← Back to Home

Your GDPR Rights

Last updated: 7 October 2026

In short

The rights described on this page are the same for you wherever you live.

Who to contact

Your rights

  • Access: get a copy of the data we hold about you.
  • Rectification: correct data that is wrong or incomplete.
  • Erasure: have your account and data deleted.
  • Restriction: ask us to limit how we use your data.
  • Portability: receive your data in a machine-readable format.
  • Objection: object to processing based on our legitimate interest.
  • Withdraw consent: at any time, for anything based on consent (push notifications): turn off notifications for Pick a pocket in your phone's settings. This does not affect processing before the withdrawal.
  • No automated decisions: we do not make decisions about you by automated means, and we do not profile you.

How to use them

Directly in the app: you can edit your profile, export a wallet to a CSV or PDF file, and delete your account from the profile screen. For a complete copy of everything we hold about you, write to us.

By email: write to privacy@pickapocket.app from the address registered to your account. Tell us which right you want to use. We may ask for additional confirmation of identity if we cannot match the request to an account.

We answer within one month. If a request is complex we may extend this by up to two further months, and we will tell you within the first month if that happens. Using your rights is free; we may charge a reasonable fee, or refuse to act, only for manifestly unfounded or excessive requests.

How account deletion works

  • You request deletion in the app. If you can no longer use the app, write to privacy@pickapocket.app from the address of the account, and we will delete it within one month.
  • We email you a one-time code, so that nobody else can delete your account.
  • Nothing is deleted until you enter the code in the app. Once you enter it, deletion is carried out straight away and can no longer be stopped. If the code is never entered, the request is cancelled after 24 hours.
  • Your account, wallets, categories, expenses, shared-wallet links, invitations you sent or received, and push tokens are permanently deleted. A wallet you own is deleted even if you shared it, together with what other members added to it.
  • One exception: when someone else split an expense with you in their wallet, the amount of your share stays in that expense, but without your name, email or account ID. It no longer counts in anyone's balance, so nobody is left owing you or being owed by you. Payments between you and other members stay in the same way, without anything that identifies you.
  • Audit records of your own actions and of the wallets you own lose their content (names and amounts). Records of what other members did in their own wallets, such as a payment between you and them, keep your account ID and the amount. All audit records keep the action, its time, the IP address and the device, for up to 12 months, and are then deleted. See the retention section of our Privacy Policy for why.
  • A record that the deletion took place, with the account's email address, the IP address and device it was requested from and the reason if you gave one, is kept for 30 days, then removed.
Deletion is permanent and cannot be undone. If you want a copy of your data, export it before you delete the account. Wallets kept only on your phone are not on our servers, so deleting the account does not remove them; delete them in the app.

If you are not satisfied

Please contact us first: most issues are resolved quickly. If you are still not satisfied, you have the right to lodge a complaint with a supervisory authority.

Our lead authority is the Polish Urząd Ochrony Danych Osobowych (UODO), ul. Stawki 2, 00-193 Warsaw, Poland. Website: uodo.gov.pl. If you live elsewhere in the EU or EEA, you may also complain to the authority in your own country.