Pocketful

Live Friend Checkout (/pay/:token): Public token-addressed friend checkout page powered by PayPal Sandbox Checkout.
Live Group Split: Server-side largest-remainder math dividing $100.00 across friends with exact whole-cent precision ($33.34 + $33.33).
Live Occasions & Getaways: Automated holiday calendar, trip budgets, and dedicated leisure savings pockets.
Live Ledger: Ingests transactions to calculate guilt-free weekend fun money ($140.00) and detects 90-day dormant ghost subscriptions.
Live Guardian Approval: Interactive tactile wax seal requiring a 1.2-second hold and passkey/PIN step-up before any funds move.
Live Spend Ledger: AG Grid transaction table featuring merchant normalization, match tiers, and one-tap micro-feedback.
The Trust Model: AI suggests outings and detects waste; you approve with a passkey; deterministic code re-verifies limits and pays.
Live Plan Screen: Friday 5 PM briefing delivering Comfort, Stretch, and New outing tickets sourced from OpenStreetMap venues.
Live You Screen: Transparent preference learning with comfort-zone tree rings, GDPR data export, and 1-tap preference erasure.
Partner Stack: Production integration with PayPal, Google Gemini 2.5 Flash, Supabase PostgreSQL, AG Grid, APIMatic, and Render.
Four Promises, One Weekend: Guilt-free budgeting, waste elimination, transparent learning, and cryptographic trust by design.
The Test Scorecard: Tested hard with 650 automated tests, 79 live adversarial exploit probes, 73 Postgres tests, and 0 vulnerabilities.
Security Hardening: 24-hour factor cooldowns, atomic 5-strike lockout, and immutable append-only financial audit trails.
Four-Layer System Architecture: Air-gapped AI suggestions strictly separated from the deterministic Guardian execution engine.
Pocketful: An AI weekend companion for your PayPal wallet. It plans, splits, and saves—never moving a cent without your approval.

Inspiration

Traditional personal finance tools suffer from a fundamental architectural flaw: they are reactive. They scold users on Monday morning with charts of what they overspent, after the money has already left their wallets. Compounding this is "Friday fog"—the cognitive exhaustion at the end of the work week that causes people to stay home, lose $50 to $150 every month to dormant subscriptions, or face the friction of bill splits where someone absorbs rounding errors.

While the industry has rushed to build conversational bots that talk about money, language models cannot be trusted with financial execution. When a probabilistic model hallucinates an API parameter or misinterprets context, real capital is lost.

We built Pocketful to prove a new standard for agentic finance: an AI weekend companion for your PayPal wallet where the intelligence layer is architecturally decoupled from the transaction layer.

Our core operating principle: AI suggests. You approve. Code pays.

The AI suggests: Gemini 2.5 Flash curates outings, detects financial waste, and explains balances. It has zero database access and no path to move funds.
You approve: You hold the physical wax seal for 1.2 seconds and approve with your passkey or PIN, tied cryptographically to that exact payload and amount.
The Guardian executes: Non-LLM, deterministic code re-verifies safety caps under an atomic lock, then pays exactly once.

What Pocketful Does: One Loop, Friday to Sunday

Pocketful runs an autonomous cycle on top of your live PayPal wallet:

Always On (Know): Ingests past PayPal and ledger transactions to deduce fixed bills and computes your exact guilt-free fun money ($140.00 in the seeded demo). No manual budgeting or surveys.
Friday AM (Recover): The Auditor scans recurring billing to detect ghost subscriptions—services with zero usage signals for over 90 days (such as dormant gym passes or duplicate streaming tiers)—staging one-tap cancellation previews.
Friday 5:00 PM (Plan): Delivers three curated outing tickets tailored to your energy and mood: Comfort (a safe bet), Stretch (a bit further or pricier), and New (something untried). Venues are fetched from a closed-world OpenStreetMap catalog within your set reach radius.
Saturday (Split): Coordinates group outings for up to 20 friends with zero lost pennies. Each friend receives a token-addressed checkout link (/pay/:token) powered by PayPal Checkout.
Sunday (Sweep): Leftover fun money is swept into your long-term savings vault, locked behind your explicit authorization.

