The 30-second version
We collect as little data about you as we can. We don't share it with anyone. We delete it when you ask. We don't run tracking ads. We don't profile you.
What we collect
Newsletter subscribers
When you subscribe to the newsletter, we store: your email address, the timestamp of your opt-in, and the source (which page you subscribed from). That's it.
We use this data to: send you the newsletter, and only the newsletter. We never share your email with sponsors or third parties.
Accounts and Pro members
When you create an account, we store: your email, the name you give (optional), a hash of your password or the link to your Google account if you sign in with Google, your subscription status and plan, and the Stripe customer ID needed to manage billing. Each sign-in session keeps its token, its expiry, and the IP address and browser of the sign-in, so you can be signed out of a session you do not recognise.
We also keep what you ask the service to do: the components you watch, the webhook URLs you add, the alerts we sent you, and for each scan the components and versions found and the CVEs that hit them (not the file you pasted).
We do NOT store payment card details: Stripe handles them on its own infrastructure.
Site visitors
We measure traffic with Datalenk (datalenk.com), a cookieless analytics script operated by GTA Go To Agency SAS, a French company. It runs here in its default mode and writes nothing on your device (no cookie, no local storage). It records the page you view, the page you came from, your browser language and window size; its server also receives your IP address and browser user agent, which it uses to group the pages of one visit. It does not run when your browser sends Do Not Track. Its data is hosted in Germany by Hetzner and is never stored outside the European Union. Detailed visit data is kept for 25 months, then permanently deleted.
A partner link (an address starting with /go/) records the partner, the page it was on, your browser user agent, your country when our CDN provides it, and a one-way hash of your IP address, never the address itself.
We do not use Google Analytics, Facebook Pixel or ad-network trackers.
What we don't collect
- Your name (unless you tell us)
- Your physical address
- Your phone number
- Browsing history outside this site
- Anything from device sensors / cameras / microphones
Cookies
We set two cookies:
NEXT_LOCALE: set by the site's language routing (the site is in English only). A session cookie, no third party access.- The sign-in cookie of our authentication library (better-auth), only if you sign in. Required to keep you signed in; it expires after 30 days. No third parties.
That's it. No tracking cookies, no advertising cookies, no analytics cookies.
Where your data lives
- Site and database: servers rented from Hetzner Online in Nuremberg, Germany (EU).
- Network: Cloudflare sits in front of the site and sees each request, your IP address included, to deliver it.
- Email delivery: Amazon Web Services (SES).
- Analytics: Datalenk, operated by GTA Go To Agency SAS (France), hosted by Hetzner in Germany, never stored outside the EU.
- Stripe customer data (Pro tier): Stripe infrastructure, US-based but DPF-certified for EU data transfers.
How long we keep data
- Newsletter subscribers: until you unsubscribe (then deleted within 30 days)
- Pro members: until you delete your account or cancel + 90 days
- Server logs: 30 days, then deleted
- Detailed visit data (Datalenk): 25 months, then permanently deleted
- Partner-link clicks: the hashed record described above
Your rights (GDPR)
If you're in the EU/EEA (or UK), you have the right to:
- Access the data we hold about you: email [email protected]
- Correct any inaccurate data
- Delete your data (we comply within 30 days unless legal obligations require retention)
- Port your data to another service (we provide a JSON export)
- Object to specific processing
- Lodge a complaint with your data protection authority (CNIL in France, ICO in UK, etc.)
Children
PocketClaw is not directed at children under 16. We don't knowingly collect data from children. If you believe a child has subscribed, email us and we'll delete the record immediately.
Changes to this policy
When we update this policy, we'll note it in the changelog and (if the change is meaningful) email subscribers. We won't make material changes retroactively to data we collected under prior terms.
Who we are
PocketClaw is published by Go To Agency SAS, a French simplified joint-stock company with a share capital of €1,000, 9 rue Jean-Jacques Rousseau, 21000 Dijon, France (RCS Dijon 944 980 762, VAT FR25944980762, phone +33 7 56 96 20 95). Publication director: Robin Monteiro. Go To Agency is the controller of the personal data described in this policy.
Contact
Privacy questions, data requests, complaints: [email protected]. We respond within 5 working days.
See also: terms, affiliate disclosure, about.