Privacy & Security at Pocket Anchor

Direct answers to the questions reviewers and users ask most. Details follow below.

• Data minimization. We only collect information needed for the feature you are using.
• No unnecessary authentication. Selected crisis and safety resources stay accessible without registration, because an account is not needed to read them.
• Privacy by context. Health, crisis, safety and survivor-oriented features get stronger privacy handling than ordinary consumer features.
• Transparency. We explain what is collected, why, who processes it where applicable, and how long it is kept.
• Security by design. We protect sensitive information with the controls actually implemented today — described plainly on this page.
• Honest limitations. We never describe Pocket Anchor as anonymous, untraceable, or risk-free, because those claims cannot be guaranteed.

We collect only what a feature needs. This table maps each category to its purpose, whether an account is required, and your controls.

• • We do not access your device GPS or track your location.
• • We do not read GPS/EXIF metadata from photos you upload; only city/country you type is used.
• • We do not sell your data, and we do not use your health information for advertising.
• • We do not require an account to read selected crisis and safety resources.

For anything not listed here, we do not currently make a blanket public claim that the information is never processed — we would rather be accurate than overclaim.

Selected crisis and safety resources — for example hotline directories and the Survivor Navigator — are intentionally accessible without creating an account. For those static resources, no account is required, no account content is created, and no AI processing runs to display them.

Analytics (Google Analytics 4 and PostHog) and standard web/server technical processing (including IP addresses handled by hosting/CDN) still apply to ordinary page loads, as with most websites. “No trace” refers to Pocket Anchor not requiring an identity or creating an account record for these resources — it does not mean the internet cannot record that you visited.

Important: Pocket Anchor cannot control records created by your browser, device, network provider, employer, school, managed device, or other third parties.

Some features necessarily require an account so your content is saved to you and protected from others. These include the Medical Vault, Journal, Guardians, Memory Vault, Déjà, and private Anchor messaging controls. For each, only the information you enter is processed and stored, access is limited to you (and only what you explicitly share), and you can delete items at any time.

You can store health-card details, medications, allergies, emergency information and medical documents in the Medical Vault. This exists only to give you your information when you need it. Everything is optional.

Health data is encrypted in transit (HTTPS/TLS) and at rest by our infrastructure. It is visible to you; supporters and guardians never see it. It is not used for advertising, and storing a record does not send it to AI providers. Only if you actively use an AI feature (such as translation) is the text you submit sent for processing. You can delete any item at any time.

Pocket Anchor is designed with privacy and sensitive-data protection in mind. Applicable legal obligations depend on your location, the service provided, the data involved, and Pocket Anchor’s actual processing activities. We do not claim HIPAA, GDPR or PIPEDA compliance on this page.

• In transit: HTTPS/TLS across the site and API.
• At rest: provided by the underlying managed database and storage infrastructure. This has not been independently verified or certified.
• Application-level / end-to-end: Pocket Anchor does not currently claim end-to-end or client-side (zero-knowledge) encryption. This is on the roadmap and this page will be updated the day it ships.
• Authentication: sign-in is handled through Google OAuth; Pocket Anchor does not store passwords. Sessions use a server-side session record and an HttpOnly, Secure cookie that expires after 7 days.
• File storage: uploaded documents and photos are stored via managed object storage and served over HTTPS.

Pocket Anchor is AI-native. AI is used for message moderation, comfort chat and the resource navigator, translation, voice-note transcription, and Déjà matching. AI requests run on our servers and are sent to the providers below via a managed proxy — they are not processed only on your device.

Please do not submit highly sensitive information to an AI feature unless Pocket Anchor explicitly states the feature is designed to process it.

These are the meaningful external services Pocket Anchor actually depends on.

Links open each provider’s own privacy policy.

Pocket Anchor uses an essential authentication cookie (session_token, HttpOnly/Secure) to keep you signed in. Analytics are provided by Google Analytics 4 and PostHog. We do not run marketing/advertising trackers. We do not describe Google Analytics as anonymous — it is standard aggregate web analytics. A formal cookie-consent manager is not yet implemented; you can use browser and extension controls to limit analytics.

