Privacy Policy

1. Scope

This policy applies to the Pouch iPhone and iPad app, Pouch's remote connection gateway, and the Pouch pages on this website. Pouch is operated by Roscommon Group LLC ("Pouch", "we", or "us"). Read it with our Terms of Use.

2. The short version

Your vault is stored by Pouch on Supabase infrastructure. Document contents and revision history are encrypted at rest. We do not sell your memory, use it for advertising, or train models on it.

When you authorize an assistant, our gateway retrieves or updates documents in your Supabase vault. The gateway does not perform AI inference or create embeddings. It stores the documents you or your assistants choose to save, not your entire assistant conversation.

3. Information Pouch handles

Vault documents

Your Markdown documents, paths, revision records, and document metadata are stored in Supabase Postgres. Each account’s records are isolated by authenticated database access rules. Supabase provides infrastructure encryption at rest; Pouch does not provide end-to-end encryption. The app keeps a local cache for reading offline. Editing and synchronization require a connection.

Credentials and connection state

Pouch uses Google sign-in through Supabase Auth. We receive your Google account identifier, email address, and basic profile information made available during sign-in. Session credentials are kept in the device credential store. Supabase stores your account, session information, OAuth grants, and assistant connection state. Google does not receive your Pouch documents merely because you sign in. No recovery key or iCloud access is required.

Minimal operational metadata

We may process an opaque vault identifier, request identifier, tool name, time, latency, status code, byte count, and record count to secure and operate the gateway. We design application logs not to contain vault content, search queries, file paths, titles, summaries, tokens, or conversation text.

Support and website information

If you contact us, we receive the information you choose to send. These website pages are hosted by Vercel and use Google Analytics; those providers may process ordinary website data such as IP address, browser information, page interactions, cookies, and referral information. Analytics on this website are separate from the Pouch app and vault gateway.

4. How information is used

We use information only to provide requested vault access and synchronization, authenticate and authorize connections, prevent abuse, diagnose reliability or security problems, provide support, comply with law, and protect Pouch and its users. Pouch does not make automated decisions about you or score the importance of your memories.

5. Providers and connected assistants

Supabase hosts authentication, the backend, document databases, and connection state. Google authenticates your Google account. The assistant consent interface is hosted on our existing website by Vercel and talks directly to Supabase; it does not load website analytics. Apple distributes the iOS app but does not provide its vault storage or authentication. Vercel, Google Analytics, and our support-form provider operate parts of this website. Their processing is governed by our arrangements with them and their applicable terms.

When you connect ChatGPT, Claude, Codex, or another assistant, that provider receives the vault information the assistant requests through Pouch. The provider's own privacy policy governs what it does with that information. Disconnect an assistant to revoke its Pouch access. Pouch does not control an assistant provider's independent retention of information already disclosed to it.

6. No sale, advertising, or model training

We do not sell or rent personal information. We do not share personal information for cross-context behavioral advertising, use vault contents for advertising, or use vault contents to train machine-learning models. We do not install session replay or screen-recording analytics in the app.

7. Retention and deletion

Vault records remain in Supabase until you delete them. Archiving moves a document to an archive folder; it does not delete it. Pouch retains up to 20 previous revisions per document. Permanent document deletion removes its active record and retained revisions. Deleting your Pouch account removes the Supabase Auth account and its associated documents, revisions, and connection records. Infrastructure backups may expire according to Supabase retention policies. The local cache remains until removed through the app or by deleting the app. Connection credentials and grants remain until you disconnect the integration, delete the vault, or they expire or are revoked. Security and operational metadata may be retained only as reasonably needed for security, reliability, legal compliance, and dispute prevention. Infrastructure providers may retain limited service logs under their own policies.

Export creates a portable ZIP archive on your device for you to save or share. After export, you control that copy and the destination's privacy practices apply.

8. Your choices and rights

You can browse, edit, archive, and delete documents; export the vault as Markdown; disconnect assistants; and delete the vault from Pouch. Depending on where you live, you may also have rights to access, correct, delete, or restrict certain personal information. Submit a request through Pouch Support. We may need to verify your request. Sign in with the same Google account to access your memories on a new device. Access to that Google account is managed through Google’s account-recovery process.

9. Security

We use measures intended to protect Pouch data, including encrypted transport, provider encryption at rest, Google sign-in, authenticated database rules, tenant isolation, revocation, rate limiting, and log minimization. This is not end-to-end encryption: the Pouch service can read documents to fulfill authorized assistant requests. No storage or transmission system is perfectly secure. Protect your Google and connected-assistant accounts, keep devices updated, and promptly disconnect access you no longer recognize or need.

10. Children and international processing

Pouch is not directed to children under 13, and we do not knowingly collect their personal information. If you believe a child has provided information, contact us. Providers may process information in the United States and other countries, subject to applicable safeguards and law.

11. Changes and contact

We may update this policy as Pouch changes. We will post the revised policy and update its effective date. Material changes will receive additional notice when required.

Roscommon Group LLC
P.O. Box 389
Issaquah, WA 98027
United States
Phone: (971) 264-3654
Contact: Pouch Support