Privacy

In effect from 4 November 2026.

Pokut is a ledger for a group that fines its own people. To do that it has to hold a record of who is in your group and what each of them owes, which is personal data. This page says what it holds, why, who else can see it, and what happens when you ask to be erased. It is written to be read rather than to be defensible, and where the answer is uncomfortable it says so.

If you want something done — a correction, a copy, an erasure — write to info@pokut.io. A person reads it.

Who is responsible

Pokut is run as a small project, and the contact for anything on this page is info@pokut.io. For the purposes of the GDPR, Pokut is the controller of the data described below.

What Pokut holds

Your name and your email address: Given when you sign in. Your name is what the group sees beside your figure.
How you sign in: Whether you used an emailed code, Google or Apple. A code you have been emailed is stored until it is used or expires. If you use Google or Apple, Pokut keeps the identifiers and tokens those services return so that it recognises you next time.
Your sessions: Each sign-in creates a session record carrying the time, your IP address and your device's user agent. That is how a signed-in phone stays signed in and how an unexpected sign-in could be spotted.
Which groups you are in, and your role in each: Admin, manager or member. A group may also give you a display name that belongs to the group rather than to your account.
Every ledger entry you record, and every entry you are the subject of: Its kind — fine, payment, expense, advance — its amount, when it happened, which offence it was priced from, who recorded it, who it is about, and any free-text note written on it. Entries that have been voided or amended are kept alongside the ones that replaced them.
Your device's push token and your notification settings: Held only while you have notifications switched on, so a fine against you or a payment of yours landing can reach your phone.
Your language: English, Czech or Slovak, and the group's own language if an admin has set one.
Your group's bank details, if an admin enters them: An account number and an account holder's name, so the app can show other members where to send money. These are the group's details, not yours, and Pokut never touches the account.
Email addresses that have been invited: An invitation holds the address it was sent to — including when the person it was sent to never signs up. That record exists so the invitation can be accepted, and it is removed when it is accepted, withdrawn or expires.
Records imported from the earlier version of Pokut: Where a group's history was carried over, a record may keep a link to the identity it had in that earlier version.

A group can hold your name without you ever using Pokut

An admin can add somebody to a group and record fines about them before that person has ever signed in — that is how a group gets its books straight on the first evening. If that is you, Pokut holds your name, your role in the group, and the entries about you, and the person who put them there is the admin of that group. You can ask us to remove your name at info@pokut.io, whether or not you have an account.

What Pokut does not hold

No photograph, and no face. Everybody in Pokut has a picture, and nothing about it is stored or uploaded. A member's record carries an eight-character seed, and the drawing is computed from that seed on the device — the same seed returns the same person, on every phone, offline, on first launch. The seed discloses nothing about you, and there is no image to upload, to leak, or to ask us to delete.
No payment data. Pokut records money; it never moves money. There is no card number, no account of yours, no payment processor and no settlement. A payment entry is a record that cash changed hands somewhere else.
No location, no contacts, no advertising identifier.
Nothing from this website. These pages set no cookie, load no font and run no third-party script. There is no analytics on pokut.io.

Why Pokut holds it, and on what basis

To give you the thing you asked for: Your account, your groups, your figure and the group's books. Performance of a contract.
To keep the group's books complete and correct: Legitimate interest. This is why a voided entry is kept rather than deleted, and why erasure works the way the next section describes: an entry that vanished would make everybody else's figure wrong.
To keep sign-in secure: Legitimate interest. Session records, including the IP address, exist for this.
To send you a notification: Your permission, which you can withdraw at any time in your phone's settings or in Pokut's own notification settings. Nothing else is sent to your phone.
To send you the two emails Pokut sends: A sign-in code and an invitation. Performance of a contract. Pokut sends no newsletter and no marketing of any kind.

Who else can see it

The people in your group. How much of your figure they see is the group's own choice — an admin sets who sees whose balance. Managers and admins see every figure in the group. Anybody who can see the rankings can see who owes most and who has paid in most, to the extent that setting allows. Seeing where everybody stands is what the app is for, so this is not incidental: it is the feature.

