pocket.ceo Privacy Policy

Version: 1.3 · Effective date: 2026-10-12

This Privacy Policy explains how the personal data of users of the pocket.ceo service is processed. pocket.ceo is a platform in which each user is paired with an AI Boss — an AI-based assistant acting as their “boss” and accountability partner. This document constitutes an information notice within the meaning of Article 13 of Regulation (EU) 2016/679 (the “GDPR”) and fulfils the information obligations under Polish law on the provision of electronic services.

Please read the whole document carefully — in particular Section 6 (Transfers outside the EEA) — because the service currently relies on AI model providers whose infrastructure is located outside the European Economic Area (in the USA).

1. Data controller

The controller of your personal data is VALITY Łukasz Wątroba, a sole proprietorship (jednoosobowa działalność gospodarcza, JDG) with its registered seat at Kretowskie 44, 43-436 Górki Wielkie, Poland, NIP (Polish tax ID): 5472086879, REGON (Polish business register no.): 24361592800000, registered in CEIDG (the Polish Central Register and Information on Economic Activity).

Controller contact details:

• Postal address: Kretowskie 44, 43-436 Górki Wielkie, Poland
• Data-protection e-mail address: hi@pocket.ceo

Data Protection Officer (DPO): The controller has not appointed a Data Protection Officer, as appointing one is not mandatory at this stage — the processing does not involve large-scale systematic monitoring within the meaning of Article 37 GDPR. For all data-protection matters, please contact: hi@pocket.ceo.

Representative in the European Union (Article 27 GDPR): Not applicable. An EU representative is not required because the controller is established in Poland — that is, within the European Economic Area.

2. Scope of this Policy

This Policy covers data processing within:

• the pocket.ceo web application — login, onboarding, starting a free Trial or selecting and paying for a plan (subscription), linking the Account with a messenger, and account settings and a usage overview;
• the communication channels offered for linking with an Account: Telegram, Discord and WhatsApp;
• the pocket.ceo website — including the site analytics described in Section 7;
• AI memory and inference processes running in the background (memory processing and consolidation, delivery of proactive messages).

3. What data we process

The service relies on the AI Boss’s persistent memory, so the scope of processed data is broader than in a typical application. We process the following categories of data:

3.1. Account data

Name, e-mail address, profile picture, time zone and language preferences. An Account is created by signing in via GitHub or Google (OAuth): from the sign-in provider we receive your e-mail address and, where available, your name and profile picture; we also process your account identifier at that provider and the tokens issued within the OAuth flow. We also process the messenger identity of the channel linked to your Account: your user id and username on Telegram or Discord, or your phone number or opaque recipient identifier and available profile name on WhatsApp. We also store your proactive-contact setting and, for WhatsApp, the reply deadline and the number you contact, so we can respond within the period the messenger permits. This data is stored in the platform database (tokens and other confidential data in encrypted form).

Providing messenger data is optional, but necessary to use the chosen channel. You may choose another supported messenger.

3.2. Conversation content (transcripts)

All chat messages, task and project content, and “proofs” of completed commitments. Stored in an isolated data store assigned to your account. Voice notes — both yours and the AI Boss’s — are stored only as text, like any other message: we transcribe the ones you send and keep no audio.

3.3. AI memory (long-term)

So that the AI Boss can play its role, it maintains persistent memory built from your interactions. It includes, among other things, records and summaries of conversations, retained information about you, and the context and overall tone of your relationship. This memory serves to personalise support, tone and proactive messages and — taken together — constitutes profiling within the meaning of the GDPR. See Section 9 (Profiling and automated decisions).

3.4. Tasks, projects and proactive messages

Commitments, schedules, and scheduled reminders and proactive messages (follow-ups). Used for accountability tracking and delivery of proactive notifications.

3.5. Attachments

Files you upload (images, PDFs). Stored in Cloudflare R2 object storage (a bucket in the European Union) and analysed by an AI model through the AI inference provider (see Sections 5 and 6).

3.6. E-mail delivery

For transactional messages necessary to provide the Account service — welcome, trial-started and trial-ended e-mails — we pass to Resend the recipient e-mail address, the transactional message content (including the Trial end date where applicable), and technical identifiers that ensure the message is sent only once. These messages concern the Account lifecycle and are not marketing. We do not send conversation content, the AI Boss’s memory, or payment-card data to Resend.

