How it works
It cannot spend
your money
Not “does not”. Cannot.
Read-only is a capability,
not a promise
Pocket never requests the permission that would let it initiate a payment. The scope is absent from the connection itself — so there is nothing to misuse, nothing to be tricked into using, and nothing to revoke in a hurry.2
ConnectionYou log in to your bank, not to usCredentials are entered on your institution's own screen. Pocket never sees a password — what comes back is a scoped read token.
StorageSealed per recordEvery access token is encrypted with AES-256-GCM before it touches disk. A stolen database file is not a stolen account.
OwnershipChecked against our recordsA connection started from your account can only be completed by your account. The check runs on Pocket's own ledger, not on a field a provider might not send.
What we do not do
Move moneyNo transfers, no payments, no trading. The capability is not requested and does not exist in the product.
Give advicePocket describes what your money did. It does not tell you what to buy, and it is not a licensed adviser.3
Sell your dataYour data pays for nothing. It is read to draw your own screens, and that is the whole of its journey.
Keep what you revokeDisconnect an institution and its token is destroyed. Delete your account and the data goes with it.
Show your numbers to anyoneCommunity posts share a claim, never a balance. Every figure on this site is a demonstration account.1