Legal

Privacy policy

How Pocketsay handles personal information, in plain words.

The website provider descriptions below reflect the planned Vercel and Supabase deployment. Configuration and retention settings must be verified before launch.

Draft · needs legal review before launch Last updated 2 October 2026

The short version
  • The app keeps what it learns on your phone, encrypted. We don't receive your saved messages.
  • When you ask a question, saved message context is sent to the model provider you chose, using your own API key.
  • This website uses no tracking cookies and no advertising scripts.
  • If you join the early testers, we keep your email address to send updates and to reply to you.
  • You can delete what the app saved in one tap, and you can ask us to delete your email at any time.

1. Who we are

Pocketsay is built and run by Bhanu Avadutha ("we", "us"). If you have a question about your information, write to avaduthabhanuprakash1@gmail.com.

This policy covers this website, pocketflow.bhanuavadutha.in, and the Pocketsay app for Android.

2. What this policy covers

It covers two things: this website and your dealings with us (signing up, writing to us), and the Pocketsay app on your phone. The Privacy and security page explains the app's data flows in more detail, and forms part of this policy.

3. Information we collect through this website

Early-tester signup. Your email address (required), and, if you choose to add them, your phone model, your Android version and a sentence about what you'd like Pocketsay to do. You also tell us you are 18 or older and agree to receive tester updates. For the planned deployment, we will store these with Supabase and use them to send tester updates and to reply to you. We use double opt-in: we email you a link, and you are added only when you confirm.

Abuse protection. To stop the signup form being misused, we limit how often one address and one connection can submit it. For that we use a salted hash of your IP address. We don't keep the IP address itself.

Messages you send us. If you email us a question, a bug report or a security report, we receive its content and your email address. If you attach screenshots, we can see what is in them. Please blur personal details, and never send API keys, passwords, one-time codes or card numbers.

Server logs. Vercel is the planned website host. Hosting and backend providers may process request metadata and keep technical logs to run and secure the service. The deployed log fields and retention settings are pending verification; the application counter described below does not store IP addresses.

Aggregate counts. A first-party counter adds each page load and APK download-button click to daily totals, with the page or app version, referring site, screen-size class and country. File-download starts are counted separately with the version, country and device class. On the setup guide, Yes and No taps add to that step's feedback total. The homepage publishes cumulative page views and download-button clicks: these are events, not unique people or completed installs. The counter stores no IP addresses, cookies or visitor identifiers and honours Global Privacy Control and Do Not Track. A local development preview displays its own local totals, separately from production.

Cookies and local storage. This website sets no cookies and loads nothing from third parties. Your browser may keep small preferences in local storage on your device. We don't read them, and nothing is sent anywhere.

What we do not collect. No accounts, no payment details, no location.

4. What the app does with information on your phone

The app works with information on your phone, which stays there except as described in clause 5.

  • Notifications. With your permission, it reads the notifications your phone shows. It saves those from the chats and apps you've switched on, in an encrypted database (SQLCipher) in the app's private storage, with the key held by the Android Keystore. Android backup is switched off for the app. One-time codes and card numbers are masked before saving. App notifications older than 30 days are cleared when the notification listener reconnects.
  • Contacts. It looks up a contact's details on your phone so it can address a message.
  • Microphone. It listens on your phone for "Hey Proto". The audio isn't stored. After the wake word, Android's speech service turns your question into text and may process audio online.
  • Phone control (accessibility). If you switch it on, the app can see and tap the screen of the app it is operating, to send a message you've approved or to run a phone task you've started. Its safeguards are designed to stop before purchase or payment actions and avoid passwords, PINs, one-time codes and card details. Phone tasks are beta; review each step.
  • Installed apps. It reads the list of apps on your phone to show the right names and icons and to open an app you name. The list stays on the phone.
  • Its own notifications and background running. It shows a "listening" notification while "Hey Proto" is on and keeps a background service running for it. Android 13 and newer asks you before it can show notifications.
  • Your API key is stored encrypted on your phone.
  • Your activity log is kept on your phone.

We do not receive any of this.

