Privacy Policy

1. Who is responsible for your data

Pocket ("Pocket", "we") is responsible for the personal data described here. Pocket is operated by its founding team while a legal entity is being incorporated. Until then, its founders are the controllers of your data. Once the entity exists, it will be the controller, and we will publish here its legal name, registered address and the contact of its data protection officer. You can reach us about privacy at pocket.stellar.xyz@gmail.com.

This Policy applies to everyone who uses Pocket, in any country. Where the law of your country gives you more rights than this Policy, you have them.

2. What we collect

What you give us

• Account: your Stellar wallet address and your role, startup or specialist. If you sign in through Pollar, also your email and how you signed in, for example Google, and your Pollar user identifier.
• Account details: your full name, contact email and country, and optionally your LinkedIn, your website and a note. Startups also give their company name and, optionally, its registration number.
• Specialist profile: name, headline, bio, categories, skills, tools, years of experience, languages, time zone, weekly availability, hourly rate, smallest project, location, past work with its links and results, and links to your portfolio, LinkedIn and CV, or the CV you upload as a PDF.
• Startup profile: company name, legal name, one-line description, description, sector, stage, what it is looking for, website, logo, languages, location and the role of its contact person.
• Marketplace activity: the jobs you post with the KPIs they are measured on, your applications, offers, contracts, milestones, deliveries with their links, files and reported results, feedback, disputes, evidence and comments.

What we collect automatically

• Security data: when a request is refused (not signed in, not allowed, or too many requests) and on security events such as sign-ins, sign-outs, account deletion and data exports, we log your IP address, the request method and path, your user identifier and the time. To limit abuse we count requests per IP address or account, in memory, for about a minute.
• Error reports: when something fails, technical details of the failure, such as the page or request, your user identifier, your IP address and your browser, are sent to Sentry so we can fix it.
• Consent records: which version of our Terms and of this Policy you accepted, when, and from which IP address.
• Records we create: the history of the blockchain transactions made through Pocket for your account, what each payment paid to whom as the blockchain recorded it, and the results report of each contract, built from its deliveries and payments.
• On your device: your session token and, if you use a browser wallet, its address and name, stored in your browser's local storage. They are strictly necessary for the Service to work. We use no cookies for advertising, no tracking and no analytics. Pollar and wallet extensions may store their own data under their own policies.

We do not ask for sensitive data, such as health, ethnic origin, religion, political views, union membership or sexual life, and we ask you not to include it anywhere in Pocket (see section 4).

3. Why we use it, and on what basis

We do not use your data for marketing, advertising or profiling, and we do not sell it. Fields marked optional can be left blank at no cost to you. Without the required data we cannot create or activate your account, or let you hire or be hired.

Consent, and how to withdraw it

When you create your account we ask, separately from the Terms, for your consent to process your data as this Policy describes, including publishing your profile and CV once your account is active, and transferring your data abroad (section 6). You can withdraw it at any time by deleting your CV or your profile, by deleting your account from your account page, or by writing to pocket.stellar.xyz@gmail.com. Withdrawing does not affect what was done before. If the consent was needed for a feature, we will have to stop that feature for you.

Automated decisions

Your account is activated automatically when you complete its details. Decisions that weigh what happened, such as resolving a dispute, are made by people. Two decisions against you are made automatically: we refuse a hire between two accounts with the same contact email, to prevent self-dealing; and we temporarily block requests that exceed our rate limits. If you think either affected you wrongly, write to pocket.stellar.xyz@gmail.com and a person will review it.

4. Public profiles and sensitive data

Once your account is active, your profile, including any CV you upload, is public: anyone can see it, and download the CV, without an account. We ask search engines not to index specialist profiles and CVs, but copies made by others are outside our control. Profiles show a shortened wallet address, not the full one.

Do not include sensitive data in your profile or CV: photos, date of birth, identity document numbers, home address, health, ethnic origin, religion, political views, union membership, sexual life or financial details. If we find it, we may ask you to remove it or remove it ourselves. You can replace or delete your CV at any time.

5. Who can see your data

• Anyone: the public profiles of active accounts, the CVs they upload, and the jobs startups publish, with the KPIs they are measured on.
• The other party of a contract: your application, your deliveries, their results and your comments, the contract's results report, and, once the specialist accepts the terms, your contact email.
• Pocket managers, on a need-to-know basis: account details, results reports, and everything in a dispute.
• Service providers that process data on our instructions: Supabase (database, United States), Railway (API hosting and its logs), Vercel (website hosting), Sentry (error reports, United States), Resend (sends notification emails to your contact email, United States) and Trustless Work (builds the escrow transactions, with wallet addresses, amounts and milestones). Our private security alerts, sent to a Discord channel, contain only technical data about Pocket's own account, never your name, email or wallet.
• Independent parties with their own privacy policies: Pollar, which creates and holds wallets for email and Google sign-ins and knows your email; Google, if you sign in with it; the Stellar network, which is public; and Circle, which issues USDC.
• Authorities, when the law requires it, or to protect the rights and safety of users or of Pocket.

6. International transfers

Your data is stored in the United States (Supabase, us-west-2) and processed by the providers listed above, in the United States and elsewhere. We transfer it because it is necessary to perform our contract with you and with your consent, and we will put in place with our providers the safeguards the law of your country requires, such as standard contractual clauses. You can ask us for a copy of those safeguards at pocket.stellar.xyz@gmail.com. Blockchain data is replicated worldwide by the Stellar network, which is not a transfer we control (section 7).

