Privacy

This is a translation for your convenience. The German version is legally binding.

Controller

Responsible for data processing in the Pocketbon app and on this website:
Dominik Ginting, Ginkaro
c/o IP-Management #12422, Ludwig-Erhard-Str. 18
20459 Hamburg, Germany
Email: hello@ginkaro.com

The short version

• There is no account. Your vouchers stay on your device only.
• The server only receives what you give away yourself, a photo to read if you agree to it, and a loyalty card when you add it to Apple Wallet.
• No cookies, no tracking, no ads, no analytics, neither in the app nor on the website.

What stays on your device

• Vouchers with name, amount, currency, code, PIN, expiry date, where they're kept, note and photo are stored only in the app on your device.
• Reminders are local notifications on your device. There is no sync. Which redeemed promises you've checked off also stays on the device.
• A backup is only created when you export it yourself in the settings. It also contains your device's token so you can keep managing the vouchers you gave away on a new device. Keep it safe.

Reading photos

• On iPhones with Apple Intelligence, the app reads the photo directly on the device.
• If your device can't read the photo itself, the app asks before the first time whether it may send it to our server. Only if you agree is the photo passed on from there to Anthropic (Claude) to read the name, amount, code, PIN and date. Without your consent, you enter the details by hand.
• Our server doesn't store the photo. According to Anthropic, requests are kept for at most 30 days and are not used for training.
• The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time in the settings under “Read photos on the server”.

Loyalty cards in Apple Wallet

• When you add a loyalty card to Apple Wallet (with Pocketbon Plus), the app sends the card's name, number, barcode, color and note to our server. A pass is built there and signed with our certificate from Apple; otherwise Wallet won't accept it.
• As proof of Plus, the app also sends the purchase confirmation signed by Apple (product, purchase and expiry date, purchase ID, store country). The server only checks the signature and whether Plus is active; it doesn't store the confirmation and can't link it to a person.
• The server sends the pass back right away and doesn't store the details. After that, the card is in Wallet on your device.
• The legal basis is fulfilling your request to add the card to Wallet (Art. 6(1)(b) GDPR).

Vouchers you design yourself

• When you give away a voucher you designed, we store the title, message, both names, color and occasion, and its status (opened, redeemed, thanked). For a voucher book, the vouchers in it and when each one was redeemed are added.
• Anyone who knows the link can view and redeem the voucher. Only share the link with the person you're giving it to.
• Your device identifies itself with a random token. The server only keeps a hash of it.
• For notifications about the vouchers you gave away, we store your device's push token and the app's language, so notifications arrive in your language.
• The legal basis is providing the feature you use (Art. 6(1)(b) GDPR).
• You can withdraw a single voucher in the app with “Withdraw voucher”. “Delete all data” in the settings removes your device and all vouchers you gave away from the server. Until then, they stay stored.

The page for recipients

• The page behind the link sets no cookies and contains no statistics, ads or embedded content from other providers.
• Unwrapping, redeeming and saying thank you are stored with the voucher so the giver can see the status.
• The page uses your browser's language setting to show German or English; it isn't stored.

Notifications

We send notifications about vouchers you gave away through Expo's push service (650 Industries, USA). Expo delivers them through Apple (Apple Push Notification Service) and Google (Firebase Cloud Messaging). Reminders for your own vouchers, on the other hand, are scheduled only locally on the device.

In-app purchases

You buy Pocketbon Plus through Apple's App Store or Google Play, forever or as a subscription. Apple or Google handle payment, invoices, cancellation and refunds; we receive no payment data and no personal details. At launch and occasionally afterwards, the app only asks Apple or Google whether Plus is active for your Apple Account or Google Account, and remembers that on the device.

Ratings

After a few good moments, such as redeeming a voucher, the app asks once whether you'd like to rate it in the App Store or on Google Play. The prompt comes from Apple or Google; we learn nothing about you.

Hosting at Vercel and database at Neon

• The website and server run at Vercel Inc. (USA), the database for given vouchers at Neon in Frankfurt am Main, Germany.
• When a page is requested, Vercel processes technically necessary data: IP address, time, page requested, amount of data, status code, referrer, browser and operating system.
• The purpose is secure and stable operation. The legal basis is our legitimate interest (Art. 6(1)(f) GDPR).
• Log data is kept only as long as necessary for this and then deleted.
• We have a data processing agreement with Vercel under Art. 28 GDPR.
• A limit on excessive requests protects the service. For this, we store only a hash of the device token and the IP address with the time of each request and delete it after one day at the latest. The legal basis is Art. 6(1)(f) GDPR.

Recipients outside the EU

Anthropic (reading photos), Expo (notifications) and Vercel (hosting) are based in the USA. Transfers rely on the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework (Art. 45 GDPR) where the provider is certified, and additionally on the European Commission's standard contractual clauses.

Contact by email

If you write to us, we process your email address, your name if given, and the content of the message in order to reply. The legal basis is Art. 6(1)(f) GDPR, or Art. 6(1)(b) GDPR for an inquiry about a contract. We delete the message once it's no longer needed and no legal retention obligations apply.

Cookies and tracking

The app and website set no cookies and use no tracking, analytics or advertising.

Fonts

The Sora and Figtree fonts are served from our own server, without connecting to third-party servers.

Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw consent at any time with effect for the future. Where we process data based on legitimate interests (Art. 6(1)(f) GDPR), you can object (Art. 21). Just write to hello@ginkaro.com.

Right to lodge a complaint

You can lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The competent authority is the Data Protection Commissioner of Lower Saxony (Landesbeauftragte für den Datenschutz Niedersachsen), Prinzenstraße 5, 30159 Hannover, Germany, poststelle@lfd.niedersachsen.de.

Last updated

November 2026. We update this policy when the app, website or the law change.