POCKET CLI · INTERNATIONAL EDITION
Privacy Policy
This policy applies to the international edition of Pocket, which serves users outside mainland China and uses servers in Hong Kong. Users in mainland China should use the China mainland edition, which has its own Privacy Policy (in Chinese).
The international edition of Pocket (the Pocket CLI phone app, the Pocket desktop app for Mac, Windows and Linux when signed in to an international account, the website pocket.pocketcli.net, and the servers behind them) is developed and operated by Alex Lay ("we", "us"). We are the controller of your personal information. This policy explains what we process, why, where it is stored, for how long, who processes it on our behalf, what we cannot see, and how you can see and delete it. This policy is available in English and Chinese; if the two versions differ, the English version prevails.
Key points
- Pocket encrypts sessions, files, and the messages and answers you send end to end, and does not work without it: the keys exist only on your phones and computers, and our servers only relay and briefly store encrypted data they cannot read.
- A new phone or computer must be paired after it signs in: it shows a 6-digit pairing code, which you enter on a device that is already signed in. The pairing code is never sent to us.
- What we can still see: your account email, which devices you have (name, type, public key), when they are online, when they send each other how much data, and IP addresses.
- No selling, no ads, no tracking. The app contains no third-party analytics, advertising or push SDKs.
- Our servers are in Hong Kong, China (Tencent Cloud). Voice can be turned into text on our servers (we do not store recordings), in which case the recording is processed by a speech recognition provider in mainland China; or it can be transcribed on your own computer or phone instead. See section 5.
- The old unencrypted way of syncing was switched off on October 9, 2026, and all old plaintext session records and attachments on our servers and object storage were deleted the same day. Old versions can no longer sync and only ask you to update.
- You can delete your account and all of your data on our servers at any time in the app: Settings → Delete account.
1. What we process and why
1.1 Your account
- When you sign up and sign in: your email address (your account name; also used to send verification codes and reset your password) and your password. Passwords are stored only as salted hashes (scrypt); we never see them. Older accounts created with a username store the username. The international edition does not collect phone numbers.
- We give your account a random account ID and record when you signed up.
- For each phone you sign in on: its type ("iPhone" or "Android"), when it signed in and when it was last used. Sign-in credentials are stored only as hashes; a phone that is not used for 30 days is signed out. A computer stays signed in until you sign it out or remove it.
- Account settings: how many days of sessions the phone shows. The server also records a region flag based on the IP address your phone connects from (only "mainland China" or "elsewhere", used to choose where attachments are stored). Your phone's interface language is kept only in the server's memory, to show messages and send emails in your language.
- Purpose: to create and protect your account, let you sign in on several devices, and tell you when a new phone signs in or a new computer is linked.
1.2 Devices, keys and pairing
- Each phone and computer creates its own keys on the device the first time it is used. Private keys stay on that device and are never sent to us. The public keys, together with the device name, its type and the app version, are registered with our server, which gives the device a random internal address. Device names: for a computer, its name (for example "My MacBook"); for an iPhone, the name the system provides (usually "iPhone"); for an Android phone, its brand and model.
- Pairing: encryption is turned on when the first phone signs in to your account. After that, each new phone or computer shows a 6-digit pairing code when it signs in; you enter it on a device that is already signed in, and only when pairing succeeds are the new device's keys added to your account. The pairing code stays on your two devices and is never sent to us; our server only relays values the two devices compute, from which the code cannot be worked out. Until it is paired, a new phone sees no sessions and a new computer syncs nothing.
- The device list: which devices belong to your account, what each may do, and which were removed are kept in a list signed by your devices. Our server stores this list and passes it to your devices, but cannot change it.
- The keys a computer uses to encrypt content are wrapped separately for each approved device's public key and handed over through our server. Only that device can unwrap them; we cannot.
- If you relay data through a server you run yourself, we record its address, name and certificate fingerprint.
- Purpose: to let your devices find and recognise each other, and to make sure only devices that paired successfully can read your content.
1.3 What the desktop app syncs (end-to-end encrypted)
After you install the Pocket desktop app on your own computer, sign in and pair it, it reads, on that computer, the session records of the AI coding tools Claude Code, Codex, Kimi Code, pi and DeepSeek Harness, and syncs the sessions from the last few days (you choose how many in the app) to your phone so you can see and act on them there:
- Session titles, working-directory paths and status; the conversation between you and the AI; the AI's reasoning, the commands it ran and tool output; actions waiting for your approval and questions the AI asks you.