3.7. Technical data, server logs and cookies

Session identifiers and cookies; server logs — technical records of how the application handles requests (time, type of operation, response status, errors), linked to internal account identifiers. Logs contain no conversation content and no data that identifies you directly, such as your name, e-mail address or phone number; the hosting provider’s access logs may also record the IP address of the connection. We also process cookieless audience-measurement data for the pocket.ceo website (page viewed, referring page, type of browser, operating system and device, country, page load performance) — see the Cookie Policy.

3.8. Special categories of data (sensitive data)

The service does not require you to provide special categories of data within the meaning of Art. 9 GDPR (e.g. health, beliefs, sexual orientation, biometric data). However, given the nature of the service (conversations about personal and professional goals with persistent memory), you may voluntarily disclose such data in the content of your messages. The service is not intended to process such data, does not require you to provide it, and we advise against entering it — in particular data you do not wish to entrust to the AI inference provider (a provider located in the USA; see Section 6). If you nonetheless knowingly include special-category data in your conversations, you do so on your own initiative; we do not use it for purposes other than providing the service, and you may delete it at any time by clearing the AI Boss’s memory or by asking us to delete the data (see Section 10).

4. Purposes and legal bases for processing

We process data for the following purposes and on the following legal bases:

What we do NOT do with your data:

• we do not sell your personal data;
• we do not use your conversation content for advertising profiling;
• we do not disclose conversation content for third-party marketing.

For the use of user content to train AI models, see Section 6.3.

5. Recipients of data and their roles

To provide the service we use external providers. Some process data on our behalf; messengers also process data for their own services under their own terms and privacy policies. The table below lists recipients, their roles and infrastructure locations.

Note: for authentication we use our own mechanism running on our own infrastructure (it is not a third-party SaaS provider).

Why the infrastructure providers are not named individually. The AI model executing a single request is hosted by an entity selected dynamically, at the moment the request is sent, from among those that satisfy the zero-retention and no-collection policy described above. That set changes over time, which is why we identify it as a category of recipients within the meaning of Article 13(1)(e) GDPR, and the current list of the specific entities is available on request at hi@pocket.ceo.

Providers that process data on our behalf do so under data processing agreements (Article 28 GDPR); the bases for transfers outside the EEA are set out in Section 6.

6. Transfers outside the European Economic Area (EEA)

This is a key section of this Policy. Providing the service requires transferring data to third countries.

6.1. Transfers to the USA — AI inference and other providers

All AI model calls within the service — the AI Boss’s chat responses, proactive messages, background memory processing, the creation of vector representations of memory (embeddings), attachment analysis, and the transcription and synthesis of voice notes — are performed by a single AI inference provider: OpenRouter (USA). OpenRouter does not host models itself: it routes every request to an infrastructure provider, which executes it and returns the result. That provider is selected separately for each request, and its infrastructure may be located in the USA or in another third country.

Transfers of data to OpenRouter and to the infrastructure providers acting as sub-processors are based on Standard Contractual Clauses (SCC) approved by the European Commission (Art. 46(2)(c) GDPR). A copy of the clauses used and the current list of the entities used are available on request (contact: hi@pocket.ceo).

Every request sent to an AI model is subject to a fixed routing policy, enforced on our application’s side:

• zero data retention (Zero Data Retention, ZDR) — a request may go only to an infrastructure provider committed to not storing the transmitted content beyond the time necessary to execute the request; the one exception is speech synthesis, described below;
• prohibition on collecting and using content — a request may go only to a provider committed to not collecting the transmitted content and not using it for its own purposes, including to train or fine-tune models;
• disabling the router’s additional services — the request is not enriched or processed by the provider’s ancillary services.

This policy is part of the application code and cannot be weakened by an individual call: a request that cannot be covered by it is not sent by the application. If no infrastructure provider meeting these conditions is available for a given model, the request fails with an error — it is not served on weaker terms.

For completeness, we state the limit of that mechanism: the classification of individual infrastructure providers as meeting the above conditions comes from the router operator and rests on commitments made by those providers, not on our separate verification of each of them. The mechanism narrows the set of recipients to those who have made such commitments — it does not replace their own responsibility for honouring them.

Please note that these measures reduce but do not eliminate the risk associated with possible access by US public authorities to data during its processing, and they do not constitute an adequacy decision within the meaning of Art. 45 GDPR. Language-model inference requires processing content in cleartext at the provider executing the request.

