Privacy Policy
Last updated: 12 August 2026
Pochi keeps a virtual pet alive based on your real health habits. To do that it needs to know about those habits, so this page explains exactly what it stores and who can see it.
Pochi is made by Bailey Martin in Queensland, Australia. Questions go to pochi.app@hotmail.com.
The short version
Your logs are private to you. We don't sell anything, we don't run ads, and there's no analytics SDK watching what you tap. Friends see your handle and a few headline numbers, nothing else. You can delete the lot from inside the app whenever you want.
What gets stored
Your account. An email address, and an identifier from Google or Apple if you signed in that way. Passwords are hashed by our auth provider and we can't read them.
The health stuff you type in. Height, weight, age and your goal. Body measurements, plus the body-fat and lean-mass figures worked out from them. Workouts, including exercises, sets, reps and weights. Food entries with their calories and macros. Water, and how long and how well you slept.
Steps and active energy, but only on Android, only if you connect Health Connect, and only read access. We never write to it.
Things the app works out. Your Health Score and its daily history, your streak, your Pochi's state and how long it's been alive, cosmetics you own, and challenges you've joined.
Bug reports. Whatever you write, plus any screenshot you attach. Read the section on attachments below before you attach anything.
A push token, if you turn notifications on.
Whether you have Premium and when it runs out. Card details go to Apple or Google and never reach us.
We don't collect your location, your contacts, an advertising ID, or anything about how you use other apps.
Why
To run the app, and nothing else. Showing your progress, keeping your Pochi alive, syncing between your devices, answering the AI features when you ask them to, showing friends what you've chosen to show them, sending the notifications you enabled, and knowing whether to unlock Premium.
Your data is not used to train AI models, by us or by Anthropic.
Who else touches it
- Supabase runs the database and sign-in. Your data sits on servers in Singapore.
- Anthropic powers the AI features. The food scanner sends your photo to them to guess what's in it. Trainer Mode, program generation and Coach's Take send the relevant numbers, like how many macros you have left today. Anthropic doesn't train on any of it, and we don't keep the photos.
- Expo delivers push notifications, and only ever sees a device token and the text of the notification.
- Apple and Google handle sign-in and payments.
- Friends you've accepted see your handle, your Pochi's name and colour, your streak, your weekly steps and workouts, and your daily score as a percentage. They cannot see your food, your workouts, your weight or your measurements.
Nobody else, unless a law forces us to hand something over.
About bug report screenshots
The bug tracker is shared. Anything you post there, including screenshots, is visible to other signed-in Pochi users on that report, so don't attach anything you'd rather a stranger didn't see.
The files themselves are stored privately and the links expire, so they can't leak outside the app. Deleting your account deletes your attachments.
Deleting it
Profile → Account → Delete account wipes your account, your logs, your history, your Pochi, your entitlements, your friendships and your attachments, and clears what's stored on your phone. There's no undo and no grace period.
Bug reports you filed stay in the tracker so other people can still see the issue, but they're unlinked from you and shown as "someone".
One thing deleting your account does not do is cancel a subscription. Those live with Apple or Google and have to be cancelled there.
Your rights
Most of your data is visible and editable in the app, and deleting it is one tap. For an export, a correction you can't make yourself, or anything else, email pochi.app@hotmail.com.
Depending on where you live you may have more rights than that. Australians have them under the Privacy Act. In the EU or UK the GDPR gives you access, rectification, erasure, restriction, portability and objection, plus the right to complain to your data protection authority. We'll honour those requests wherever you are.
Security
Row-level security in the database means one account can't read another's. Traffic is encrypted. Anything that matters, like Premium status or deleting an account, is checked on the server instead of trusted from the app. Nothing is perfectly secure, but problems get fixed quickly.
Children
Pochi isn't for under-13s and we don't knowingly store their data. Email us if you think a child has signed up and it'll be deleted.
Changes
If this policy changes the date at the top changes too, and anything important gets flagged in the app.