Privacy Policy

1 Who We Are

Pocaly ("we," "our," or "us") is an iOS application that helps K-pop fans track their photocard collections. We are an independent developer. You can reach us at hello@pocaly.app.

2 What This Policy Covers

This Privacy Policy explains what information we collect when you use the Pocaly app, how we use it, who we share it with, and your rights regarding that information.

3 Information We Collect

4 How We Use Your Information

We use your information only to operate and improve Pocaly. We do not use your data to serve third-party advertising. We do not sell your data.

• Provide and operate the app — sync your collection, wishlists, and preferences across devices.
• Authenticate your identity via Apple Sign In.
• Display your profile and collection to you.
• Process subscription purchases and enforce feature tier limits.
• Run AI card-matching (CLIP embeddings via Replicate) when you use the scan feature.
• Review fan-submitted photocard images in our admin panel before they are published.
• Improve database accuracy based on community submissions.
• Respond to support requests sent to hello@pocaly.app.

5 Third Parties We Share Data With

We share data only with the services needed to operate Pocaly. We do not sell your data.

6 User-Submitted Photocard Images

When you choose to submit a photocard scan to the community database:

• Your image is uploaded to private storage and reviewed by a Pocaly administrator before publication.
• If approved, the image is published to the Pocaly database and visible to all users.
• If rejected, your submission is deleted.
• Approved images may be attributed to you by your Pocaly username if you consent to attribution. Attribution is optional.
• You retain ownership of photographs you took. By submitting, you grant Pocaly a non-exclusive, royalty-free license to display that image within the app.

7 Children's Privacy

Pocaly is not directed at children under 13. We do not knowingly collect personal information from anyone under 13. If you believe we have inadvertently collected such information, contact us at hello@pocaly.app and we will delete it promptly.

8 Data Storage and Security

Your data is stored on Supabase servers. Supabase uses Row Level Security (RLS) to ensure users can only access their own data. Data is encrypted in transit (TLS) and at rest.

We are an independent developer and cannot guarantee absolute security, but we apply industry-standard practices and will notify you promptly in the event of a breach affecting your personal data.

9 Data Retention

We retain your account and collection data for as long as your account is active. If you delete your account, we will delete your personal data within 30 days, except where we are required by law to retain it. Community-contributed photocard images that have been approved and published may remain in the database after account deletion because they are part of the shared community record.

10 Your Rights

Depending on where you live, you may have rights including:

To exercise any of these rights, email hello@pocaly.app. We will respond within 30 days. If you are in the European Economic Area, you also have the right to lodge a complaint with your local data protection authority.

11 California Residents (CCPA)

If you are a California resident, you have the right to know what personal information we collect, the right to delete it, and the right to opt out of its sale. We do not sell personal information. To submit a request, email hello@pocaly.app.

12 Changes to This Policy

We may update this policy as the app evolves. We will post the updated policy at pocaly.app/privacy and update the "Last updated" date. For material changes, we will notify you in-app.

13 Contact