Legal
Privacy policy
Last updated on 2026-09-27. This page says what we store about you, why, where and for how long.
The short version
- We store your account, the docs you choose to sync, and a log of who changed what.
- We never store your source code or a secret value.
- We use only strictly necessary cookies. No ads, no tracking, no analytics scripts.
- We make no automated decisions about you.
- You can export and delete everything yourself.
What we store
| What | Why | How long |
|---|---|---|
| Your name, email address and a hash of your password (never the password itself) | To sign you in and to send you emails you asked for: password reset, email confirmation, invitations | Until you delete your account |
| Your session: a random token, the IP address and browser it was created from | To keep you signed in and to show you where you are signed in | 7 days, or until you sign out |
| The docs you upload or sync (.poket files), project names and descriptions | To run the service: show the docs to your workspace and serve them to the agents you connect | Until you delete the project or your account |
| Every earlier version of a changed file | So Review can show a diff and Restore can undo a change | Until you delete the project |
| The activity log: who did what, when, from which client | So your team can see what changed and who changed it | Until you delete the project |
| A hash and a short prefix of each access key, its name, when it was made and last used | To recognise the key when an agent calls; the key itself is shown once and never stored | Until you revoke the key |
| Workspaces, members, roles and invitations | So teams can share projects | Until the workspace is deleted |
What we do not store
Your source code. PoketProject runs no AI model on your code; your own coding agent reads it on your machine and writes the docs. The website receives only the .poket files you choose to sync.
Secret values. PoketProject stores where a secret lives and who owns it, never the value. Every write is scanned and files that look like they hold a value are refused, and the error never repeats the value.
Where it is stored
The website runs on Vercel and the database is MongoDB Atlas. Emails go through Resend. If you sign in with GitHub or Google, that provider tells us your name and email address. The full list, with regions, is on the subprocessors page. Data is encrypted in transit (TLS) and at rest.
Cookies
We use only strictly necessary cookies: the session cookie that keeps you signed in (HTTP-only, so page scripts cannot read it) and a cookie that stops cross-site request forgery. Your light or dark theme choice is kept in your browser's local storage. There are no advertising or tracking cookies and no third-party analytics scripts.
No automated decisions
We make no automated decisions about you and build no profiles. Rate limits protect the service; they count requests, not people.
Who can see your data
The people you invite to your workspace, with the role you give them. The AI agents you connect with an access key, for that project only. Our site administrators can see accounts and workspace names for support; they do not read your docs unless you ask for help with them.
We never sell your data and we do not share it with anyone else unless the law requires it.
Export and deletion
You can download every project as .poket files at any time, and delete a project, a workspace or your whole account yourself. Deleted data is removed from the live database at once and from backups within 14 days.
Projects with no activity for 90 days may be archived after an email warning; nothing is deleted without you.
Your rights
You can see, correct, export and delete your data from the app. If your country gives you more rights (for example under the GDPR), you can use them by writing to us. You can also complain to your local data protection authority.
Changes
When we change this policy in a way that matters to you, we tell you by email at least 30 days before the change takes effect.
Contact
Write to legal@poketproject.example.
Placeholder: the owner must replace this address, and add the name and address of the company that is the data controller, before launch.