- Files the AI read, created or changed in a session (screenshots, web pages, documents and so on), and images you pasted into a session, are synced as attachments; thumbnails are made on your computer. Files over 20 MB are not synced automatically; only their name, type and size are. The desktop app keeps a list of sensitive file names and also checks file contents, so keys, passwords, access tokens, certificates and configuration files containing passwords are not synced, but it cannot be guaranteed to recognise everything sensitive. If you do not want something to appear on your phone, do not work with it in an AI session, or choose Pause Sync in the desktop app.
- About the computer: its name, the project folders you trusted in your AI tools, the AI tools and models available, and whether the desktop app has all the system permissions it needs.
- Usage and balances: usage and limits of the AI tools on your computer, and your DeepSeek and Moonshot account balances. Your computer queries DeepSeek and Moonshot directly, using the keys already configured on it; those keys are never sent to us, and our servers cannot see the results.
- All of the above is encrypted on your computer, relayed and briefly stored by our relay server (which only holds encrypted data), and can be decrypted only by phones you paired; neither we nor Tencent Cloud can see it. When you search sessions on your phone, the search terms are also encrypted and sent to your computer, which searches locally.
- Purpose: to show sessions, files and usage on your phone, and to deliver your answers, approvals, stops and new messages to your computer.
We do not deliberately collect sensitive personal information. If your sessions or files contain sensitive content such as identity documents, health or financial account details, it is synced (encrypted) to your phone along with the session; please decide for yourself.
1.4 What you send from your phone (end-to-end encrypted)
- The text you type, your answers to approvals and questions, and the images and files you choose to send to your computer (up to 20 MB each, 5 at a time).
- These are encrypted on your phone, passed by our relay server to your own computer, handled there by your AI tools, and then synced back as part of the session. We cannot see them.
- The AI tools on your computer (Claude Code, Codex and so on) are installed and signed in by you; how they handle what you send to the AI is governed by their providers' terms. Pocket neither provides nor calls any AI model.
1.5 Voice input
- Audio is recorded only while you hold the microphone button. The first time, the app asks you to choose how speech is transcribed; if you choose Pocket cloud, the app first explains it separately and asks for your consent:
- Pocket cloud: the recording goes to our speech service in Hong Kong, which passes it to the speech recognition provider we use in mainland China (see sections 4 and 5). The text comes back to your phone and is then sent to your computer, encrypted, like typed text. The only thing sent to the provider with the recording is an anonymous identifier derived from your random account ID (the same for every request from your account), never your email or device name. We do not store recordings: a recording stays in memory only while it is being recognised and is then discarded; logs record only the random account ID, the transcription method, the recording length and the number of characters recognised, never the audio or the text.
- My computer: the recording is encrypted and sent to your own computer, which transcribes it with an open-source model downloaded to that computer. The recording and the text travel only in encrypted form, so we cannot see them. On the computer, the recording is saved to a temporary file during recognition and deleted afterwards.
- Self-hosted speech service: the recording goes to a speech service you run yourself; we are not involved.
- On this phone: the phone's built-in offline recognition turns the recording into text; the recording never leaves the phone.
- You can change the method (Voice transcription) or withdraw consent (Voice input) at any time in Settings. After withdrawing you cannot use voice; typing works as before.
1.6 What our servers can see
Even with end-to-end encryption, the servers need some information to deliver data to the right device. This is all of it:
| Information | Account server (accounts and devices) | Relay server (holds only encrypted data) | Speech service |
|---|---|---|---|
| Sessions, messages, the AI's reasoning and commands, tool output, approvals and questions, plans, titles, project paths, models, usage, attachment names and contents, thumbnails, search terms and results | No | No (ciphertext only) | No |
| Account email, password hash, sign-in times; device names, types, public keys, internal addresses and versions; the device list and permissions; devices waiting to be paired and how their pairing is going (never the code); which relay server you use; the session-days setting; whether devices are online | Yes | Only internal addresses and a random account ID | Only the random account ID and the internal address of the device asking for transcription |
| Who sent how much data to whom and when, whether it is a command or a reply, how many messages each session has, which messages are long, attachment sizes and when they are downloaded | Only whether devices are online | Yes | — |
| IP addresses | Yes | Yes | Yes |
| Recordings and recognised text | No | No | Only when you choose Pocket cloud, never stored |
We use this information to deliver data, limit request rates, prevent abuse and fix problems, never to analyse your content (which we cannot see).
