OverPocket Privacy Policy

Effective Date: November 7, 2026

Overpocket Inventory operates OverPocket ("OverPocket," "we," "us," or "our"). This Privacy Policy explains how we collect, use, share, store, and protect personal information when you use the OverPocket mobile application, website, and related services.

1. Information We Collect

Account Information

When you create an account, we process your email address, account identifiers, authentication information, preferences, and settings. Amazon Cognito manages authentication. OverPocket does not store your plaintext password.

If you choose Google sign-in, Google and Cognito process the information needed to authenticate you, including your email address and provider identifiers. Google sign-in is optional.

Inventory Information

We process the inventory information you provide, including:

• Item names, descriptions, categories, and quantities.
• User-defined storage locations, rooms, floors, shelves, and containers.
• Item photographs.
• Inventory changes and associated timestamps.
• Household membership, invitations, and access permissions.

Photographs may incidentally contain faces, addresses, documents, or other personal information. Avoid including information that is not needed for your inventory.

AI Processing Information

When you request AI features, we send the selected photograph or command text to Amazon Bedrock to identify items or interpret inventory actions. Voice commands are sent as transcribed text. You can review proposed results before saving inventory changes.

Voice Information

Voice features use your device's or browser's speech-recognition service with your permission. Audio may be processed by Apple, Google, or another speech provider depending on your device and settings; on-device processing is not guaranteed. Their privacy practices govern that processing.

OverPocket does not upload or retain raw voice audio on its own servers. Transcribed commands are held in the app while you review them and sent to our API and Amazon Bedrock when interpreted. We do not maintain a separate server-side transcript history. Inventory details saved from a command are retained as inventory records.

Subscription Information

RevenueCat and the applicable marketplace provide subscription products, purchase and renewal dates, transaction identifiers, and entitlement status. RevenueCat uses your OverPocket account identifier to associate access with your account and may process device and app information needed to manage purchases. Apple or the payment provider handles payment details; OverPocket does not receive complete payment-card numbers from App Store purchases.

Technical Information

Our infrastructure and service providers process technical information needed to operate and secure the Service, such as network/IP information, request timestamps, application or device information, errors, and service logs. We do not use separate advertising, behavioral analytics, or crash-reporting services. Necessary operational logging and provider diagnostics are not advertising tracking.

2. How We Use Information

We use information to:

• Create and manage accounts.
• Store, retrieve, and organize inventory.
• Provide requested AI and voice-command features.
• Synchronize inventory across devices and support offline access.
• Enable authorized household sharing.
• Manage subscriptions and premium access.
• Send account, invitation, security, and service emails.
• Diagnose errors, prevent abuse, and protect the Service.
• Respond to privacy requests and comply with law.

We do not sell your personal information or share it for targeted advertising or cross-context behavioral advertising.

3. How Household Sharing Works

Authorized members of a shared household can see its inventory, locations, and photographs. Members can manage inventory while the household owner's Pro access is active. Owners manage invitations and membership.

We do not make a household's inventory available to unrelated households as part of normal operation. Joining a household replaces your previous inventory after explicit confirmation, rather than merging it.

Removing a member blocks future authorized API access but does not erase previously downloaded information or offline copies on their devices. A previously issued photo link can remain valid for up to five minutes.

4. Service Providers

We use these providers to operate OverPocket:

• Amazon Web Services: Cognito authentication, Lambda and API Gateway processing, DynamoDB records and backups, private S3 photo storage, CloudWatch operational logs, and Bedrock AI processing.
• RevenueCat: Purchase validation, subscription management, entitlement tracking, and paywalls.
• Resend: Account and household-invitation email delivery.
• Apple: App distribution, in-app billing, and speech recognition on supported devices.
• Google: Optional Google sign-in and speech recognition where supported by your device or browser.

Providers process information under their applicable agreements and privacy practices. We may disclose information when required by law, to protect the Service or others, or as part of a business transaction subject to appropriate safeguards.

5. AI and Data Processing

OverPocket currently uses Amazon Nova 2 Lite through Amazon Bedrock. Photos and command text are processed to generate proposed inventory information. AI results can be inaccurate and should be reviewed before saving.

We do not use your private inventory photographs or descriptions to train our own general-purpose AI models. Our configured Bedrock invocation logging does not store prompt or response content. Our application does not intentionally log photographs, command text, or generated item content.

