Pocko privacy notice
The short version: we ask for only what we need, we never sell it, there are no ads and no tracking cookies on this website, and you can ask us to delete your data any time by emailing [PLACEHOLDER: contact email for privacy questions and deletion requests].
1. Who is responsible
[PLACEHOLDER: legal name of the person or company running Pocko], [PLACEHOLDER: country] ("we", "us"), runs Pocko and decides how your personal data is used. Under India's Digital Personal Data Protection Act, 2023 (DPDP Act) we are the Data Fiduciary; under the EU and UK GDPR, the controller. Contact for anything here: [PLACEHOLDER: contact email for privacy questions and deletion requests]. Grievance officer: [PLACEHOLDER: name of the grievance officer], at the same address.
2. The waitlist on this website
When you join the waitlist on the home page, here is exactly what happens to what you type.
What we collect, and why
| What | Why |
|---|---|
| Your email address | To tell you about Pocko's early access and send your invitation. Nothing else. |
| Your name (optional) | To greet you properly. |
| Your country | To plan the launch, languages and prices for where people live. |
| What you get stuck on (optional) | To learn which problems Pocko should help with first. Please don't type anything private here. |
| A referral code | When you join you get a short code of your own. If a friend joins through your link, their join is counted for you ("bring 3 friends, get in early"). If you came through a friend's link, we keep that friend's code, and if you came through a video or post, we keep its link tag. |
| A scrambled form of your IP address | To stop bots and floods: at most a few joins an hour from one visitor. The address is only hashed (turned into a code that cannot be turned back into the address). We never store the raw IP address, and our logs don't record it. These counts are deleted after a day. |
Basis: your consent, given when you press "Join the waitlist" (DPDP Act section 6; GDPR article 6(1)(a)). You must be 18 or older.
Where it is stored
On Pocko Cloud, our server, run on Supabase in Mumbai, India (AWS ap-south-1). Only our server can read the waitlist; the public cannot. This website itself is hosted by Vercel, which can see your IP address while you visit, like any host. It has no ads, analytics or tracking cookies.
How long we keep it
Until Pocko launches plus 12 months, or until you ask us to delete it, whichever comes first. After that we delete it.
What we don't do
- We don't sell or rent your data, and we don't share it for advertising.
- No ads tracking: no advertising cookies, pixels or profiles.
- We email you only about Pocko's early access: no spam.
How to ask for deletion
Email [PLACEHOLDER: contact email for privacy questions and deletion requests] from the address you joined with, and say "delete my waitlist entry". We delete it and reply within 30 days at the latest, usually much sooner.
3. Your rights, in plain words
Under India's DPDP Act you can:
- ask what we hold about you, how we use it and who we've shared it with;
- correct, complete, update or erase it;
- take back your consent at any time, as easily as you gave it (this doesn't undo what was done before);
- name someone to use these rights for you if you die or can't act for yourself;
- complain to us, and if you're not satisfied, to the Data Protection Board of India.
If you're in the EU, the UK or a country with similar laws (GDPR), you also have the right to receive your data in a usable form (portability), to object to processing we base on legitimate interests, and to complain to your local data protection authority. To use any of these, email [PLACEHOLDER: contact email for privacy questions and deletion requests]. We reply within 30 days at the latest.
4. The Pocko app
Pocko is a desktop buddy for Windows that talks with you, looks at your screen when you ask for help, and remembers you. The app is in a private, invite-only beta. This part explains what it handles.
4.1 Your PC first
Pocko's memory, your saved conversations and everything else he keeps about you are stored on your PC, encrypted with your Windows account. What has to leave the PC is what an AI needs to answer you during a chat, your sign-in, a locked backup of your memory (so you can restore it on a new PC; you can turn it off and delete it), and, if you allow it, anonymous crash reports.
4.2 During a chat: voice, screen and memory (sent to Google)
A chat is open after you say "Hey Pocko" or while you hold Ctrl+Space, until it ends. Only then:
- Your voice streams as audio from your PC to Google's Gemini API, and Pocko's spoken answer streams back, with a text transcript of both.
- Your screen: a picture of the monitor under your mouse, a close-up near the mouse, the words and buttons on it as text (read on your PC), and the mouse position. It is sent when the chat starts, with each new sentence you say, and every 10 seconds while you talk. Anything visible on that monitor can be in it, so close what you don't want Pocko to see before you start a chat.
- Background for the chat: what Pocko remembers about you (if memory is on), the lines you and Pocko said since he started, and walkthroughs that worked before in the app in front.
- If you let Pocko use your computer ("use my computer", off by default): the names and text of the buttons in the app he works in.
These go directly from your PC to Google; they do not pass through our servers, and we never store them. Basis: your consent, given when you start a chat. You withdraw it by ending the chat, and can turn memory or "use my computer" off at any time.
4.3 Starting a chat, your account, updates
When a chat starts, the app asks Pocko Cloud for a single-use pass to Google. It sends the app's version and your choices (Pocko's name, personality, language, voice, speech speed, reply length, custom instructions and which features are on). Pocko Cloud turns these into Pocko's instructions for that one chat and hands them to Google with the pass. It does not log or store them. It stores a row saying a chat was started: when, which AI model and the minutes it may use, so it can apply your daily minutes.