1.7 The old way of syncing (switched off)
- Before October 9, 2026, older versions of the app and desktop app synced without encryption: sessions, files and the messages you sent passed through and were stored on our servers in plaintext.
- The old way of syncing was switched off on October 9, 2026. Old versions that connect are only asked to update and can no longer sync or send anything.
- All old plaintext session records and attachments on our servers and object storage were deleted the same day. End-to-end encryption is now the only way Pocket works.
1.8 Logs
For security, troubleshooting and abuse prevention, the servers keep operational logs: IP addresses, times, actions such as signing in, signing up, sending verification codes, linking computers, pairing devices and downloading installers, the account email, and device or computer names; the relay server logs the times and sizes of connections, deliveries and stored items, and the internal addresses and random account IDs of sender and recipient; the speech service logs the time, random account ID, transcription method, recording length and number of characters. Logs never contain session content, what you send, recordings or recognised text.
1.9 The website
The website uses no cookies and no third-party analytics; the server rate-limits by IP address in memory only and keeps no page-visit logs; when you download an installer, the server logs the IP address and file name. When the desktop app signs in through your browser, the sign-in state lives only in that browser tab and expires after 30 minutes. The "GitHub mirror" download links on the website are provided by GitHub; downloading through them is subject to GitHub's privacy policy.
1.10 What we do not collect
Phone numbers, location, contacts, text messages, call logs, camera, health information, advertising identifiers (IDFA), unique device identifiers (such as IMEI, MAC address or Android ID), browsing history. The app reads the clipboard only when you tap a paste button. We do no profiling and no automated decision-making, and we do not use your content to train models or target advertising.
2. Phone permissions
| Permission | When we ask | What it is for |
|---|---|---|
| Microphone | The first time you hold to talk, after you choose a transcription method (for Pocket cloud, after you agree to the voice notice) | Voice input |
| Speech recognition (iPhone) | The first time you use "On this phone" transcription | The system's offline recognition turns the recording into text; the recording never leaves the phone |
| Notifications | After you agree to this policy | Tell you when a session finishes or needs your decision. These are local notifications sent by the phone itself, not through Apple's or Google's push services; we receive no push identifiers |
| Photos, files | No permission requested | The system picker is used; only the items you select are read |
| Clipboard | No permission requested | Read only when you tap a paste button (to fill in the connection details of a server you run yourself); written when you tap copy |
| Motion sensors | No permission requested | The home background tilts with the phone; used only on the phone, never uploaded |
| Network | — | Connecting to Pocket's servers |
You can turn these permissions off at any time in your phone's settings. The matching feature then stops working; everything else keeps working.
3. Where it is stored and for how long
We keep your information only as long as needed for its purpose and delete it afterwards.
| Information | Where | How long |
|---|---|---|
| Account information, sign-in credential hashes, account settings | Tencent Cloud server in Hong Kong | While the account exists; deleted immediately when you delete the account |
| Device public keys and names, the device list, wrapped keys (ciphertext we cannot open) | Hong Kong server | While the account exists (removed devices stay in the device list so signatures can be checked); deleted immediately when you delete the account |
| Encrypted session records (ciphertext) | The relay server in Hong Kong | Deleted after 30 days without being read or written (for a computer that was online in the last 7 days, its session list, computer information and usage are kept); deleted when you delete the account or remove the computer |
| Encrypted attachments (ciphertext) | Tencent Cloud object storage: normally in Hong Kong; attachments uploaded from a mainland China network, or from a network whose region cannot be determined, are stored in Shanghai | 30 days after the last download, or 30 days after upload if never downloaded; deleted when you delete the account or remove the computer |
| Messages waiting for an offline device (ciphertext) | The relay server in Hong Kong | Deleted once the receiving device confirms delivery; at most 7 days |
| Plaintext session records and attachments synced by old versions | No longer stored | All deleted on October 9, 2026 |
| Revocation records for removed devices and deleted accounts (random account ID, device IDs and internal addresses; no email or device names) | Hong Kong server | Kept 180 days to stop removed devices from reconnecting, then deleted |
| Verification codes | Hong Kong server, hashes only | Valid for 10 minutes; deleted when used, or within a day after expiring |
