Pocket Universe

Privacy

iOS App Privacy Policy

Last Revised: September 22, 2026


Kerberus Cyber Security, Inc. (“us”, “we” or “Company”) respects the privacy of our users (each, “you” or “User”) and is committed to protecting the privacy of Users who access, use, or engage with our proprietary iOS mobile application, Pocket Universe Mobile (the “App” and, together with related services, the “Services”).


We have prepared this Privacy Policy to outline our practices for collecting, using, and disclosing your information when you use the Services.


We encourage you to read this Privacy Policy carefully and use it to make informed decisions. By using the Services, you agree to the terms of this Privacy Policy, and your continued use of the Services constitutes your ongoing agreement to the Privacy Policy.


This Privacy Policy is a part of our Terms of Use, and is incorporated therein by reference.


In this Privacy Policy, you will read about, among other things:


  • What type of information we collect

  • Tracking technologies

  • How we use your information

  • Who we share your information with and why

  • International transfer

  • How long we retain your information for

  • iOS Permissions

  • Account Deletion

  • Children’s Privacy

  • Your privacy rights

  • How we protect your information

  • Marketing

  • How to contact us

What Type of Information We Collect


We may collect two types of data and information from our Users:


Non-personal Information: Unidentified and non-identifiable information pertaining to you, which may be made available or gathered via your use of the Services. We are not aware of the identity of the source from which the Non-personal Information is collected. Non-personal Information which is collected may include your aggregated usage information and technical information transmitted by your device, including certain software and hardware information about your device (e.g., the device you use, the type of operating system your device uses, language preference, etc.), in order to enhance the functionality of the Services. We may also collect information about your activity on the Services (e.g., app usage patterns, feature interactions, etc.).


Personal Information: Individually identifiable information, namely information that identifies an individual or may, with reasonable effort, identify an individual. Such information may include:


  • Account Information: You must sign in to use the Services. Sign-in is handled by our identity platform provider Clerk. Depending on the method you choose (email, Sign in with Apple, or another provider shown on the sign-in screen), Clerk receives your email address, your name if the provider supplies it, and authentication tokens, and assigns you a Clerk user ID. Kerberus receives your email address, your Clerk user ID, and the sign-in method, and assigns you a Kerberus user ID and app ID.

  • Device Identifier: A random identifier (UUID) generated by the App and stored in your device’s Keychain. It persists across app reinstalls and is attached to scan requests, telemetry, and diagnostic logs. Because we associate it with your account and with wallet addresses, we treat it as Personal Information.

  • Voluntary Information: We may collect information that you provide us voluntarily. Further, we may collect information when you respond to our communications, communicate with us via email, or share additional information about yourself through your use of the Services. We may also collect the feedback, suggestions, complaints, bugs, and reports that you send to us.

  • Claim Information: If you submit a Coverage claim, we collect what you send us: transaction hashes and networks, affected wallet addresses, screenshots, the time of the approval, and your description of the incident. We may ask for a video call, government identification (KYC), or further evidence to verify a claim.

  • Device Information: We may collect Personal Information from your device. Such information may include IP addresses, unique identifiers, and other information related to your activity on the Services.

For the avoidance of doubt, if we combine Personal Information with Non-personal Information, the combined information will be treated as Personal Information as long as it remains combined.


VPN, Deep Protection and Transaction Scanning: When using our mobile application, we use a local on-device VPN (Network Extension) to provide phishing and scam protection. By default it is active whenever your device has network activity, and while it is active web traffic from every app on your device passes through a proxy running on your device. All proxying occurs locally on your device, and traffic is not routed through our servers.


Once you install and trust the Pocket Universe Deep Protection root certificate (“Deep Protection”), the proxy decrypts HTTPS web pages on your device in order to insert our protection script, and then re-encrypts them. This applies to apps that do not use certificate pinning, including browsers, and not only to wallet apps. The certificate’s private key is generated in your device’s Keychain and never leaves your device. We do not store or upload page contents, form data, cookies, request bodies, or response bodies.


