Chobo Pocket Privacy Policy

Last updated: 2026-10-02 · Provider: KUANG LIAN CO., LTD. ("we") · Contact: [email protected]

1. Our principles

Chobo Pocket is local-first: your ledger (accounts, transactions, categories, budgets, diary…) stays on your phone by default. We only receive the minimum data a feature needs when you use a feature that requires the network.

• When you turn on cloud sync or join a group, your ledger is uploaded end-to-end encrypted: the keys exist only on your devices (and those of people you authorize), so we cannot read your ledger.
• We do not sell personal data, and we never use ledger content (amounts, notes, merchants, diary, receipts) for advertising or share it with advertisers.

2. No account needed

Bookkeeping, statistics, budgets, the diary and other core features work without signing in. On first network use the app creates a random device identifier; our server only stores its hash, to count daily free quotas and prevent abuse. Signing in is only needed for cloud sync, groups and restoring plans across devices.

3. What each feature sends

Stays on your phone and is never uploaded: diary photos, receipt photos in personal ledgers, app-lock settings, automatic backup files. Diary text, moods, stickers and drawings are only uploaded end-to-end encrypted when you turn on sync.

4. Advertising (rewarded ads)

• We only use Google AdMob rewarded ads, loaded and played only when you tap "Watch ad" on the Points screen. There are no banner, interstitial or app-open ads, and bookkeeping never requires watching an ad.
• When you tap "Watch ad", Google may collect your device advertising identifier (Android advertising ID; on iOS the IDFA only if you allow tracking), device and app information, approximate location derived from your IP address and ad interactions, to serve and measure ads and prevent fraud. See how Google uses data: https://policies.google.com/technologies/partner-sites.
• Consent: in the EEA, the UK, Switzerland and other regions where consent is required, Google's consent form (UMP) is shown before your first ad. You can change your choice anytime in Settings → Security & privacy → Ad privacy options.
• iOS tracking (ATT): we never ask at launch; the "Allow tracking" prompt only appears the first time you tap "Watch ad". If you decline you can still watch non-personalized ads.
• If you decline personalized ads, we only request non-personalized ads (Google may still use approximate location and device information for frequency capping and fraud prevention).
• We never pass ledger content, amounts, notes, merchants, diary entries, receipts or keywords to the ad SDK, and never use them for ad targeting.
• You can reset or delete your advertising ID in your system settings (Android: Settings → Google → Ads; iOS: Settings → Privacy & Security → Tracking).

5. Groups and sharing

Groups can be family, team or company groups. All ledger content stays end-to-end encrypted: the server only stores permission metadata (members, roles, who may receive which key) and ciphertext. Group names, department names and expense-report comments are encrypted with a group key too.

5.1 What other members can see

• Shared ledgers: members can view or add transactions in a shared ledger according to their role (owner, admin, editor, viewer) and see who recorded each one.
• Your member ledger: whether and with whom it is shared depends on the group's visibility rule (everyone / managers see their reports / each member decides) and your own settings. Before you join, the app lists who can see which of your data; afterwards you can check it anytime under "My sharing".
• Sharing level: a "totals only" viewer sees monthly totals and counts per category and daily spending totals — not individual transactions, merchants or notes. A "full details" viewer sees transactions (amount, category, date, merchant, note, sticker). Your diary, budgets, settings, weekly insights and other data are never shared with viewers.
• Private transactions: a transaction marked private can only be decrypted by your own devices; no viewer can see it and it is excluded from totals.
• Stop sharing: in family and team groups you can stop sharing anytime; other members lose access at their next sync and the ledger key is rotated. We cannot erase what others have already seen.

5.2 Company groups

• The company creates a work ledger for each employee. Work ledgers belong to the company: depending on the company's settings, managers, admins and the finance role can see the business expenses and receipts in them. Work ledgers cannot be made private.
• Your personal ledgers are never visible to the company; the app clearly labels "Company ledger" and "Personal (the company can't see this)".
• Expense-report status, submitter, approver and timestamps are stored in plain form (needed for notifications and permission checks); report contents (transaction list, amounts, comments) are encrypted.
• The company is responsible for its employees' data: when it uses the service for employees' business expenses, it should inform them as required by local law.