| Recordings | Not stored | With Pocket cloud, held in memory only during recognition |
| Speech usage (transcription time, recorded per anonymous account identifier) | Hong Kong server | Used for daily and monthly limits; deleted after the month ends |
| Attachment traffic counters | The relay server in Hong Kong | Used for daily and monthly limits; deleted after about 3 months |
| Operational logs (account server, relay server, speech service) | Hong Kong server | Deleted automatically after 7 months; deleting your account does not delete logs early |
| Database backups | Hong Kong server | One a day, kept 7 days. After you delete your account, its information in backups is gone within 7 days as old backups are deleted; project paths, attachment names and usage recorded by old versions in backups made before October 9, 2026 are deleted with those backups by October 16, 2026 at the latest |
| Data on your phone | Your phone | Decrypted records and the image cache are up to you: Settings → Clear cache, or uninstalling the app, deletes them; images and files over 500 MB are trimmed, least recently viewed first. Keys are kept in the system keychain / Secure Enclave (iPhone) or Keystore (Android); sign-in credentials, keys and records are not included in iCloud backups |
| Data on your computer | Your computer (the .pocket folder in your user folder) | Up to you; key files are readable only by your system account and excluded from Time Machine on Mac, readable only by your system account on Linux, and encrypted with the system's DPAPI on Windows; files received from your phone and thumbnails are cleaned up after 30 days |
| Data on a server you run yourself | Your own server | Up to you; when you delete your account we also tell your self-hosted server to delete your data |
4. Service providers
We do not sell your personal information or give it to third parties for their own purposes. To provide the service, we use the following providers, who may process it only on our instructions and with appropriate safeguards:
| Provider | What they do | Information involved | Location |
|---|---|---|---|
| Tencent Cloud Computing (Beijing) Co., Ltd. (Tencent Cloud) | Cloud servers, object storage | The information stored on our servers in section 1: account, devices and the device list, logs; end-to-end encrypted sessions and attachments only as ciphertext (neither Tencent Cloud nor we can decrypt it) | Hong Kong, China; some encrypted attachments in Shanghai |
| Beijing Volcano Engine Technology Co., Ltd. (Volcano Engine) | Speech recognition (only when you choose Pocket cloud) | Recordings, an anonymous identifier | Mainland China |
| Shenzhen Tencent Computer Systems Co., Ltd. (Tencent Exmail) | Sending verification-code emails | Email address, verification code | Mainland China |
The app contains no third-party SDKs. The open-source speech models used by "My computer" transcription are downloaded by your computer from our website's download service or from the models' release page (GitHub), which see your computer's IP address when it downloads them. When the desktop app checks balances, it connects directly to DeepSeek's and Moonshot's APIs, whose own privacy policies apply.
We may disclose necessary information where the law requires it or a judicial or administrative authority lawfully demands it; we do not have the keys to end-to-end encrypted content and cannot provide a readable copy of it. If personal information has to be transferred because of a merger, acquisition or similar event, we will tell you who the recipient is and how to contact it, and require it to remain bound by this policy; if the recipient changes the purpose or manner of processing, it will ask for your consent again.
5. Where your data is and cross-border processing
The servers of the international edition are in the Hong Kong Special Administrative Region of China. Your account information, device information, operational logs and end-to-end encrypted session records (as ciphertext) are stored in Hong Kong. The international edition is meant for users outside mainland China and is not offered in app stores in mainland China; users in mainland China should use the China mainland edition.
The following processing transfers some information to mainland China:
- Pocket cloud voice: our speech service in Hong Kong sends the recording to a speech recognition provider in mainland China (Beijing Volcano Engine Technology Co., Ltd.) to be turned into text, together with an anonymous identifier only; the text comes back through Hong Kong to your phone, and we do not store recordings. If you do not want recordings to go to mainland China, choose "My computer" or "On this phone" transcription.
- Verification-code emails: the emails we send when you sign up, reset your password or reset encryption go out through Tencent Exmail in mainland China, which handles your email address and the code.
- Some encrypted attachments: attachments uploaded from a mainland China network, or from a network whose region cannot be determined, are stored in Tencent Cloud object storage in Shanghai, as ciphertext only.
All of these transfers use encrypted connections. You can exercise your rights regarding this processing with us as described in section 7.
