Privacy Policy

Docspocket Ltd ("DocsPocket", "we", "us") operates docspocket.com, a service for storing copies of identity and personal documents and receiving expiry reminders. For the purposes of the EU General Data Protection Regulation (GDPR) and the UK GDPR, Docspocket Ltd is the data controller for the personal data described in this notice.

Contact for privacy matters: privacy@docspocket.com.

• Account data: email address, optional name, password hash (handled by our authentication provider), sign-in method and timestamps.
• Document data you upload: photos of passports, ID cards, driving licences, residence permits and visas, plus the details you save (holder name, document number, issuing country, expiry date, notes).
• Legacy & Essentials data (optional add-on): records you create about pensions, insurance and similar arrangements, including any beneficiary or contact details you choose to enter.
• Payment data: subscription status, plan tier and renewal date. Card details are collected and processed directly by Stripe — we never see or store them.
• Technical data: IP address (used transiently to show prices in your local currency and for security), browser and device information, and error logs.

Identity documents can reveal information such as nationality, date of birth, and in some cases biometric-style imagery. We process this content solely on the basis of your explicit consent (Article 9(2)(a) GDPR / UK GDPR), given when you choose to upload a document. You can withdraw that consent at any time by deleting the document or your account; withdrawal does not affect processing carried out before withdrawal.

• Providing the vault and expiry reminders — performance of our contract with you (Art. 6(1)(b)), plus explicit consent for document content (Art. 9(2)(a)).
• Account creation, sign-in and service emails — performance of contract.
• Taking payment and preventing fraud — performance of contract and our legitimate interests (Art. 6(1)(f)).
• Keeping the service secure and diagnosing faults — legitimate interests in operating a safe, working service.
• Meeting tax and accounting obligations — legal obligation (Art. 6(1)(c)).

We do not use your data for advertising, profiling or automated decision-making.

We use a small number of processors, each bound by a data processing agreement:

• Supabase — database, authentication and encrypted file storage.
• Cloudflare — hosting, content delivery and network security.
• Stripe — payment processing (independent controller for payment data).
• Resend — delivery of account and reminder emails.

We do not use any AI provider, OCR service or document-recognition tool. You enter every detail yourself. We never sell your data or share it with advertisers. We disclose data to authorities only where legally required.

Some providers process data outside the EEA or UK. Where that happens, transfers are covered by the European Commission's Standard Contractual Clauses together with the UK International Data Transfer Addendum, or by an adequacy decision, plus additional technical measures such as encryption in transit and at rest.

• Documents and vault entries: until you delete them or close your account.
• Account data: for as long as your account is open. After you delete your account we erase your documents and files immediately and remove account records within 30 days.
• Payment and invoice records: retained for up to 7 years to meet tax law.
• Security and error logs: up to 90 days.

Document photos and sensitive details are encrypted in your browser with AES-GCM-256 before they are uploaded. The server only stores ciphertext. Data is encrypted in transit (TLS) and at rest, access is restricted by row-level security rules that scope every record to its owner, and administrative access is limited to what is needed to run the service.

Your vault passphrase and recovery key are known only to you. Docspocket does not store, cannot access, and cannot reset them. If you lose both your passphrase and your recovery key, your encrypted documents cannot be decrypted by anyone, including us. No system is perfectly secure, so please use a strong, unique password and keep your recovery key in a safe place.

Under the EU and UK GDPR you have the right to:

• access a copy of your data (available instantly from your account privacy page);
• have inaccurate data corrected;
• have your data erased (self-service account deletion);
• restrict or object to processing;
• receive your data in a portable, machine-readable format;
• withdraw consent at any time;
• lodge a complaint with a supervisory authority.

In the UK that is the Information Commissioner's Office (ico.org.uk); in the EU it is the data protection authority of your country of residence. Email privacy@docspocket.com and we will respond within one month.

DocsPocket is not intended for children under 16. You may store a child's document as their parent or guardian, in which case you are responsible for that data.

If we make a material change to this notice we will tell you by email or in the app before it takes effect.