Internet search is performed by Google Search (USA) — it receives only the content of the search query composed by the model, with no transcripts, AI Boss memory or account data. Search is not covered by the zero-retention policy described above — it operates under the terms of the Google service; the transfer basis is listed below.

Speech synthesis — turning the text of the AI Boss’s voice notes into audio — is performed by a Google model (USA) that is available only on Google’s own infrastructure. It receives the text of the voice note and nothing else about you: no other conversation content, AI Boss memory or account data. Google offers no zero-retention option for this model, so speech synthesis is the one exception to zero data retention; the prohibition on collecting and using content, including to train models, still applies. Under the terms of its paid services, Google logs these requests for a limited period, solely to detect and prevent violations of its usage policy, and does not use them to improve its products.

Other providers with infrastructure in the USA rely on the following transfer mechanisms:

• Google — the EU–US Data Privacy Framework (DPF): Google LLC holds an active DPF certification (https://policies.google.com/privacy/frameworks);
• Stripe — SCC and/or DPF;
• Resend — SCC + DPF; Resend account data is stored in the USA. The configured eu-west-1 sending region controls sending infrastructure and does not provide EU account-data residency;
• GitHub (Microsoft) — SCC and/or DPF;
• Cloudflare — SCC and/or DPF; the bucket storing attachments is hosted in the EU, while audience measurement of the website runs on Cloudflare’s data centres in the US and Europe.

Messengers. Telegram, Discord and WhatsApp may process messages and identifiers outside the EEA. Their privacy policies and terms describe the countries and transfer safeguards; links are in Section 5. Telegram describes standard clauses for transfers within its group; Discord describes SCC and adequacy decisions. WhatsApp’s Data Processing Terms incorporate a data-transfer addendum where WhatsApp Ireland acts as processor.

Processing and storage in the EU. The isolated user data stores and the platform database (Turso) are hosted in the European Union (Ireland) — storage in the database layer does not involve a transfer to a third country. Attachments are stored in a Cloudflare R2 bucket in the European Union. The server application (API) runs at the hosting provider in an EU region. The providers of these layers are, however, established in the USA and may access data in the course of operating and maintaining the service, so Standard Contractual Clauses (SCC) remain the transfer basis.

6.2. Background memory processing

Background memory processing — the consolidation and processing of your memory (including the extraction of generated memory from your conversations) and the creation of vector representations of memory content, which enable related information to be retrieved — is performed by the same AI inference provider and under the same rules as interactive chat (Section 6.1). This means that transcript and memory content — not only vector representations — is sent to the AI model as part of background memory processing.

6.3. Training models on your content

Content transmitted for AI inference — conversations, memory, tasks and attachments — is not used to train or fine-tune AI models. The router operator commits not to use it for model training, and the policy described in Section 6.1, enforced on every request, narrows the set of infrastructure providers to those that have made the same commitment; a request that cannot be covered by it is not sent.

For other recipients, the rules set out in their terms and data processing agreements apply. We do not pass conversation transcripts, AI Boss memory or account data to Google Search — only the content of a single query reaches it.

7. Cookies and analytics

A detailed list of cookies is set out in the Cookie Policy. In short:

• authentication session cookie (better-auth.session_token, first-party) and short-lived technical cookies for the OAuth login flow and for linking a messenger — necessary to log in, to maintain the session and to link a channel; they do not require consent (technical cookies);
• site language — an entry in the browser’s local storage that remembers the language of the website, so it opens in that language and does not redirect you again;
• no analytics cookies — we measure the website’s audience without cookies: nothing is stored on or read from your device, there is no fingerprinting, and you are not tracked over time. The measurement runs on selected public pages only, never in the signed-in area, and is provided by Cloudflare as our processor (Section 5). Basis: our legitimate interest in aggregate statistics (Art. 6(1)(f) GDPR).

8. Data retention period

The automated memory housekeeping covers only system-generated memory records and does not delete conversation transcripts. Messenger providers retain data under their own applicable terms and policies; this is separate from our retention periods.

9. Profiling and automated decisions

So that the AI Boss can play its role, it builds a persistent profile of the user from your memory and analyses your behaviour, commitments and progress to adjust tone, content and proactive messages. This constitutes profiling within the meaning of the GDPR.

