How Pocketly uses your information

The offer pages, the Direct Debit guide and the quick check work without an account. The quick check’s answers are used to work out your result and are not saved on our servers. So that you don’t have to type them again if you go on to build a plan, they are kept in a cookie on your own device for 7 days, and removed once used.

To keep the service secure and stop abuse, our hosting provider processes your IP address when you visit. Pocketly keeps a scrambled (keyed hash) form of it for up to 24 hours to limit repeated requests. It can’t be turned back into your address. Our lawful basis is our legitimate interest in keeping the service safe and available.

• Your email address, to sign you in.
• What you tell us about your situation: which bank you’re with, how many Direct Debits you have, your spare cash and safety buffer, and your yes/no answers about your history with banks and what you can do with a new account. If you add them: your pay day, up to three regular bills (what each is, how much, and its day), and the days your Direct Debits leave (with who they’re to, if you keep them from a statement).
• Your plans and what you record as you follow them (dates you opened accounts, switches completed, payments made and received), and every decision Pocketly gave you, so you can see it again exactly as it was.
• Passkeys, if you add one: only the public key. Your device keeps the private part.
• Notifications, if you turn them on: the address your browser gives us for sending reminders to that device.
• Bank emails you forward to your private Pocketly address: the sender, subject, date and text, and any PDF or picture attached (photo details removed). They’re encrypted and only you can read them. Emails you don’t file on a switch are deleted after 30 days; filed ones stay with that switch until you delete them or your account. A bank’s email may show things Pocketly never asks for, such as an account number. If you set your email service to forward automatically, the confirmation it sends to your Pocketly address is kept the same way, so you can read its code.
• A calendar link, if you subscribe to your plan in a calendar app: a private address that shows your plan’s steps to whoever has it. You can replace it on Now at any time, and the old one stops working.
• An email address for reminders, if you add one: the address, whether you’ve confirmed it, and which emails you want (reminders, a Monday summary).
• What you tell us a bank said, and any note you add, as part of your record.
• Your answer to “Was this right?”, if you give one after a decision or a switch: yes, partly or no, and any note. The owner reads these without your name or email, to find mistakes in how offers are checked.
• Banks you’ve been with, if you tell Pocketly: which banks you've had current accounts with, roughly when they opened and closed, and when a bank paid you a switching reward. It answers offers' history questions, and you can change or delete it at any time.
• The other person in a plan for two, if you add them with their agreement: which banks their own current accounts are with, how many Direct Debits each has, their spare cash (or that you share yours), and their answers to their offers’ questions. Used only to plan their switches around yours (or yours around theirs, if you choose), and, if you start tracking their switches, those switches and what you record on them, which you see on your Now and are reminded about. You confirm they agree, and Pocketly keeps the date. Removing them from the plan for two erases all of it, their tracked switches included.
• A statement you choose to read, if you use “Read it from a statement”: the file is read in memory and thrown away at once, never stored. Only what you tick afterwards is kept, as part of your situation: how many Direct Debits, and Yes to offers’ conditions you already meet (a salary of at least an amount, a number of card payments). No payee, amount or single payment is kept.
• A switching tracker you import, if you use “Import it” on Banks you’ve been with: the file (or what you paste) is read in memory and not stored. Between reading it and adding it, it travels inside the page itself, sealed so only Pocketly can read it, for at most two hours. Only the rows you add are kept, as part of your banking history: the bank, when each account opened and closed, and when a reward was paid. Amounts and any other columns are not kept.
• A statement checked against a switch, if you use “Check a statement” on a switch: the file is read in memory and thrown away at once, never stored. For each payment you choose to record (or, if you turn on “Record exact matches for me”, each exact match), its date, amount and the bank’s description of it are kept on that switch’s record as proof, with a reference that can’t be turned back into the line. No other payment from the file is kept. Automatic records can be undone for 30 days.
• How banks pay, counted: from every switch tracked with Pocketly, how often each bank paid on time and how long it took, worked out without who. A bank’s figure appears on its offer page only once at least 10 switches with it are paid or overdue, so no one can be picked out.
• The other person’s banks, if you have a joint account and tell Pocketly: the same about the other person on it, which you give with their agreement. It’s used only for your plan (offers that take a joint account look at both of you), never to contact them, and you can change or remove it at any time.
• A balance and circumstances, if you give them: the least you expect in an account on its switch day, and whether you use an overdraft or are borrowing soon, so Pocketly can say when it’s better to wait.
• Documents you choose to add to a switch: screenshots or PDFs, such as a bank’s email or a payment. We encrypt each one before storing it and only you can open it. Photo details (such as where a picture was taken) are removed from pictures; a PDF is kept as it is. A document may show things Pocketly never asks for, such as an account number: cover anything you don’t need before adding it.