5.3 Leaving or being removed

• When you leave or are removed, the group's shared ledgers and other members' ledgers you could view are deleted from your devices at the next sync, and the related keys are rotated.
• When an employee leaves or is removed from a company, the work ledger stays with the company (archived; finance can still view it); personal ledgers are not affected.
• When a group owner's plan expires, the group's ledgers become read-only and are kept for 180 days.

5.4 Receipt photos in company ledgers

Receipt photos attached to transactions in a company work ledger are compressed on your phone, encrypted with the ledger key and uploaded to our storage (Cloudflare R2, ≤ 2 MB each); only authorized members' devices can decrypt them. Receipt photos in personal ledgers and all diary photos are never uploaded.

6. Purchases and subscriptions

• Pro, Family and Company plans (auto-renewing subscriptions) and sticker packs and appearance items (one-time purchases) are paid through the App Store or Google Play. Payment is processed by Apple / Google; we never receive or store your card number or payment details.
• We use RevenueCat as a processor to manage purchase status. RevenueCat receives an anonymous app user id (our user id once you sign in), store receipts and transaction information, and your store country, to confirm which plans and items you own. We only receive the plan, items, expiry date and (for company plans) the number of seats from RevenueCat.
• Points are stored only on your phone; they cannot be bought with money or exchanged for cash.

7. Push notifications

• The app only asks for notification permission after you sign in and join a group. You can turn off expense-report or group notifications anytime in your system settings or in Settings → Notifications.
• We store your device's push token, platform and language, and deliver notifications via the Expo Push Service and Apple (APNs) / Google (FCM).
• Notifications never contain amounts, merchants or notes — e.g. "{name} submitted an expense report". Some are silent background notifications used only to trigger a sync.
• Push tokens are deleted when you sign out or delete your account.

8. Usage data and crash reports

• Usage data (PostHog): feature usage only (e.g. "a transaction was added manually", "a family group was created") — never amounts, notes, merchants, diary content, group names or invoice contents. Off by default in the EU, UK, Switzerland, Brazil and similar regions until you consent; can be turned off anytime elsewhere under Security & privacy.
• Crash reports (Sentry): error details and device model, with all financial fields removed before sending. Can be turned off.

9. Service providers (processors)

These providers may be located outside your country (e.g. in the United States); we use contractual and other safeguards as required by law .

10. Retention

11. Deleting your account

• In the app: Settings → Account & sign-in → Delete account → type the confirmation word.
• Without the app: follow https://kuangli.tw/chobo-pocket/delete-account/en/ and email [email protected] from the address (or with the sign-in method) you use.
• Deleted: sign-in methods and account data, cloud ledgers you own (including shared ledgers — other members lose them at their next sync), your encryption keys, group memberships and viewing rights, push tokens, chat-bot links and pending items, usage-quota records and the link to your purchases; for Sign in with Apple we also revoke the authorization with Apple.
• Not deleted, or kept by others:
• company work ledgers belong to the company and stay with it;
• groups you own: transfer ownership first, otherwise the group and its shared ledgers are deleted too;
• content other members already synced to their devices within their permissions;
• data on your phone (you choose to keep or erase it after deletion);
• App Store / Google Play subscriptions — you must cancel them in the store; we cannot cancel them for you;
• anonymous aggregate records without personal data (e.g. daily request counts) and quota records tied only to a hashed anonymous device id.
• Deletion cannot be undone.

12. Your rights

You can anytime: export your data (CSV, JSON), delete all local data, delete your account and cloud data, turn off usage data and crash reports, change your ad consent, request access to, correction or deletion of the account data we hold, or withdraw consent (email [email protected]). Depending on where you live you may also complain to a data-protection authority. Because ledger content is end-to-end encrypted we cannot look up or restore it for you; if you lose your sync password your cloud data cannot be recovered.

13. Children

The service is not directed to children under 13 (under 16 in the EEA and other places where the law sets a higher age). We do not knowingly collect children's personal data; if you believe a child has given us personal data, contact [email protected] and we will delete it. Ad requests are not tagged as child-directed and the maximum ad content rating is PG.

14. Security

All traffic uses HTTPS; sensitive data (keys, sign-in tokens, verification codes) is kept only in the device's secure storage; ledgers, group names, expense-report contents and company receipts are stored on our servers as ciphertext only.

15. Changes

Material changes will be announced in the app and reflected in the "Last updated" date above.

16. Contact

KUANG LIAN CO., LTD. · [email protected]