6. How we protect it
- End-to-end encryption: content is encrypted on the device that sends it with AES-256-GCM and signed by that device (P-256 ECDSA); keys are exchanged with P-256 ECDH and derived with HKDF-SHA256. The servers can only relay and store ciphertext; they cannot decrypt it, and any change they make is detected by your devices.
- The pairing code: a new device is added to your account and gets keys only after you enter the pairing code it shows on a device that is already signed in. Pairing uses the SPAKE2 protocol: our server never gets the code and can only guess online, with a one-in-a-million chance per guess and at most 5 guesses, after which the new device has to sign in again. So even someone in control of our servers cannot slip in a device to read your content. When you remove a device, your computers switch to new keys, and the removed device cannot read anything that follows.
- We do not have your keys, and there is no recovery code. If you lose all your paired devices, you can reset encryption on a new phone with your password and an email code, and then pair all your devices again: each computer warns that encryption was reset; you confirm on the computer, then enter the pairing code it shows on your phone. The old ciphertext stored on the relay server becomes unreadable, and your computers sync your sessions again. We cannot decrypt any encrypted content for you.
- All connections between phones, computers and servers are encrypted (HTTPS / TLS).
- Passwords are stored only as salted hashes; sign-in credentials and verification codes only as hashes.
- Each account's data is isolated; attachments are kept in private object storage, download links expire after 2 minutes, and what they download is ciphertext.
- Data directories on the servers are readable and writable only by the service processes; the database is backed up daily.
- The source code of the relay server and the speech service is public, so anyone can check what they do and run their own.
- Sign-in credentials, keys and records on the phone are not included in iCloud backups; the Android version has system auto-backup turned off.
- If a personal information security incident occurs, we will tell you, as required by law, what happened, its possible impact, the measures we have taken and how you can reduce the risk, and report it to the authorities.
No system on the internet is 100% secure. Please keep your password and devices safe, and do not share your account. Enter a pairing code only when you have just signed in on a new device yourself; if you are asked for one but have not, do not enter it, and change your password right away.
7. Your rights
- Access: sessions, files, signed-in phones and linked computers are all visible in the app; the Devices page shows your paired devices and what each may do.
- Copy: end-to-end encrypted content can be decrypted only by your devices: the sessions themselves are on your computer (in your AI tools' own records), and your phone keeps a local cache. For a copy of your account and device information, email us.
- Correction: change your password in Settings → Change password; for anything else, email us.
- Deletion:
- Removing a device: remove a phone or computer on the Devices page; it is revoked at once and gets no new keys, and what it stored on the relay server is deleted. You can also choose Sign Out in the desktop app.
- If your account may be compromised, use Settings → Sign out everywhere to sign out all your phones and computers.
- Deleting your account: Settings → Delete account. It takes effect immediately once you enter your password and cannot be undone. It deletes your account, your devices and device list, and all of your ciphertext on the relay server and in object storage, and signs out all your phones and computers; we also tell any server you run yourself to delete your data. Files on your computer and your AI tools' own session records are not affected. If you cannot sign in, email us from your registered address to ask for deletion.
- Withdrawing consent: withdraw consent for voice input in Settings → Voice input; withdraw consent to this policy in Settings → Withdraw privacy consent, which signs this phone out and erases its local records and keys, after which Pocket processes no information from this phone (to delete data already on our servers, delete your account); in the desktop app you can choose Pause Sync or Sign Out at any time. Withdrawing consent does not affect processing carried out before it.
- Explanations and complaints: if you have questions about this policy or think we mishandle your personal information, email us; you can also complain to the personal information or data protection authority where you live.
We reply within 15 working days of receiving a request. To protect your account we may need to verify your identity first, for example by asking you to write from your registered email address.
8. Children
Pocket is a tool for developers and is not directed at children under 14. If you are under 14, please do not use Pocket. If we learn that we collected personal information from a child under 14 without a guardian's consent, we will delete it promptly. If you are under 18, please read this policy with your guardian.
9. Changes
When this policy changes we update this page and the date above. If a change affects your rights (for example new information collected, a new purpose, a new service provider or a change in where your data is stored), we will tell you in the app and ask for your consent again.
10. Contact
- Personal information controller: Alex Lay
- Email: service@pocketcli.net
- Website: pocket.pocketcli.net