You sign in with Google. Pocko Cloud's sign-in (Supabase Auth) receives your email address and the name and profile picture Google shares, and keeps them with an account id and sign-in times. The tester list holds your email, your daily minutes and which versions you may download. A minute after Pocko starts and every 6 hours, the app asks Pocko Cloud, with your sign-in, whether a newer version exists. The download page asks Pocko Cloud for your invite and a download link valid for 10 minutes. The nightly "dream" that sorts chats into memories, once it reaches your version, sends that text to Pocko Cloud and Google's Gemini and keeps nothing.
4.4 Backup
If backup is on, Pocko keeps an encrypted copy of your memory, settings, custom instructions, reminders and walkthroughs in Pocko Cloud (Supabase, Mumbai, India). It is encrypted on your PC before it is sent, and the key is kept separately from the files. The honest part: because we hold the key, we could technically open a default backup, and could be legally required to. We guard against it: keys are kept apart from the files, only the owner has access, with 2-factor sign-in, no tool reads them, and every use of a key is logged. A Private backup, where only you hold the key, is coming but is not available yet. Deleting a memory, or all your data, or pressing "Delete my cloud backup", deletes the copy at once; our encrypted database safety copies keep encrypted key records for up to 30 days during the beta (7 days on our provider's paid plan). Basis: your consent, by turning backup on.
4.5 Crash reports
If Pocko crashes, he sends a report to Sentry so we can fix it. It holds only the error's type, the names of the code steps involved, Pocko's version and channel, your Windows version, and a random report id and time. Never error messages, file names, your screen, voice, memory, chats, settings, or your PC or user name. Reports are on by default; turn them off in the control center, under Privacy. Basis: our legitimate interest in a working app, with an easy off switch.
4.6 Your IP address in the app
Every connection shows your IP address to the service it reaches (Google, Supabase, Sentry, Vercel). We don't store it in our database, our function logs don't record it, and we have asked Sentry not to keep it. Those services may keep it briefly in their own security logs.
4.7 What we don't do
No advertising, no selling or renting your data, no profiling you for anyone else, no usage analytics in the beta, and no training of AI models on your data by us.
5. Who receives your data
| Service | What for | Where |
|---|---|---|
| Supabase (Pocko Cloud) | The waitlist, sign-in, tester list, chat counts, updates, backups, passing settings to Google | Mumbai, India (AWS ap-south-1) |
| Google (Gemini API, Google sign-in) | The AI during chats, voice samples; signing in | Google's servers, mostly in the United States |
| Sentry | Crash reports | United States |
| Vercel | Hosting this website and the download page | Global network, United States company |
Google processes chat content under its paid Gemini API terms: it does not use it to improve its products, and may keep it for a limited time to detect abuse. Each service works under its own data processing terms with us. Some are outside India and the EU; DPDP allows transfers except to countries the Government restricts, and for people in the EU or UK these services rely on standard contractual clauses or similar safeguards. We may also disclose data where the law requires it.
6. How long we keep it
| Data | Kept |
|---|---|
| Waitlist entry (email, name, country, what you're stuck on, referral details) | Until launch plus 12 months, or until you ask us to delete it |
| Hashed IP counts for rate limits (waitlist) | One day |
| Voice, screen, memory and chat lines sent during a chat; settings sent when a chat starts | Not kept by us. Google: as in section 5 |
| Backup (locked copy of your memory and settings) | Until you delete it or turn backup off and delete it; gone from our safety copies within 30 days in the beta |
| Chat records (time, model, minutes; no content) | 12 months |
| Your account and tester row | Until you leave the beta or it ends, then deleted within 30 days |
| Crash reports | Up to 90 days, in Sentry |
| Everything on your PC | Until you delete it ("Delete all my data" in the control center) or uninstall Pocko and delete %AppData%\Pocko |
7. On your PC
Pocko keeps his memory, your saved conversations (text only), walkthroughs, reminder notes, custom instructions and sign-in encrypted with your Windows account (Windows DPAPI). Your other settings (names, looks, voice and switches) are plain files. Logs for troubleshooting are kept 7 days and hold sizes and timings, not what you said. The wake word, text recognition and reading buttons on screen all run on your PC. "Delete all my data" in the control center erases memory, conversations, walkthroughs and logs on the PC and, unless you untick it, your backup in Pocko Cloud.
8. Security
Data on your PC is encrypted with your Windows account. Everything sent travels encrypted (HTTPS or secure WebSockets). Pocko Cloud's database lets each user read only their own rows, and the waitlist can be read only by our server. If a breach affects your personal data, we will tell you and the Data Protection Board as the law requires.
9. Children
Pocko and its waitlist are for people 18 or older. If you think someone younger has joined, tell us and we'll delete their data.
10. Changes
We'll update this notice when Pocko changes. For anything that changes how your data is used, we'll tell you first (in the app, or by email if you're on the waitlist), and ask again where your consent is needed.
11. Contact and grievances
[PLACEHOLDER: legal name of the person or company running Pocko], [PLACEHOLDER: country]. Email: [PLACEHOLDER: contact email for privacy questions and deletion requests]. Grievance officer: [PLACEHOLDER: name of the grievance officer], at the same address. Also see our terms of use.