While the VPN is active we do not collect the hostnames of the sites your device contacts, and we do not collect page addresses (URLs), query strings, request paths, or user-agent strings. What we do send to Kerberus is diagnostic: whether a connection was inspected and, if not, why (for example, the site is on a bypass list or the device is low on memory), together with your Device Identifier, and never the hostname, port, or address of the site. We also receive the API domain of the wallet whose activity started a protection session, and the hostname of a site where you acted on a Pocket Universe dialog (signed, rejected, or connected). We use this to diagnose where inspection succeeds or fails and to prevent abuse.


When a Web3 Site asks your wallet to sign a transaction, approval, or message, we send that request to Kerberus for analysis before your wallet receives it. The data sent includes the request itself as the site composed it (for a transaction, the destination contract, value, and calldata; for a signature, the message or typed data to be signed), the blockchain network, the wallet address(es) the site is using, and the site’s hostname and page address. We do not store scan requests: they are analyzed in real time and discarded once the verdict is returned, and no copy is retained on our servers. Diagnostic logs of a failed request record the error, not the site or the content of the request. We do not sell, use, or disclose to third parties any VPN traffic data for any purpose.


Push Notification Tokens: When you enable push notifications, the App obtains Apple Push Notification (APNs) tokens to deliver threat alerts, Live Activity updates, and security notifications to your device’s Lock Screen and Dynamic Island. The tokens stay on your device and are used to contact Apple directly; they are not sent to our servers.

Mobile Identifiers and Technologies


We may use various tracking technologies to collect and track limited information about your use of the Services, strictly in compliance with applicable data protection regulations.


Types of tracking technologies may include:


  • Device Identifiers: A UUID stored in iOS Keychain that persists across app reinstalls for abuse prevention and service continuity.

  • Analytics SDKs: Crash reports and technical diagnostics are sent to Datadog, our monitoring provider. They contain the app version, iOS version, device model, your Device Identifier, and technical details of how the App is operating. They do not contain the hostnames of sites you browse, page addresses, page content, or wallet data.

  • Apple Push Notification Tokens: Used to deliver security alerts and app notifications to your device.

You may stop this collection by removing the Pocket Universe Deep Protection certificate and the VPN configuration in iOS Settings, or by deleting the App. However, if you choose to do so, some features of the Services will not operate, and your app user experience may be limited.

How We Use Your Information


We use and share Personal Information in the manner described in this Privacy Policy. In addition to the purposes listed above, the information we collect, which may include your Personal Information, is used for any of the following purposes:


  • To communicate with you and to keep you informed of our latest updates;

  • To set up your account and to provide the Services;

  • To identify and authenticate your access to certain features of the Services;

  • To perform research or to conduct analytics in order to improve and customize the Services to your needs and interests;

  • To support and troubleshoot the Services and to respond to your queries;

  • To analyze consumer trends on an aggregate and anonymized basis;

  • To investigate and resolve disputes in connection with your use of the Services;

  • To assess and pay Coverage claims, and to detect fraudulent claims;

  • To detect and prevent fraudulent and illegal activity or any other type of activity that may jeopardize or negatively affect the integrity of the Services; and

  • To investigate violations and enforce our policies, and as required by law, regulation, or other governmental authority, or to comply with a subpoena or similar legal process or respond to a government request.

With Whom We Share the Information and For What Purpose


We do not rent, sell, or share your Personal Information with third parties except as described in this Privacy Policy.


We may share information, including Personal Information, with the following recipients:


  • Our identity provider (Clerk) and our crash reporting provider (Datadog), each of which processes the information described in this Privacy Policy on our behalf;

  • Third-party services that you choose to connect to your account on our Service;

  • Our subsidiaries and affiliated companies;

  • Subcontractors and other third-party service providers;

  • Auditors or advisers of our business processes;

  • Any potential purchasers or investors in the Company.

In the event of a corporate transaction (e.g., sale of a substantial part of our business, merger, consolidation, or asset sale of an asset or transfer in the operation thereof), the acquiring company or transferee will assume the rights and obligations as described in this Privacy Policy.


