--- title: "Privacy Policy — PocketRocket" description: "What PocketRocket stores, where and why—in iCloud, on the relay, in update checks and on this website." canonical: https://pocketrocket.click/en/privacy/ lang: en updated: 2026-10-27 --- Last updated October 27, 2026 # Privacy Policy What personal data aveneo processes in connection with PocketRocket, PocketRocket Host, this website and our support channels — why, on what legal basis and for how long. ## In short. ### This website It uses Google Analytics, which stores cookies in your browser. Spam protection for our forms works without cookies. ### Your screen, sound and input They travel end-to-end encrypted between your device and your Mac. We don’t store them, and the relay passes them on in a form it can’t read. ### Your Mac computers and connections They’re stored in your iCloud and sync between your devices. aveneo has no access to them. ### Your Mac password If you save it, it’s stored on your devices and in your iCloud, and it reaches your Mac only over an encrypted connection. ## Who is responsible The controller of the personal data described in this policy is **aveneo Dawid Morzyński**, ul. Dmowskiego 124/2, 60-124 Poznań, Poland, tax ID (NIP) 7792268011, REGON 300989958 (“aveneo”, “we”) — the publisher of the PocketRocket and PocketRocket Host apps and of the pocketrocket.click website. For anything about your personal data, write to [support@pocketrocket.click](mailto:support@pocketrocket.click) or to the postal address above. We have not appointed a data protection officer. This policy covers the pocketrocket.click website, the contact form and our handling of support requests, the idea board (on this website and at feedback.pocketrocket.click), the PocketRocket app (iPhone, iPad, Apple Vision Pro, Mac), PocketRocket Host (Mac) and the servers these apps connect to. ## Purposes, legal bases and retention An overview is below; each area is described in more detail in the sections that follow. Legal bases refer to Article 6(1) of the GDPR. | Purpose | Data | Legal basis | How long | | --- | --- | --- | --- | | Providing the website and services, and keeping them secure | IP address, time, requested address, referring page, browser or app information (server logs) | (f) legitimate interests: running the services and keeping them secure | Web server logs — 14 days; technical logs of server applications are overwritten automatically once they reach a size limit | | Website visit statistics (Google Analytics) | Cookie identifiers, pages visited and on-page events, device and browser information, approximate location | (f) legitimate interests: understanding how the website is used and improving it | Cookies — up to 2 years; data in Google Analytics — no longer than 14 months | | Replying to your message and handling your request | Name (optional), email address, topic and message, language and page address, IP address, browser information, further correspondence | (f) legitimate interests: answering questions; (b) where the request concerns your use of our services | Until the matter is closed, then until any claims that may arise from it are time-barred | | Idea board | Idea title and description, name (optional, public), email address (not public), anonymous voter identifier, votes and comments | (b) providing the idea board under the terms of use; (f) moderation and protection against abuse | Until the idea is deleted, you ask us to remove your data, or the board is closed | | Relay and app updates | IP addresses and ports, hashed Mac identifier, public key, app and system version | (b) providing the services you use in the apps; (f) security | Connection data — only in the server’s memory; logs — as in the first row | | Subscriptions | One-way hash of the original transaction identifier, plan, environment, subscription dates and status, refunds, fingerprints of device public keys | (b) providing the plan you’ve bought; (f) protecting the relay from abuse | 60 days after the subscription expires or last changes; a device — 30 days after its last connection through the relay | | App diagnostics and performance statistics | Information about the course and quality of connections, performance and errors, app and system version, device model, technical identifiers, IP address | (f) legitimate interests: running, optimizing and developing the apps; (a) where the app asks for your consent | For as long as needed to analyze how a given app version performs, no longer than 24 months; after that, aggregated statistics only | | Establishing, pursuing and defending legal claims | The data needed in the matter | (f) legitimate interests: protecting our rights | Until the claims are time-barred | | Complying with legal obligations, such as handling data protection requests | The data needed to comply | (c) legal obligation | For as long as the law requires | ## This website pocketrocket.click runs on our server in Warsaw, Poland (OVHcloud). Like any web server, it receives your IP address, the time of the request, the page address, the referring page and information about your browser. We keep these in server logs to run the website and keep it secure. ### Google Analytics This website uses Google Analytics 4, a service of Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). When you open the website, the Google Analytics script stores cookies in your browser (including **_ga** and **_ga_***, valid for up to 2 years) and sends Google information about the pages you visit and events on the page (such as starting to fill in a form), about your device and browser, and your approximate location derived from your IP address. This gives us aggregated visit statistics. Google may also process this data in the United States (Google LLC) — see “Transfers outside the EEA”. Google’s privacy policy: [policies.google.com/privacy](https://policies.google.com/privacy). You can block or delete cookies in your browser settings, or install Google’s opt-out browser add-on: [tools.google.com/dlpage/gaoptout](https://tools.google.com/dlpage/gaoptout). The website also works without these cookies. ### Browser storage The website stores the language you choose in your browser (localStorage) and, if you vote on the idea board, an anonymous voter identifier and the numbers of the ideas you voted for. None of this goes to Google; the voter identifier is sent only to our server when you vote. All other resources of the website — fonts, images and scripts — come from our server. ## Contact form and support requests When you send a message through the contact form, you give us your name (optional), email address, topic and message, and the form automatically adds the language and address of the page you write from, your IP address and information about your browser. We treat messages sent directly to support@pocketrocket.click the same way. Your message goes to the support@pocketrocket.click mailbox (OVHcloud) and to FreeScout, the help desk system running on our server in Warsaw. We use this data to reply and to handle your request. The form protects against spam without cookies: your browser solves a small computational puzzle (ALTCHA), and your IP address is used to limit the number of messages — in the server’s memory, for no longer than a day. We keep the correspondence until the matter is closed, then until