AWS processes AI requests under its service terms and may use automated safety checks. In limited cases, such as suspected illegal image content, AWS may retain or review flagged inputs or outputs and make disclosures required by law. We do not promise that all provider-side AI processing has zero retention.

6. Data Storage and Security

Account data, inventory records, item photographs, application logs, and DynamoDB point-in-time backups are hosted in AWS US East (Ohio), us-east-2. Our Bedrock endpoint is in Ohio, but the configured US inference profile can route AI processing to other AWS Regions within the United States. Other providers may process information where they operate.

We use authenticated API access, membership checks, encrypted connections, and provider-managed storage encryption. Item photos are private S3 objects; authorized users obtain short-lived download links through our API.

The app also stores inventory and cached photos locally for offline use. Signing out hides an account's local cache; it does not erase that cache or queued changes. Protect your device and browser storage, especially on shared devices. No method of storage or transmission is completely secure.

7. Data Retention

• Accounts and inventory: We retain active account information and inventory while needed to provide the Service. Verified account-deletion requests are completed within 30 days, except information we must retain for legal obligations, disputes, or fraud prevention.
• Deleted items: Items disappear from the active inventory after deletion syncs. Sync tombstones and mutation records may remain for the life of the inventory to prevent deleted data from returning or changes from being applied twice.
• Photos: Attached photos remain until removed, replaced, or deleted with the associated inventory. Obsolete photos are deleted by an asynchronous cleanup worker. Unused uploads expire after 24 hours; physical cleanup follows DynamoDB's asynchronous expiration and retry processing and may occur later.
• Backups: DynamoDB point-in-time recovery retains historical records for up to 35 days, including data removed from active records. Deletion does not immediately erase those recovery copies.
• Application logs: Our CloudWatch Lambda log groups have a 30-day retention setting. AWS expires old log events asynchronously.
• AI inputs and outputs: They are processed to answer your request, not kept as a separate application content history. Saved results become inventory records. Provider safety retention is described in Section 5.
• Local copies and provider records: Unsynced changes and downloaded copies can remain on devices until their local storage is removed. Service providers retain authentication, email, billing, and security records according to their policies and legal obligations. We cannot erase copies independently retained by other household members.

Shared inventory may remain with a continuing household when a member deletes their account. A household owner should contact support to review the effect of deletion on shared records and other members before proceeding.

8. Your Choices and Rights

Depending on your location and applicable law, you may have rights to access or correct personal information, request deletion or a copy, object to or restrict processing, and appeal a privacy-request decision.

You can edit inventory directly in OverPocket. Contact info@stow.house for account or privacy requests, including a copy of your data. We may verify your identity before acting. We will not discriminate against you for exercising applicable privacy rights.

Photo and microphone access are optional and can be managed in device or browser settings. You can use manual inventory and text search without those permissions.

9. Account Deletion

Email info@stow.house from your account's email address to request deletion. We will verify your identity and complete the request within 30 days, subject to applicable legal retention requirements and the backup limits described above. Account deletion is currently handled by support; there is no in-app deletion button.

If you own a shared household, identify it in your request so support can review what will happen to shared data and member access. Request a copy of information you want to keep before deletion.

Deleting an account does not cancel App Store subscriptions. Manage or cancel them through your Apple account's subscription settings.

10. Location Information

OverPocket uses storage locations you enter, such as "Garage," "Basement," or "Bin B1." We do not request your device's GPS or precise location. Location names and details you enter may still reveal personal information, so choose what you share with care.

11. Children's Privacy

OverPocket accounts are intended for people at least 18 years old or the age of legal majority in their jurisdiction. The Service is not directed to children under 13, and we do not knowingly collect personal information directly from children under 13 through independently registered accounts.

If we learn of information collected in violation of applicable law, we will take steps to delete it. Parents and guardians should consider what they include in shared household inventories.

12. International Processing

OverPocket and its providers may process information in the United States or other locations where they operate. Where required by law, we use appropriate safeguards for international transfers.

13. Changes to This Policy

We may update this policy as the Service, our practices, or legal requirements change. We will update the effective date and provide additional notice when required by law.

14. Contact Us

Overpocket Inventory

Website: https://app.stow.house

Email: info@stow.house