Significance and consequences: profiling serves to personalise support (accountability, coaching, reminders) and affects how the AI Boss communicates with you and when it initiates contact.

No solely automated decisions producing legal effects: the service does not make decisions about you based solely on automated processing that would produce legal effects concerning you or similarly significantly affect you within the meaning of Art. 22 GDPR. AI responses and notifications are supportive and informational in nature.

Your rights: because the AI Boss’s memory and profile are necessary to provide the requested service (Art. 6(1)(b) GDPR), we provide control over profiling primarily through the ability to clear the entire AI Boss memory or delete your account (which removes the associated memory) — as part of the right to erasure (Art. 17 GDPR). You may also exercise your other rights, including requesting deletion of your data, by contacting us (see Section 10). The right to object (Art. 21 GDPR) applies instead to processing based on legitimate interest (service security, abuse prevention).

10. Your rights

You have the following rights under the GDPR:

• Right of access to your data (Art. 15);
• Right to rectification (Art. 16);
• Right to erasure — the “right to be forgotten” (Art. 17);
• Right to restriction of processing (Art. 18);
• Right to data portability (Art. 20) — in a structured, commonly used, machine-readable format;
• Right to object to processing, including profiling, based on legitimate interest (Art. 21);
• Right to withdraw consent at any time (without affecting the lawfulness of processing before withdrawal) — where consent is the basis;
• Right to lodge a complaint with a supervisory authority — in Poland: the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw.

How to exercise your rights: send your request to the e-mail address given in Section 1. We will respond without undue delay and within one month of receiving the request; where the matter is complex or there are numerous requests, this period may be extended by a further two months, of which we will inform you.

Account deletion: when your account is deleted, account data is cascade-deleted and all isolated User data is deleted from the Turso infrastructure. Temporary messenger copies follow the retention rules in Section 8. Attachments stored in Cloudflare R2 expire automatically 90 days after upload. Content previously sent for AI inference does not require separate deletion: under the policy described in Section 6.1 it is not stored at the provider beyond the time needed to serve the individual request. The exception is the text of the AI Boss’s voice notes sent for speech synthesis (Section 6.1), which Google may keep for a limited period under its own terms.

Data export / portability: you may request a copy of all your data — transcripts, the AI Boss’s memory, tasks, projects, proactive messages, and account data — by contacting hi@pocket.ceo. The copy is provided in a commonly used, machine-readable format within one month of your request.

11. Data security (Article 32 GDPR)

We apply, among others, the following technical and organisational measures:

• Isolation of individual users’ data — each user’s data is kept isolated; one user’s data contains no other users’ data;
• Databases located in the EU — the databases are hosted in the European Union (Ireland), with no transfer of the database layer to a third country;
• Content protection at the AI providers, enforced in code — see Section 6.1;
• Session management — sessions expire after a defined period or on logout;
• Validation and filtering of user content;
• Access control over application configuration and confidential data;
• Minimised logging — server logs contain no conversation content (see Section 3.7);
• Authentication of the messenger integration;
• data in transit secured with TLS;
• Encryption at rest — stored data is encrypted at rest by default on the Cloudflare R2 and Turso side.

12. Use of the service by minors

The service is not directed at persons under the age of 18 and we do not knowingly collect such persons’ data. If we learn that data of a person below the required age has been provided to us without the required basis, we will delete it without undue delay.

13. Users in the United States, including California

The service is also offered to users in the United States. This Policy applies to every user, wherever they live: the data we collect, why, who receives it and for how long are described in Sections 3–8, and the rights in Section 10 — including access, correction, deletion and portability — are available to everyone, including California residents under the California Consumer Privacy Act (CCPA) as amended by the CPRA. We do not sell personal information and do not share it for cross-context behavioral advertising; the website uses no advertising or analytics cookies. We will not treat you differently for exercising your rights. Requests may be sent to hi@pocket.ceo, also by an authorized agent acting on your behalf.

14. Changes to this Privacy Policy

We may update this Policy, in particular where there are changes in law, in the scope of the service, in providers (subprocessors) or for security reasons. We will inform you of material changes in a manner appropriate to the nature of the change (e.g. an in-app notice or e-mail), with reasonable advance notice. The current version is always available at https://pocket.ceo/legal/privacy-policy.

15. Contact

For any matters concerning personal data protection, contact us at: hi@pocket.ceo.