Nobody else. Pokut sells nothing to anybody, shares nothing with advertisers, and has no business that depends on your data.

Who processes it on Pokut's behalf

Amazon Web Services — Frankfurt, Germany (eu-central-1): The application, the database and the backups all live there. Amazon SES, in the same region, sends the sign-in code and the invitation.
Apple: Sign in with Apple, if you use it. Push notifications are delivered through Apple's own push service — Pokut talks to Apple directly rather than through a third party, so a push passes through nobody else's hands.
Google: Google sign-in, if you use it.
Expo: App updates are fetched from Expo. The app also reports when it is opened and whether an update reached it to Expo's service. That is the only usage reporting in Pokut and it was added for one reason: three updates were published, the member who asked for them saw none of them, and there was no way to tell "nobody downloaded it" from "everybody did and it failed". It reports no name, no email and nothing about your group or its money.

Sign in with Apple and Google sign-in may involve a transfer of your data to the United States, under the European Commission's standard contractual clauses.

How long

A session lasts 30 days, extended each time you use the app, and is deleted when it expires or when you sign out.
A sign-in code lasts minutes.
An invitation is removed when it is accepted, withdrawn or expires.
Ledger entries are the group's record and are kept for as long as the group exists. Leaving a group does not remove them — a former member's history stays, which is the only way the group's totals can still add up.
Your name and email are kept until you ask for them to be erased.

Erasure, said plainly

You can ask to be erased, and this is exactly what happens. It is not deletion, and calling it that would be a lie.

Your name and your email address are replaced with a meaningless marker, and your picture reference is cleared.
Your sessions and your sign-in records are deleted outright.
Any invitation holding your address is removed.
Any name a group gave you is cleared.
The ledger entries stay, and your internal identifier stays with them. Removing them would change what every other person in the group owes. What is left is a number with no name on it.

This is pseudonymisation, not deletion

A row with no name on it is not the same as no row. In a small group, somebody who knows the group and remembers the evening could still work out which entries were yours from their pattern, their dates and their amounts. We are not going to pretend otherwise. The alternative was deleting the entries, and that would have silently changed everybody else's figure — so this is the trade that was made, deliberately, and it is written down in the project's own decision record.

Do not put personal remarks in a note

A note on an entry is part of the group's financial record and is covered by an audit trail, so it cannot be quietly scrubbed afterwards without rewriting that trail. A note that mentions somebody else — "paid back what he owed Sarah" — is personal data about a person who never agreed to be in it. Notes are for what the money was, not for what anyone thinks. If a note about you needs to come out, write to us and it will be handled as an exception, with a record of the decision.

What is written down when something changes

Changes to ledger entries and to a group's fine prices are recorded in an audit trail, so a correction can be told apart from a quiet rewrite. Changes to who is in a group and to their roles are not recorded that way. That is a known gap rather than an oversight: the audit trail was deliberately kept to the financial tables so that erasing an identity would not mean mutating it.

Your rights

Under the GDPR you can ask for a copy of your data, ask for it to be corrected, ask for it to be erased on the terms above, object to processing based on legitimate interest, and ask for your data in a portable form. Write to info@pokut.io.

If you are not satisfied with the answer, you can complain to a data protection authority. The one for Pokut is the Czech Úřad pro ochranu osobních údajů (uoou.gov.cz), and you may also complain to the authority where you live.

Children

Pokut is not intended for children. If you are under 16, use it only with the agreement of a parent or guardian.

Security

Traffic between the app and Pokut is encrypted. The database is not reachable from the internet and sits in a private network; its storage and its backups are encrypted. A group's data is scoped to the group — there is no route by which one group can read another's.

Changes to this page

If what Pokut holds changes, this page changes with it and the date at the top moves. If a change matters to you, you will be told in the app rather than left to notice.

Back to Pokut · Terms of use