Pocket Anchor does not access device location, does not track you, and does not continuously monitor location. Location appears only where you manually type a city/country. Manually entered location is stored with the item you attach it to and is shown only to people allowed to see that item. It is not sent to third parties.

Where a formal window is not yet defined, we say “being documented” rather than invent a number.

You can delete individual items — journal entries, memories, Déjà dreams, evidence, vault items, guardians, trusted contacts and Anchor messages — at any time from your dashboard. Déjà data can be exported as JSON and deleted all at once. Deleting an item removes it from the active database immediately.

Full-account self-service deletion is not yet a one-click feature: to delete your whole account, contact the team from your account email and we remove everything. Backup propagation timing is still being documented. Some records may be retained where required for security or legal reasons.

You can access your data. Supporters see only what you share through your Anchor Link. Guardians see only your mood “weather” — never your words. As a matter of policy and design, the Pocket Anchor team does not read user content. However, because data is not end-to-end encrypted, infrastructure administrators technically could access stored data to operate and maintain the service. We are transparent about this rather than claiming administrators cannot access data.

Pocket Anchor operates from Canada. Data is stored with managed cloud infrastructure and may be processed across borders by the third parties listed above. We evaluate legal requests according to applicable law; we do not promise to refuse all lawful requests. Minimizing what we retain limits what could ever be disclosed. The specific hosting region is not currently publicly disclosed.

We monitor the service and respond to issues as they arise. Where a security incident legally requires user or regulator notification, we will follow applicable law. A formal, published incident-response process is currently being developed; we do not claim certifications or processes that do not yet exist.

Pocket Anchor has not yet completed an independent third-party security audit. This means no independent audit claim is being made, and the statements on this page are based on the current implementation and documentation rather than external certification.

Pocket Anchor is currently closed-source. PrivacyTools.io generally prefers open-source software and services; we are being transparent about our current source-availability status and do not represent Pocket Anchor as open-source.

• Everyday privacy: reducing unnecessary tracking, profiling and data collection.
• Sensitive situations: protecting people seeking health, crisis and safety resources.
• Targeted personal threats: acknowledging users may face abusers, stalkers, controlling partners, hostile employers or unsafe family situations.

Pocket Anchor should not be treated as a guarantee against a determined adversary who has access to your device, browser, network, accounts or physical environment.

Quick Exit can reduce visible exposure inside the app, but it cannot erase your browser history, cannot erase network or ISP logs, cannot control screenshots, and cannot stop someone with access to your device from inspecting it. It cannot guarantee anonymity, and it cannot guarantee that another person will not discover that you used the service.

If you are in immediate danger, contact your local emergency services. Consider using a private browsing window or a device only you can access, and review our guidance on documenting safely.

If you believe you have found a security or privacy vulnerability, please report it privately to security@pocketanchor.tech (a dedicated security mailbox is being set up; until then this reaches the team).

• • Include: what you found, where, and clear steps to reproduce.
• • Please practise responsible disclosure and give us reasonable time to fix the issue before publishing.
• • Do not send real medical records, other people’s data, or sensitive personal information as part of a report.
• • This channel is not for emergencies — if you are in crisis, use our safety resources or local emergency services.

Related: Privacy Policy (plain-words privacy notice) · Safety resources · Resource hub

• Pocket Anchor is not currently open-source.
• No independent third-party security or privacy audit has been completed.
• Some features (Medical Vault, Journal, Guardians, Memory Vault, private Anchor messaging) require an account.
• Certain third-party services (hosting, database, AI, analytics, payments, email) necessarily process some data.
• AI features involve external processing by Anthropic and OpenAI via a proxy; provider retention/training behaviour is not currently documented here.
• End-to-end / client-side encryption is not yet implemented.
• Records created by your browser, device, network provider, employer, school, managed device, or other parties are outside Pocket Anchor’s control.

This page is designed to make the relevant evidence transparent for independent review. It does not claim endorsement or that Pocket Anchor “meets” any external criteria.