Privacy

What we keep

When you sign in with Google, we get your name, your email address and a link to your Google profile picture. That's the standard sign-in basics and nothing else: no password, no contacts, nothing from your inbox or your Drive.

Then there's what you put in:

• Your family's name, and each parent's name, email and picture link, so you can see who's who.
• Each kid's name, an emoji and a colour. Kids don't have accounts, and a first name or a nickname is plenty.
• Every award, warning, fine and payment: which kid, how much, the note, who issued it and when.
• Photos, if you add them.
• The email address of any parent you invite.

Who can see it

Every parent in your family sees everything in it: the kids, the whole history and the photos. That's the point.

We run it, so we can get at the database too. That's how a family gets deleted when someone asks (see below).

We don't sell or share any of it with anyone.

Photos

Before a photo is uploaded, the app strips the hidden details a phone tucks into it: where it was taken, when, and the make and model of the phone. What's stored is just the picture. Photos added before 13 September 2026, in the app's first few days, went up before this was in place and still carry whatever the phone put in them.

Right now, a photo's link works for anyone who has it, signed in or not. The app only gives those links to the parents in your family, and never puts one in anything you share: a shared card is a picture, not a link. But a link that got out, copied from a browser say, would open the photo for whoever had it.

If a parent is removed from the family, the ledger is closed to them straight away. The photos they have already opened stay reachable to them.

Both are good reasons to photograph the crime scene rather than the kid.

Sharing

Share and Copy turn a card into an image and hand it to your phone. Once it's in the family chat it's a picture in that chat, photo and all, and it goes wherever that app sends it. Copy puts it on your clipboard, which your phone may sync to your other devices. We can't take a card back once it has left.

Where it lives

Your family's data and photos are stored with Google, in Firebase, in Google Cloud's Sydney region (australia-southeast1). Your sign-in record is kept by Google's Firebase Authentication, which we don't set to any particular region.

The pages come from Firebase Hosting, which sees what any web server sees, like your IP address. The domain's DNS is at Cloudflare. It only tells your phone where pocketjustice.app is, and your visits don't pass through it.

Usage stats are the exception to Sydney. Google Analytics, below, keeps them with Google, which processes them outside Australia, in the United States among other places.

Usage stats

The app and the home page use Google Analytics to count how Pocket Justice gets used: which screens get opened, and how often an award, warning or fine is issued, a card is shared, a family is started or a parent is invited.

That's all it's told. Never a name, a note, an amount, a photo or an email address, and never which family or kid something was about. A screen address that would say which, like a kid's page, goes as a pattern, /app/kids/:id, and an invite code in a link is left off. Google Analytics also sees what any website sees of your device: the browser, the kind of phone, the screen size, and roughly where you are, worked out from your IP address. Google says Analytics doesn't store the IP address itself.

It's kept for two months. None of it is used for advertising: Google's ad features, Google signals and sharing with other Google products are all turned off.

To turn it off, switch off Usage stats on the app's Family screen. That's for the phone or computer you do it on, and the home page there stops too. A content blocker, or Google's opt-out add-on, stops it everywhere. This page doesn't use it at all.

No ads, no other trackers

No ad networks, no tracking pixels and no scripts from anyone else beyond the ones on this page. This page runs one small script of our own, which remembers light or dark. The home page runs that, one that sends you on to the app if you're signed in, and Google Analytics.

The app itself loads Google's reCAPTCHA when it starts, for Firebase App Check. It works quietly in the background, with no puzzles, and checks that requests are coming from the real app rather than a script hammering the servers. reCAPTCHA is covered by Google's Privacy Policy and Terms of Service.

Apart from Google, for Firebase, reCAPTCHA and Google Analytics, and Cloudflare for the DNS, nobody else is involved.

On your phone

The app keeps you signed in and remembers a few small things in your browser: light or dark, which card design is up next, whether you've turned usage stats off, and a note that you're signed in so the home page can send you straight to the app.

Google Analytics sets two cookies, _ga and one starting _ga_, so it can tell a returning phone from a new one. They last up to two years, and switching off Usage stats deletes them. reCAPTCHA, in the app, may set its own.

Keeping and deleting

Nothing in the app is ever deleted. Voiding a fine marks it, and it stays in the history. Everything stays until the family is deleted.

There's no delete button. To have your family deleted, email hello@pocketjustice.app. We do it by hand: the family, the kids, every entry and payment, every photo and the invites. Before anything goes, a backup copy is saved on the computer doing the deleting, as the undo if something goes wrong. It isn't kept in the cloud.

Deleting a family doesn't delete your sign-in. Your name and email stay on your profile, and you can sign in again later and start a new family.

Changes and questions

If any of this changes, this page changes with it, and so does the date at the top.

Questions? Email hello@pocketjustice.app.

What using Pocket Justice does and doesn't promise is on the Terms page.