Technical Architecture

Pocketful implements a zero-trust, four-layer architecture dividing probabilistic AI from deterministic money execution:

Layer 1 (Frontend): React 18, Vite 7, TypeScript, Tailwind, and AG Grid. Built accessible by design with contrast ratios of at least 4.5:1 across every token pair, focus-trapped dialogs, a keyboard approval path, and full prefers-reduced-motion support.
Layer 2 (Hardened Gateway): Node 22, Express 4, Helmet CSP, strict payload limits, and pinned JWT verification (HS256 and ES256/RS256 via Supabase JWKS).
Layer 3A (Advisory AI): Planner, Tracker, Learner, and Pip (the assistant) powered by Gemini 2.5 Flash with closed-world venue IDs. Air-gapped from execution.
Layer 3B (Deterministic Engine): The Guardian gatekeeper (begin_execution), Splitter, Settlement reconciler, and Currency engine. All state mutations and money handling reside exclusively here.
Layer 4 (Persistence & Autopilot): Supabase PostgreSQL 16 with Row-Level Security on all tenant tables, append-only triggers on financial audit logs, and timezone-aware cron jobs with atomic distributed leases.

Mathematical and Security Invariants

Integer Minor Units Invariant: Floating-point arithmetic is forbidden across the codebase. All transactions are calculated and stored in integer minor units (cents, pence, yen) across 9 supported ISO 4217 currencies.
Largest-Remainder Group Splitting: Dividing $100.00 among three people mathematically yields $33.33 three times ($99.99). Pocketful uses largest-remainder splitting with deterministic rotation so shares always equal the total: $$\$33.34 + \$33.33 + \$33.33 = \$100.00$$ Proven exact across an automated 3,000-case randomized fuzzing suite (totals up to 5,000,000 cents, up to 20 participants).
Dual-Phase Cap Enforcement: Staging-time cap checks are advisory; the authoritative check executes under a per-user PostgreSQL advisory lock immediately before funds move, summing all executed and currently executing amounts for the active ISO week.
24-Hour Step-Up Cooldown: When a new factor (passkey, TOTP, PIN) is enrolled, replaced, or reset, it cannot approve money-moving Guardian actions for 24 hours. A stolen session token cannot enroll a new factor to drain funds.
Atomic Lockout: PIN and TOTP share a unified counter. Five consecutive failed attempts trigger an atomic 15-minute lockout via a single database compare-and-swap update, neutralizing brute-force attempts.
No Stranded Friends: Cancelling an outing voids unpaid payment links immediately and automatically refunds all friends who already completed PayPal checkout.

Tested Hard, With Receipts

650 Unit & Component Tests: 573 API tests across 47 files and 77 web tests across 9 files passing with 0 errors.
79 / 79 Live Adversarial Probes: The verify-fixes suite spins up live server processes and tests them over HTTP against spoofed proxy headers, race conditions, replay attacks, forged proofs, and malformed payloads.
73 Real PostgreSQL 16 Tests: Dedicated test suite verifying migrations, immutability triggers, and atomic functions against live PostgreSQL.
Zero Vulnerabilities: Clean npm audit across all development and production dependencies.
Fail-Closed Boot Guard: The production server refuses to boot if secrets are missing, simulators remain enabled, or wildcards exist in CORS origins.

Partner Stack

PayPal: Payments, subscriptions, refunds, and webhook reconciliation (Orders v2, Captures, Subscriptions v1).
Google Gemini 2.5 Flash: Contextual suggestions, preference deduction, and explanations. Never payments.
Supabase: PostgreSQL database, authentication, and Row-Level Security.
AG Grid: Real-time transaction spending ledger.
Render: Production deployment for API and static web services via render.yaml.
APIMatic: Full OpenAPI 3.1 specification (71 operations across 67 paths), ready for client SDK generation.

Roadmap

Guarded Sunday Micro-Investing (Flagship): Connecting leftover weekend sweeps to automated micro-investment allocations via PayPal, behind the same Guardian approval.
Passkey-Only Mode: Phasing out fallback PINs in favor of strictly hardware-bound FIDO2 credentials.
Multi-Rail Payouts: Extending friend settlement to direct wallet disbursements across global corridors.
Group Escrow Automation: Staging collaborative travel budgets that lock reservations only after all party members fund their shares.