Privacy Policy — PocketHSA

What this is

PocketHSA is an HSA receipt management app. We help you capture, organize, and store documentation for medical expenses so you can reimburse yourself from your HSA — this year or years from now.

What we collect

Account information: your email address and password (hashed — we never see it).
Receipt metadata: merchant name, amount, date, category, notes, and any other fields you enter.
Receipt files: the images or PDFs you upload. Stored in our secure cloud by default, or in your own Google Drive if you connect it.
Usage data: standard server logs (timestamps, request paths). No behavioral tracking or ad pixels.
Payment information: handled entirely by Stripe. We never see or store your card details.

How we use it

To provide the service — storing, organizing, and displaying your receipts.
To run AI extraction — your receipt file is sent to Anthropic’s Claude API to extract the merchant, amount, date, and category. Anthropic’s privacy policy applies to that processing.
To process payments via Stripe.
To send transactional emails (account confirmation, password reset). No marketing emails without your explicit opt-in.

Third-party services

Supabase — authentication and database. Your data is stored in Supabase’s US infrastructure.
Anthropic (Claude) — AI extraction of receipt fields. Files are sent for processing and not retained for training.
Stripe — payment processing for Pro subscriptions.
Google Drive (optional) — if you connect your Drive, receipt files are stored directly in your Google account. We request only the drive.file scope, meaning we can only access files PocketHSA itself created.
Cloudflare — hosting and infrastructure.

Your data, your control

You can export all your receipts as a PDF at any time (Pro plan).
You can delete individual receipts or your entire account.
If you’ve connected Google Drive, your files are already in your account — disconnecting PocketHSA doesn’t delete them.
We do not sell your data. Ever.

Data retention

We keep your data for as long as your account is active. If you delete your account, your data is removed from our systems within 30 days. Receipt files stored in your Google Drive are not affected.

Security

All data is encrypted in transit (TLS) and at rest. Receipt files are stored in private buckets with signed URLs — not publicly accessible. We follow security best practices and access controls are enforced at the database level.

Contact

Questions about this policy? Email us at privacy@pockethsa.com.