In addition to the purposes listed in this Privacy Policy, we may share Personal Information with our recipients for any of the following purposes:


  • Storing or processing Personal Information on our behalf (e.g., cloud computing service providers);

  • Processing such information to assist us with our business operations;

  • Performing research, technical diagnostics, personalization, and analytics; or

  • Validating and/or processing any claims you might make via the Services.

These third-party providers are contractually obligated to protect your data in accordance with applicable laws and our standards.


We may also disclose Personal Information, or any information you submitted via the Services, if we have a good faith belief that disclosure of such information is helpful or reasonably necessary to:


  • Comply with any applicable law, regulation, legal process, or governmental request;

  • Enforce our policies, including investigations of potential violations thereof;

  • Investigate, detect, prevent, or take action regarding illegal activities or other wrongdoing, suspected fraud or security issues;

  • To establish or exercise our rights to defend against legal claims;

  • Prevent harm to the rights, property, or safety of us, our affiliates, our Users, yourself, or any third-party;

  • For the purpose of collaborating with law enforcement agencies; and

  • In case we find it necessary in order to enforce intellectual property or other legal rights.

Third-Party Collection of Information


Our policy only addresses the use and disclosure of information we collect from you. To the extent that you disclose your information to other parties via the Services (e.g., by connecting your account on the Service with third-party services or by clicking on a link to any other website or location) or via other sites throughout the Internet, different rules may apply to their use or disclosure of the information you disclose to them.


You acknowledge that we are not responsible for the products, services, or descriptions of products or services that you receive from third-party sites or for the content or privacy practices of those sites, and that this Privacy Policy does not apply to any such third-party products and services. You are knowingly and voluntarily assuming all risks of using third-party sites to purchase products and services. You agree that we shall have no liability whatsoever with respect to such third-party sites and your usage of them.

International Transfer


Since we operate globally, it may be necessary to transfer data, including Personal Information, to countries outside the European Economic Area (EEA) and the United Kingdom. The data protection and other laws of these countries may not be as comprehensive as those in the EEA or the UK − in these instances, we will take steps to ensure that a similar level of protection is given to Personal Information, including through adequate contractual measures such as the European Commission’s Standard Contractual Clauses (SCCs) and the UK International Data Transfer Addendum. You hereby consent to the transfer of Personal Information to countries outside the EEA or the UK.

How Long We Retain Your Information For


We respect your privacy rights, and therefore, you may contact us at any time and request:


  • To access, delete, change, or update any Personal Information relating to you (for example, if you believe that your Personal Information is incorrect, you may ask to have it corrected or deleted); or

  • That we will cease any further use of your Personal Information (for example, you may ask that we stop using or sharing your Personal Information with third parties) or that we shall remove your Personal Information (subject to any other legal obligation that may require us to keep the information).

Please note that unless you instruct us otherwise, we retain the information we collect for as long as necessary to provide the Services, comply with our legal obligations, resolve disputes, and enforce our agreements. We may rectify, replenish, or remove incomplete or inaccurate information at any time, at our discretion.

Your Rights


Certain jurisdictions provide users with statutory rights regarding their Personal Information. Subject to exemptions provided by law, and with proper identification, you may have some/all of the following rights available to you:


  • Right to verify your information (to access, delete, change, or update any personal information relating to you. For example, if you believe that your personal information is incorrect, you may ask to have it corrected or deleted);

  • Right to see what, if any, personal information about you we have;

  • Right to request that we erase information about you (subject to any other legal obligation that may require us to keep the information);

  • Right to restrict us from processing information pertaining to you; and

  • Right to export information in a portable format;

If you wish to exercise any of these rights, please contact us at: support@kerberus.com. When handling your request, we may ask for additional information to confirm your identity (which may include personal information). However, please note that if you choose not to allow us to process your personal information, we may not be able to provide you with the Services.


If you wish to raise a complaint on how we have handled your Personal Information, please contact us directly at support@kerberus.com. If you are not satisfied with our response or believe we are collecting or processing your Personal Information not in accordance with applicable law, you can complain to your applicable data protection authority.

iOS Permissions We Request


The iOS app requests the following permissions. You may grant or revoke each at any time in the iOS Settings app:


  • Notifications: Used to deliver phishing-threat alerts, Live Activity updates, and security notifications. You may revoke notification permission in Settings → Notifications → PU Mobile. Revoking does not delete your account or stop on-device protection.