5. What the app sends to others

Your model provider. When you ask a question, the app sends your question, and saved message context, to Groq or Google Gemini, whichever you chose, using your own API key. During a phone task, it sends the text on the current screen as well, and does not store it. The provider is independent of us. You have your own agreement with it, its terms apply to what it receives, and we do not control what it does. Terms differ between providers and between free and paid plans. For example, as of 1 October 2026, Google's Gemini API terms say that on the free tier Google uses submitted content to improve its products and human reviewers may read it. Please read Google's Gemini API terms and Groq's "Your Data in GroqCloud".

Context is matched by app, chat or sender where possible. If nothing matches, recent saved items may be sent up to a size limit. Previous exchanges may also be included. A broad question can therefore send context from several enabled chats and apps.

Messaging apps. A message you approve is sent through WhatsApp, Telegram, SMS or Gmail, like any message you'd send yourself. Those services have their own policies.

Android's speech service. It handles your voice as set by Android and your phone's settings, and may process audio online.

The app sends nothing else to us or to anyone.

6. Messages from other people

The chats you switch on include other people's words. They haven't agreed to Pocketsay reading them. Please switch on only chats you are comfortable keeping on your own phone, and treat what Pocketsay tells you with the care you'd give the originals.

7. Why we use information

  • To run the early-testing programme: to send updates and to answer you. This is based on your consent or your request.
  • To keep the website secure and working.
  • To fix bugs and improve Pocketsay, using the reports you choose to send.
  • To meet our legal obligations.

8. Who we share information with

  • Service providers that help us run the website and the tester emails: Vercel (planned website hosting), Supabase (planned signup database and aggregate counts) and Resend (email delivery). Provider configuration is pending deployment verification; their applicable service terms govern processing.
  • Authorities, where the law requires it.

We do not sell personal information, and we do not share it for advertising.

9. Where information is processed

Our service providers, and the model providers you choose, may process information outside India. Vercel, Supabase, Resend, Groq and Google run their own infrastructure.

10. How long we keep information

InformationHow long
Unconfirmed signup (email and answers)Deleted after 7 days if you don't confirm.
Confirmed signup (email and optional answers)Until you unsubscribe or ask us to delete it, or 6 months after early testing ends, whichever comes first.
After you unsubscribeDeleted within 30 days. We keep a one-way scrambled (hashed) form of your address so we don't email you again.
Emails and reports you send usUp to 12 months after the issue is resolved, then deleted. Security reports may be kept longer where needed to track a vulnerability.
Visit countsDaily totals only. They hold no personal data.
Server logsProvider retention settings are pending verification before the planned deployment launches.
App data on your phoneUntil you delete it. App notifications older than 30 days are cleared when the notification listener reconnects. "Delete all saved data" removes every saved message, alert and chat choice. Uninstalling removes the app’s private storage.

11. Security

In the app, the database is encrypted with SQLCipher, the key is held by the Android Keystore, Android backup is off, and your API key is stored encrypted. On the website, we use standard protections. No system is perfectly secure, and we can't promise otherwise. Pocketsay is early software and hasn't had an independent security audit. Please report security concerns to avaduthabhanuprakash1@gmail.com.

12. Your choices and rights

You can ask us what we hold about you, ask us to correct or delete it, and withdraw your consent at any time. Every tester email has an unsubscribe link, so withdrawing consent is as easy as giving it. In the app, you can switch chats off, delete saved data, revoke permissions or uninstall.

If you are in India, the Digital Personal Data Protection Act, 2023 gives you rights over your personal data, including the right to nominate someone to exercise them for you. Write to avaduthabhanuprakash1@gmail.com.

13. Children

Pocketsay is not for anyone under 18, and the signup form asks you to confirm that you are 18 or older. We do not knowingly collect information from children. If you think a child has joined the early testers, write to us and we will delete it.

15. Changes to this policy

If we change what the app stores or sends, or what this website collects, we will update this policy and the Privacy and security page, and note it in the changelog. The date at the top shows the latest update.

16. Contact and complaints

Questions, requests and complaints go to Bhanu Avadutha at avaduthabhanuprakash1@gmail.com. We will reply as soon as we can, and within the time the law requires.

This document describes Pocketsay version 0.3.0. It is a plain-language draft awaiting review by a qualified lawyer in India and is not legal advice.