7. What is on the blockchain

Your wallet address is personal data, because Pocket links it to your account. Each escrow is a public smart contract on Stellar that stores the full wallet addresses of the startup and the specialist, the milestone amounts, the status of the escrow and an identifier of the contract. Every deposit, approval, release and dispute resolution is a public transaction. Anyone can read this data, and anyone who knows your address, or sees it next to your name, can link those payments to you.

The Stellar network, not Pocket, keeps this record, and nobody can change or delete it, including us. When you delete your account, we delete what we hold outside the blockchain and the link between your identity and your address, but the record on the blockchain stays. To limit this, you can use a wallet you do not use for anything else. Pollar and Circle can also see your activity on the blockchain, and Circle can freeze USDC at an address under its own terms.

8. How long we keep it

• Profile and CV: until you change or delete them, or delete your account.
• Account details: until you delete your account.
• Contracts, deliveries and their results, payments, disputes, evidence and consent records: while your account is open and afterwards for as long as commercial, tax and limitation periods require, up to 10 years after the contract ends. When you delete your account they stay attached to an anonymous account, because they are also the records of the other party.
• Security logs: up to 30 days, in our hosting provider.
• Error reports: up to 90 days, in Sentry.
• Sign-in challenges: minutes. They are deleted once used or expired.

When a period ends we delete or anonymize the data. Blockchain records are permanent (section 7).

9. Your rights

Depending on where you live, you can: access your data and get a copy; correct it; delete it; object to a use of it, or ask us to limit it; receive it in a portable format; withdraw a consent you gave; ask which providers we share it with; and ask for a person to review an automated decision. In Mexico these are your ARCO rights.

• Yourself, at any time: download all your data, and delete your account, from your account page. Correct your profile from your profile page.
• Anything else: write to pocket.stellar.xyz@gmail.com from the email linked to your account, or prove that you control your wallet by signing a message we send you. Tell us your wallet address, the right you want to use and, for a correction, the correct data. We may ask for proof of identity, and someone acting for you must prove they can.

Using your rights is free. We answer within the shortest period your law sets, and never later than 15 business days. If we must keep some data, we will tell you which data and why. Data on the blockchain cannot be deleted by anyone.

10. How we protect it

Data is encrypted in transit, between your browser and Pocket and between Pocket and its database, and at rest by our database provider. Only the Pocket API and a small number of authorized administrators can access the database. Sessions last up to 12 hours and can be revoked. Session tokens are kept in your browser's local storage, which protects them less than a secure cookie would. No system is perfectly secure. If a breach creates a relevant risk for you, we will notify you and the competent authorities within the time the law requires, explaining what happened, what data was affected and what you can do.

11. Children

Pocket is only for people aged 18 or over, and we do not knowingly collect data from minors. If you believe a minor has given us data, write to pocket.stellar.xyz@gmail.com and we will delete it.

12. Complaints

Please write to us first, so we can try to solve it. You can also complain to the data protection authority of your country, for example: in Brazil, the ANPD; in Mexico, the authority designated under its federal data protection law; in Colombia, the Superintendencia de Industria y Comercio; in Argentina, the Agencia de Acceso a la Información Pública; in Chile, the Agencia de Protección de Datos Personales once it is in operation, and the courts until then; in Peru, the Autoridad Nacional de Protección de Datos Personales; in Costa Rica, PRODHAB; in Ecuador, the Superintendencia de Protección de Datos Personales; in Uruguay, the URCDP; and in Bolivia, the courts, through the constitutional action for the protection of privacy.

13. Users in the European Union, the United Kingdom and elsewhere

If you are in the European Union, the European Economic Area or the United Kingdom, the General Data Protection Regulation, or its United Kingdom version, applies to your data. In particular:

• The legal bases in section 3 are those of the Regulation: performance of a contract, legitimate interests, legal obligations and consent.
• You may object at any time to any use of your data based on our legitimate interests, and we will stop unless we have compelling legitimate grounds, or need it to establish or defend legal claims.
• Transfers of your data outside the European Economic Area or the United Kingdom are made under the European Commission's standard contractual clauses, or the United Kingdom's equivalent, with our providers.
• None of the automated decisions in section 3 produces legal effects on you or significantly affects you in a similar way; you can still ask a person to review them.
• If we offer Pocket to people in the European Union or the United Kingdom, we will appoint a representative there, as the Regulation requires, and publish its details here.
• You may complain to the data protection authority of the country where you live or work, or where you think your rights were infringed; in the United Kingdom, the Information Commissioner's Office.

If you live in the United States, we do not sell your personal information or share it for cross-context behavioural advertising, and you can use the rights your state gives you in the same way as those in section 9. Wherever you live, we handle your data as this Policy describes, and you can use the rights in section 9.

14. Changes to this Policy

We may update this Policy. The version in force is shown at the top, with its date. We will give at least 15 days' notice of material changes, in the Service and by email where we have yours, and ask you to accept them before you keep using Pocket. This Policy is written in Spanish and in English; if the two versions differ, the Spanish version prevails, unless the law of your country requires otherwise.

15. Contact

For anything about your data, write to pocket.stellar.xyz@gmail.com.