Moreno Ltda ME ("pouchie", "we"), based in São Paulo, Brazil. We are the data controller for the data processed in the app, under Brazil's LGPD (Law 13.709/2018) and, where it applies, the GDPR. Our Data Protection Officer is Gustavo Henrique Moreno, reachable at [email protected].

2. Who this applies to

Anyone who uses the pouchie app. It does not cover the pouchie.app website, which holds no product data and has its own privacy notice. Your use of the app is also governed by our terms.

3. What we collect

  • Account: your phone number, the name you choose to give, and your device's language.
  • Email address (account holders only): if you hold your own account (a trial or a subscription), an email address is required, and we confirm it is yours by sending a code to it. Guests, the people added to a circle by phone, are never asked for an email. If a guest later starts their own subscription, we ask for it then. Once an email address is on your account, you can change it in the app, but you can't remove it.
  • Authentication and security: one-time codes (stored hashed, HMAC-SHA256), the device your account is bound to, your IP address and a device identifier (anti-abuse and diagnostics), and append-only access logs.
  • What you create: the photos and videos you upload, plus captions, comments, reactions, and how you've organised them into memories, moments and circles.
  • Technical operation: timestamps, crash and error reports (via Sentry), and strictly operational usage metrics.

We do not collect your location. Photos and videos often carry GPS coordinates in their metadata; we strip that metadata during processing, before any other person can view the file.

4. Why we use it, and our legal basis

  • Creating and running your account, and providing the service: performance of a contract.
  • Delivering your photos and videos to the circles you chose: performance of a contract.
  • Emailing account holders about their account (the end of a trial, changes to their access, data deletion) and emailing them the link to a data export they request: performance of a contract (LGPD art. 7, V; GDPR art. 6(1)(b)).
  • Emailing legal and security notices we are required to send: legal obligation (LGPD art. 7, II; GDPR art. 6(1)(c)).
  • Sending account holders a few optional tips by email during their trial, and occasional posting reminders in the app, to help them get going with the service they signed up for: legitimate interest (LGPD art. 7, IX; GDPR art. 6(1)(f)). You can turn either off at any time (section 5).
  • Counting, as totals only, which of our messages led to a subscription: legitimate interest (section 5).
  • Sending login codes and protecting against abuse and fraud: legitimate interest (security).
  • Diagnosing and fixing faults, via Sentry: legitimate interest.
  • Meeting legal obligations, such as retaining logs: legal obligation.

Your email address is never used to sign in or to recover your account (that is always your phone number). Apart from the optional tips in section 5, which are only about getting started with pouchie and stop with one click, we will never send you marketing email unless you give separate, explicit consent. Payment receipts come from the App Store or Google Play, not from us.

5. Emails and reminders we send you

If you hold your own account (a trial or a subscription), pouchie may contact you in the ways below, on top of the notifications you chose for your memories. Guests, the people added to a circle, get none of these, with one exception: if your account became a guest account while memories of your own were still on their way to deletion (section 9), you keep getting the account notices about those memories.

Account notices (always sent)

Emails about your plan and your data: a few days before your trial ends, when your account becomes read-only, before your family's view ends, and before anything is deleted. They are service messages, so they still arrive if you stop the tips below. A few of them (the last day of your trial, the end of your family's view, the final notice before deletion) also arrive as a notification in the app. Those arrive whenever your notifications are on, even with posting reminders off; if a notification can't reach you on the last day of your trial, we send that one by email instead.

Tips by email (optional)

Up to three emails during your trial: a welcome when you confirm your email address, one gentle next step around day 3 if you haven't posted or added your family yet, and a short note around day 7 on how things are going (how many moments you've shared, how many people you've added, and how many reactions and comments they left; never views). Every one of them has a link at the bottom to stop the tips, which works in one click. Stopping the tips does not stop the account notices above.

Posting reminders (optional)

Occasional notifications that nudge you to share: when a new memory has no moments yet, when you've posted but haven't added your family, when your family reacted or commented and you haven't shared anything since, and "on this day", when a memory has moments from the same date in an earlier year. They respect your notification frequency and quiet hours. They come at most twice a week, never within two days of your last post and never while your account is read-only. A memory goes quiet after two reminders you didn't act on, until you post in it again.

One switch turns them all off: Settings → Notifications → Posting reminders. If your version of the app doesn't show that switch yet, update the app; until then, turning notifications off stops the reminders too.

Links in our emails and notifications

Links in our messages open the pouchie app on the right screen (for a memory, the link includes that memory's internal ID, which means nothing outside the app). Each one also carries a single tag that names the message it came from, for example source=email_trial_ending. The tag never contains anything about you: no name, no phone number, no email address, no account ID. If you subscribe after following one, we note which message it was together with that subscription, and we only ever look at these as totals (how many subscriptions each message led to). This tag is first party: no other company receives it. If the app isn't installed, the link opens a simple page on pouchie.app that shows nothing from your account and doesn't read the tag.

What we never track

We never track whether you opened an email: our emails carry no tracking pixels or remote images, and open and link tracking are turned off at Postmark, the provider that sends them. Following a link records nothing by itself. The only trace a link can leave is the note described above, and only if you go on to subscribe. And pouchie never tracks who opened or viewed a memory or a moment. The only activity our messages ever mention is reactions and comments, which your family chose to leave.