We use this to provide the service you asked for: checking offers against your situation, building and tracking your plan, and preparing an evidence pack if a bank doesn’t pay. Our lawful basis is that this is necessary to provide the service to you. Reminders are sent only if you turn them on (your consent), and you can turn them off at any time: on the device, in Your data, or with the link at the end of every email.

We never ask for bank logins, card numbers, sort codes or account numbers, and Pocketly doesn’t connect to your bank.

• Sign-in links expire after 15 minutes.
• Rate-limit records (a scrambled form of your IP address): up to 24 hours.
• The quick check’s answers, in a cookie on your device if you ask to carry them into a plan: 7 days.
• Sign-in sessions end after 30 days without use.
• A forwarded bank email you haven’t filed on a switch: 30 days.
• A copy of each email Pocketly sends you, without its links: 90 days.
• Account information and documents you add: until you remove them or delete your account. “Delete my account” on Your data erases everything straight away; “Start again” clears just your situation and answers.
• Our hosting provider’s request logs are kept for a short period under its own retention settings.

Records of your switches are never silently changed: a correction is added alongside the original, so your evidence stays trustworthy if a bank disputes a payment. Deleting your account removes them too.

If you create your account with a passkey, Pocketly holds no email address for you: your device’s passkey is how you sign in.

• Vercel Inc. hosts the website. Pocketly’s server code is set to run in London.
• Neon hosts the database, stored in London on Amazon Web Services.
• If you turn on notifications, reminders go through your browser maker’s push service (for example Google, Mozilla or Apple), encrypted so that only your device can read them.
• Resend also receives the emails you forward to your Pocketly address, and keeps its own copy under its retention settings.
• Resend sends Pocketly’s emails (sign-in links, and reminders if you ask for them): it handles your address and what each email says, and tells Pocketly whether each one was delivered, refused or marked as spam. If an address refuses an email, Pocketly pauses emails to it until you check it; if you mark one as spam, Pocketly stops emailing you.

These providers process information only to run the service for us. Where a provider is based outside the UK, the transfer is covered by the safeguards UK data protection law requires.

You can ask to see, correct or delete your information, ask us to restrict or stop using it, and take a copy with you. Signed in, Your data shows what Pocketly holds, lets you download all of it and lets you delete your account. For anything else, contact dawidchachulski@hotmail.com: we’ll answer within one month.

If you’re unhappy with how we’ve handled your information, you can complain to the Information Commissioner’s Office: ico.org.uk, or 0303 123 1113.

Pocketly only uses cookies the site needs to work, so it doesn’t ask for consent. It uses no analytics, advertising or tracking cookies.

To know whether its public pages help anyone, Pocketly counts how many times each one is read, and how many quick checks are run, each day: a number per page per day and nothing else, with no cookie, no address and nothing about who. Counts are kept 400 days.

On the live site the first two are named __Host-pk_s and __Host-pk_a, a browser rule that locks them to this site. The theme is also kept in your browser’s own storage, which is never sent to us.

On your device, when you’re signed in: a copy of your last Now page, so it opens when you’re offline, marked with the time it was saved. It stays in your browser only, and is deleted when you sign out, start again or delete your account. Your browser also remembers, for the length of a visit, which pages and charts you’ve already seen, so they don’t animate twice.