Privacy
Last updated 16 October 2026
This page explains what TenthPocket collects, why, who it goes to and what you can ask us to do with it. It follows the New Zealand Privacy Act 2020.
Who we are
TenthPocket is run by Holdr Ltd, a New Zealand company based in Auckland. Questions about your information go to hello@tenthpocket.com.
What we collect
- Your account: your name, email address and password. Passwords are handled by our sign in provider and we never see them.
- Your shop: your business name, country, currency and tax settings, and the people you invite to your team.
- Your business records: the cards you buy, sell, trade and stock, prices, costs, cash ups, offers and reports.
- Your customers: the names and contact details of the people you buy from and sell to, when you choose to record them.
- Card photos: photos you take in the app to read a card.
- Emails you forward to your private TenthPocket address, if you turn that on.
- Your online store, if you connect one: the listings we create there and the orders that contain your TenthPocket stock.
- Technical information: the requests your device makes to our servers, kept in short lived logs for security and fixing faults.
Why we use it
To run the app for you: keeping your stock, sales and cash correct, pricing cards, reading card photos, keeping a connected store in step, and signing you in. To contact you about your account and about TenthPocket. To keep the service secure. We do not sell your information and we do not use it for advertising.
Your customers' information
When you record a customer, you decide what goes in and you are responsible for telling them you keep it. We hold it for you, use it only to run your shop in TenthPocket, and never contact your customers ourselves for our own purposes.
Card reading
When you scan a card, the photo is sent to an AI provider that reads the card name, set and number. We use Anthropic first. If Anthropic is unavailable or cannot read the card, the same photo is sent to OpenAI instead. Both are based in the United States. Neither uses the photos we send to train its models. OpenAI may keep a photo for up to 30 days to detect abuse, then deletes it. We do not send your name, your customers' details or anything else with the photo. Card photos rarely contain personal information, but if a person or a name is visible in the frame it would be sent too, so photograph the card on its own.
Who we share it with
A small number of service providers run parts of TenthPocket for us. Each receives only what it needs. They are listed, with where they are based, on Who we share data with. Some are outside New Zealand. We may also disclose information when the law requires it.
Where it is kept
Your account and business records are stored in a database in Sydney, Australia. The app and this website are served by Cloudflare's global network.
How long we keep it
We keep your records while your account is open. The text of a forwarded email is kept for 30 days, then only a short record that it arrived. An owner can download the shop's records at any time. If you close your shop, it is locked straight away and deleted 30 days later, with everything in it, unless you reopen it before then. If you delete your login, your name and email are removed and you leave every shop; deals you logged stay in that shop's records under Former staff. We keep only a record that a shop was closed and when, with no business or personal details.
Cookies
The app uses one kind of cookie: the one that keeps you signed in. This website uses no cookies. We do not use analytics or advertising trackers.
Your rights
You can ask to see the information we hold about you and ask us to correct it. Email hello@tenthpocket.com and we will reply within 20 working days. If you are not happy with our answer, you can complain to the Office of the Privacy Commissioner at privacy.org.nz.
Changes
If we change this page in a way that matters, we will tell account holders by email before the change takes effect.