  • VPN Configuration: Used to install and run the on-device Network Extension that proxies web traffic locally for scam protection. No traffic is routed to our servers. You may disable the VPN at any time in Settings → General → VPN & Device Management → Pocket Universe Mobile.

  • Pocket Universe Deep Protection Root Certificate (configuration profile): Installed and trusted by you during setup so that Deep Protection can inspect HTTPS pages locally on your device. Remove it in Settings → General → VPN & Device Management, or turn off its trust in Settings → General → About → Certificate Trust Settings. Either action stops inspection.

  • Network access: Used to communicate with our backend for configuration updates, transaction scanning, account services, and diagnostic logging.

Account Deletion


You may delete your account and associated Personal Information directly within the iOS app: open Settings → Account and choose Delete Account. Account deletion is permanent and will remove your profile, preferences, and identifiers from active systems. It does not remove the VPN configuration or the certificate from iOS, which you remove in Settings → General → VPN & Device Management. Some data may be retained in backups for up to thirty (30) days or as required by law (for example, to comply with tax, audit, or anti-fraud obligations) before being purged. If you would prefer to request deletion by email, you may also contact us at support@kerberus.com.

Children’s Privacy


The Services are not directed to children under 18, and we do not knowingly collect Personal Information from anyone under that age. If you believe a person under 18 has provided Personal Information to us, please contact us at support@kerberus.com, and we will take steps to delete the information and terminate the account. Parents and guardians who believe their child has provided Personal Information without their consent may exercise the rights described in ‘Your Rights’ on the child’s behalf.

How We Protect Your Information


We take great care in implementing and maintaining the security of the Services and your information. We employ industry-standard procedures and policies to ensure the safety of your information and prevent unauthorized use of any such information. Although we take reasonable steps to safeguard information, we cannot be responsible for the acts of those who gain unauthorized access or abuse the Services, and we make no express, implied, or otherwise warranty that we will prevent such access.


If you feel that your privacy was not treated in accordance with our policy, or if any person attempted to abuse the Services or acted in an inappropriate manner, please contact us directly at support@kerberus.com.

Crash Reporting and Diagnostics Provided by Others


Crash reports and technical diagnostics are sent to Datadog, our monitoring provider. A crash report contains technical details of the crash (app version, iOS version, device model, and stack trace); a diagnostic contains technical details of how the App is operating (for example, memory use). Both carry your Device Identifier. They do not contain the hostnames of sites you browse, page addresses, page content, or wallet data. We use them only to find and fix defects in the Services. Datadog’s ability to use and share this information is restricted by Datadog’s Terms of Service and Privacy Policy.

Marketing


We may use your personal information, such as your full name, email address, etc., either directly or indirectly, to send you notifications, messages, and other updates about new features, offerings, events, and special opportunities, or any other information we think you may find valuable. We may provide such notices through any of the contact means available to us, through the Services, or through our marketing campaigns on any other sites or platforms.


If you do not wish to receive such promotional communications, you may notify us at any time by using the unsubscribe link in any marketing email or by sending an email to support@kerberus.com.


Please note that even if you unsubscribe from our marketing mailing list, we may continue to send you service-related updates and notifications.

Updates or Amendments to the Privacy Policy


We may revise this Privacy Policy from time to time, in our sole discretion, and the most current version will always be posted on our website. In the event of a material change to the Privacy Policy, we will notify you through the Services or via email. We encourage you to review this Privacy Policy regularly for any changes.


Your continued use of the Services following the notification of such amendments constitutes your acknowledgment and consent to the Privacy Policy amendments and your agreement to be bound by their terms.

How to Contact Us


If you have any general questions regarding the Services or the information that we collect about you and how we use it, please contact us at support@kerberus.com.

Information about us


The details of the Company are as follows:


Kerberus Cyber Security, Inc.

254 Chapman Rd, Ste 209, Newark, DE 19702 US