Privacy policy

Who is responsible

Pouso is developed and provided by Carlos Antonio Pereira Jorge Filho. This policy covers the Pouso apps for Mac, iPhone and Windows and pouso.app. Contact carlos@pouso.app for privacy questions and requests.

Your library and devices

Files, images, text, links and shelves are kept locally. When you enable the shared library, its state is shared automatically through Google Drive with devices connected to the same library. This includes names and copies of selected files, note and link contents, shelves, organization, tags, available extracted text, and library, item and device identifiers generated by Pouso. Photos, videos and audio you import may also be uploaded to your Drive. Preferences, selection, sharing history and recovery copies remain local. Shared license recognition uses the service described below. Previews and text recognition run locally; private paths, bookmarks and credentials are excluded from shared state.

Your personal Google Drive and permissions

To sync, you connect your own Google Drive and configure the shared library. You need a valid Google account, internet access and space in Drive and on your devices. Pouso does not provide a Google account or cloud storage. The app uses the files, folders and metadata permitted during Google consent to store and retrieve library state and file copies. Library content does not pass through the Pouso licensing server. Permissions may vary between versions and platforms; local capture and organization can be used without Drive.

Sign-in and shared licenses

Google sign-in provides account identity information, including an account identifier and verified email. The licensing service uses this information and an internal identifier to recognize the account across devices. To link or check an Apple purchase, it receives a signed proof and checks the transaction with Apple. It stores the test or production environment, app and product, transaction identifiers, linked account, revocation status and verification dates. The complete signed proof is not stored in its database. The licensing flow does not receive your library files. In the beta, the integration is being tested; a Sandbox license is not a production purchase.

Google authentication SDK in Apple apps

The Mac and iPhone apps include Google Sign-In. The privacy manifest supplied by the SDK declares name, email, phone number, coarse location, user and device identifiers, other usage data and other data types. Declared purposes include authentication, app functionality and analytics, depending on the data type. This does not mean Pouso asks for your phone number or GPS access: Google states that an IP address may estimate a general location for fraud prevention. These SDK practices are included in the store privacy disclosure. The manifest declares no cross-app advertising tracking.

Sessions and credentials

Sign-in uses Google and Apple mechanisms; we do not request their account passwords. Authorization credentials are managed through the app and platform authentication mechanisms. On Apple apps, the Google SDK can restore sign-in and a local marker identifies the account to restore. Pouso issues short-lived sessions and stores only a cryptographic digest of the token, email, account, environment and expiration in the service database. Licensing sessions last 15 minutes. In production, an hourly task removes expired records; older copies may remain in backups. Signing out ends the session without deleting the account or purchase link.

Public links and Drive files

When you confirm a public link, Pouso publishes copies of the selected content in a delivery folder in Drive and grants public read access only to that folder. The library folder, its snapshot and sync files remain private. Anyone with the link can access it while the permission is active. Revoking access does not delete copies already downloaded. Disconnecting Drive or revoking Google authorization does not automatically delete remote files or existing public link permissions. You can manage files and permissions in Google Drive.

Website, waiting list and support

If you join the waiting list, we store email, language, selected systems, beta interest, and signup and update dates. An approximate country may also be received when provided by the infrastructure. We use these details to confirm signup, arrange invitations and send Pouso news. Waiting-list emails use Resend, which receives the recipient and content needed for delivery. Contact support to leave the list. Support messages include the information and attachments you choose to send. Do not send passwords, codes, tokens or identity documents as a standard procedure.

Website statistics and technical records

The homepage uses Umami, hosted in a service managed by the developer, for visit, navigation and event statistics, such as downloads and signups. Our form events include language, selected systems and beta interest, without sending the email to Umami. Your browser stores the language preference locally. Infrastructure receives connection information needed to deliver the site and APIs, such as IP addresses and request information. Error records may contain technical data. Licensing application logs record statuses, request identifiers and error categories, without deliberately including tokens, email or purchase proofs. Third-party services and test distribution such as TestFlight also have their own diagnostics and policies.