6. How we protect it

  • Media is encrypted at rest and stored and processed in the European Union.
  • Each file has its own key, held in AWS KMS (EU region), and is decrypted on your device; the delivery network only ever handles ciphertext. The exception is a data export you request, which our servers in the EU decrypt while sending it to you (section 12).
  • EXIF and GPS metadata are removed from photos and videos before anyone views them.
  • Screenshots are blocked on media screens (see the limits below).
  • One-time codes and tokens are stored hashed; access logs are append-only.

One honest caveat: this is strong protection and EU data residency, not zero-knowledge encryption. pouchie, via our key service, remains technically able to decrypt your media. We would rather tell you that than over-promise. And no technical measure is absolute: someone you have given access to could always photograph their screen with another device. Choose who joins your circles carefully.

7. Who we share it with

  • The people in your circles. That's the point of the app. You control which circles see each memory; nobody outside them sees it.
  • Service providers who run our infrastructure under our instructions: Twilio (sending login codes), Postmark (sending account email to account holders, with the optional tips on a separate sending stream), Cloudflare (storage and delivery), Heroku (application hosting), AWS (key management) and Sentry (crash reporting). Each is under a data-processing agreement.

We never sell your data, never use it for advertising, and never use it to train AI models, ours or anyone else's.

8. International transfers

Your data is stored and processed in the European Union. Some of our service providers are headquartered outside the EU; where data moves, those transfers rely on Standard Contractual Clauses and equivalent safeguards. Account email is the main example: your email address and the messages we send you are processed by Postmark, in the United States, under those clauses. Your photos and videos never go through our email provider.

9. How long we keep it

  • Your data is kept while your account is active.
  • Your email address is kept until you delete your account, and is erased immediately when you do, without waiting for the 30-day grace period. You can change it in the app at any time, but once it is added it can't be removed, only replaced by another address.
  • If you delete your account, the memories you hold are soft-deleted for 30 days (a grace period in which they can be restored) and then permanently erased.
  • If your trial or subscription ends while you are in another family's circle, your account becomes a guest account, so you keep seeing what that family shares with you. We never delete your account for this. The memories your own account holds go through the same steps as when any plan ends: read-only first, then visible only to you, and then deleted. Your name, phone number and email address stay on your account until you delete it.
  • Data exports are never stored as a file: the archive is assembled while you download it (section 12).
  • Security logs and records we're legally required to keep are retained for the period the law requires.

10. Children in the photos

pouchie is built for adults to share pictures of their own family privately, and those pictures often show children. Children do not create accounts and do not use the app: the account holder is an adult, and the sharing happens inside a closed circle that adult chose.

Brazil's LGPD gives children's and adolescents' data special protection in the child's best interest, and the ECA and the Digital ECA (Law 15.211/2025, in force since 17 March 2026) reinforce a child's right to privacy. If you share images of a child, you confirm that you hold parental authority or equivalent legitimacy to do so, and you are responsible for that sharing.

11. Your rights

Under the LGPD (art. 18) and, where it applies, the GDPR, you can: confirm and access the data we hold about you; correct it; request deletion or anonymisation; obtain a portable copy; withdraw consent; and be told who we've shared it with.

If you hold your own account, you can download a copy of your photos and videos yourself, in the app (section 12).

To exercise any of these, email [email protected]. We respond within the legal deadlines: up to 15 days for confirmation of processing under the LGPD, and up to 30 days under the GDPR. You can also delete your account directly in the app, at any time.

12. Downloading a copy of your photos and videos

If you hold your own account, you can ask for a copy of the photos and videos in the memories your account owns. Only the owner of those memories can ask for it, so a guest who only follows other families' memories has nothing to export.

What's in it

  • Full quality copies of the photos and videos in every memory your account owns, including the ones other people posted in those memories.
  • Not included: captions, comments, anything in the trash, and other families' memories, even ones you were added to.

How it works

  1. In the app, go to Profile › Privacy › Download my data and confirm with a code we send to your phone by SMS.
  2. Right away, we email your verified address to say an export was requested. That email gives you a way to cancel it.
  3. When the export is ready, we send the link only to your account's verified email address.
  4. The link opens a page on our service that asks for another code, sent by SMS to your account's phone, before anything downloads.
  5. The download is a single ZIP file.

Limits

  • The link works for 7 days or 3 downloads, whichever comes first. Resuming a download that stopped partway doesn't count again.
  • You can make up to 1 request a day, and up to 3 every 30 days.
  • If you change your verified email, exports can't go to the new address for 24 hours, and we let your old address know about the change.

Where the archive is built

The ZIP is assembled on our servers in the European Union at the moment you download it, and is never stored as a file. To build it, our servers decrypt each file only while sending it to you. This is different from viewing in the app, where files are decrypted on your own device.

Your email only receives the link

Your email address is never a way to sign in or to recover your account, and an export doesn't change that: the email only carries the link, and the download still needs the code sent to your phone.

After you download

Once the files are on your device, they are outside pouchie's protection: there is no screenshot blocking and no encryption. Keep them somewhere safe.

If you delete your account

Deleting your account stops any export immediately, and its link stops working.

13. Changes to this policy

We may update this policy. When a change is significant, we'll tell you in the app and update the effective date below.

14. Contact

Write to [email protected] with any privacy question, request, or complaint.

Effective date: 17 October 2026.