Providers and data use

Google provides sign-in and Drive; Apple handles App Store purchases and validation; Oracle Cloud hosts Pouso infrastructure; Resend delivers waiting-list emails. The site uses Cloudflare for domain services and, when configured, traffic delivery and protection. The support mailbox provider processes received messages. Providers may process data in other countries according to their policies and service configuration. Data is used for requested features, chosen communications, security and support. Pouso does not use data obtained from Google APIs for personalized advertising, sale to third parties or AI model training. Use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including Limited Use requirements.

Storage, retention and backups

You manage local content and Drive files. Accounts and purchase links are retained as needed to recognize licenses and prevent improper claims, with review upon deletion requests. Waiting-list records support chosen communications; support handles cancellation requests. Support messages are kept to handle and follow up on requests. There is no single automatic deletion deadline for these categories. Technical logs have operational rotation and limits, which do not guarantee deletion within a fixed number of days. The production licensing database has encrypted backups and a copy outside the VPS. Managed encrypted licensing backups may retain earlier data for up to 30 days, with removal on the next scheduled run; the SSD copy depends on destination and connection availability. Copies preceding deletion are ineligible to reactivate deleted accounts. Fraud prevention retains the cryptographic transaction digest after deletion, without account identity; if a trial was used, it also retains the minimal pseudonymized marker described in the trial section. Portable library backups exported by you are not encrypted by Pouso: keep them protected. Device backups made by the system or by you have their own configuration.

Your choices and requests

You can disconnect Drive in the app, revoke Pouso access in your Google Account, manage Drive files and links, and sign out of licensing. Starting with build 30 for Mac and iPhone, the Pouso Pro screen offers “Delete license account”, with confirmation. This removes the service account, its sessions and purchase links. It preserves your library, files, configuration, Google Drive and local Apple purchase; it does not request a refund or delete your Google Account. Shared Pro stops being renewed; an offline proof already issued may remain valid until it expires, recognizing deletion when reconnecting. The deleted link cannot be reused to share the same purchase. We retain a cryptographic transaction digest, without email, Google identity or account UUID, to prevent its transfer. If a trial was used, its minimal pseudonymized used marker also remains as described in the trial section. For earlier versions, access, correction, other requests or waiting-list cancellation, email carlos@pouso.app. We will verify your identity appropriately. Signing out does not delete the account. Data held by Apple or Google must be managed through their services.

Policy changes

Updates will be available on this page with their date. Changes to data purposes or permissions will be explained in the appropriate context. This version was updated on October 15, 2026.

Provider policies

Google · Apple · Oracle · Resend · Cloudflare

Google API Services User Data Policy · Google Workspace user data policy

Shared-library retention

In the sync profile, item removal and renaming propagate to other devices. This does not automatically delete file blobs already stored in Drive. Replaced local versions may be preserved for at least 30 days; dismissing a notice only hides it and can be reversed.

Offline license and installation identity

When offline licensing is available, the server may issue a signed proof valid for up to 30 days for Pro, or only until the original end of the 14-day trial. It contains internal account and installation identifiers, environment, tier, revision and dates; it contains no email, Apple receipt or library content. The random installation identifier belongs to licensing, uses no hardware serial number, and is linked to the account with platform, revision and enabled status until account deletion. The device keeps the proof and time references in protected storage to check validity without a network. Signing out removes its local use. Revocation or deletion reaches an offline device when it reconnects or the proof expires; revocation is not immediate without a network. The technical proof duration does not turn a one-time purchase into a subscription.

Free account trial

When the free trial is available and you choose to start it, the server verifies your Google identity and Apple proof for the free product. The active account stores the start and end of the 14-day window, environment, app, transaction identifiers and revocation status, but not the complete signed proof. Deleting the account removes these details. To prevent a second trial, only a pseudonymized cryptographic marker of the Google identity, separated by environment, and its key version remain. This marker has no name, email, internal account identifier, device, library or dates. It is not anonymous and is used exclusively to record trial use, only as long as necessary for one-time eligibility, with review of purpose and necessity. Backups preceding activation or deletion cannot restart a trial. Activation is explicit with no automatic charge; availability is shown in the app.