any claims that may arise from it are time-barred. Backups of the help desk database are overwritten after 14 days. ## Idea board The idea board is available on this website (Support › Ideas) and at feedback.pocketrocket.click. It runs on Fider software on our server in Warsaw. When you suggest an idea, you give us its title and description, your email address and, optionally, your name. Every idea is reviewed first. Once approved, the title, description and name (or “Anonymous”) are public. Your email address is not published — Fider uses it to notify you about your idea, for example when its status changes. You can vote without signing in. When you vote for the first time, our server creates an anonymous voter identifier, stored in your browser, and a matching anonymous Fider account. We don’t link it to your name or email address. Your IP address is used to limit the number of votes and new identifiers — in the server’s memory, for no longer than a day. At feedback.pocketrocket.click you can sign in with a link sent by email, for example to comment. Fider then stores a session cookie in your browser, which signing in requires. Fider may also fetch your avatar from Gravatar (Automattic Inc.) by sending it a hash of your email address. We keep ideas, comments and votes for as long as we run the board, unless we delete them earlier or you ask us to delete them or your data. ## PocketRocket and PocketRocket Host The apps don’t require an aveneo account — your devices and Mac computers recognize each other through your Apple Account. They contain no advertising tools. The picture and sound of your Mac, keyboard, mouse, touch and clipboard — and, if you use them, the camera and microphone of your device — travel between your device and your Mac end-to-end encrypted (ChaCha20-Poly1305). We don’t store them and don’t have the keys they are encrypted with. Your device tells your Mac its name and identifier, and the PocketRocket app sends your Mac diagnostic information about the connection. PocketRocket Host keeps it in logs on your Mac (in Library › Logs). On your local network, PocketRocket Host announces itself over Bonjour, so devices on the same network can see the name of your Mac and its local network addresses. To allow connections from outside your local network, PocketRocket Host may ask your router to open a port (NAT-PMP or UPnP). The PocketRocket app may check for internet access by connecting to an Apple server (captive.apple.com). ## Diagnostics and performance statistics The apps may send aveneo diagnostic data and performance statistics, such as information about the course and quality of connections (latency, throughput, lost packets, connection type), performance, errors and crashes, as well as the app and system version and the device model. We use it to find bugs, optimize picture and connection quality, and develop the apps. This data doesn’t include the content of your sessions — picture, sound, what you type, clipboard contents, or camera and microphone input — or passwords. It may contain technical identifiers, such as a random installation identifier or a hashed Mac identifier, and our server receives your IP address when the data is sent. The legal basis is our legitimate interest in running and developing the apps (Article 6(1)(f) GDPR). Where the app asks for your consent to share this data, the legal basis is your consent (Article 6(1)(a)), which you can withdraw at any time in the app’s settings. We keep detailed data for as long as needed to analyze how a given app version performs, and no longer than 24 months. After that we may keep only aggregated statistics that don’t identify anyone. ## iCloud PocketRocket and PocketRocket Host use your iCloud account so that your devices can find your Mac computers and trust them without a separate account. iCloud stores, among other things, the name of your Mac, its identifier and public keys, your list of connections (name, address, settings, a thumbnail of the last screen, date of the last connection) and — if you save it — the password of your Mac. A copy of the list of connections is also kept on your device. This data is stored in your iCloud account and syncs between devices signed in to the same Apple Account. Apple processes it under its own terms (Apple Distribution International Ltd., Ireland). aveneo has no access to it. You can delete it by removing connections and Mac computers in the app. ## Unlocking your Mac If you save the password of your Mac in the PocketRocket app, it is stored on your devices and in your iCloud. The app uses it only after Face ID, Touch ID, Optic ID or your device passcode confirms it’s you, and sends it to your Mac only over an encrypted connection. PocketRocket Host keeps it in memory only for the unlock attempt. aveneo has no access to this password. ## The relay When your device can’t reach your Mac directly, traffic goes through our relay, relay.pocketrocket.click, on a server in Warsaw. PocketRocket Host registers with it by sending a hashed Mac identifier, its public key and its public IP address and port. The content of the connection is end-to-end encrypted — the relay passes it on without the keys to read it. It does see technical data: the IP addresses and ports of both sides, when the connection happens and how much data flows. The relay keeps connection information only in memory. Its technical logs may contain the hashed Mac identifier and IP addresses and ports; they are overwritten automatically once they reach a size limit. ## Subscriptions Subscriptions to the PocketRocket app are sold and billed by Apple. We don’t see or store your payment details, your name, email address or Apple Account. The app checks your subscription on your device through the App Store; the Own Infrastructure plan is checked only there. The Cloud plan is verified by our relay. When you connect through it, the app sends the relay a record of your latest transaction signed by Apple (JWS). It contains, among other things, the original transaction identifier, the product, the environment, the purchase and expiry dates, and the app account token (appAccountToken) — a random-looking identifier that the app derives from a purchase key kept in your iCloud Keychain; it doesn’t contain your name, email address or Apple Account. Together with the record, the app sends the public part of that key and a signature, so that the relay can link the purchase to your devices. The relay checks Apple’s signature, the product, the environment, the expiry date and whether the transaction has been refunded or revoked. It doesn’t store the record itself or the app account token. For each subscription, it keeps on the server in Warsaw: a one-way hash of the original transaction identifier, the plan, the environment, the purchase, expiry and grace period dates, the renewal status, refunds and their dates, and fingerprints of the public keys of the devices that use the subscription, with the time of their first and last connection. It keeps the number of sessions in progress only in memory. Apple also sends our server notifications about changes to subscriptions of both plans, such as purchases, renewals, plan changes, expiry, refunds and revocations (App Store Server Notifications). We use them only to update the stored state of the subscription described above⁠—for Own Infrastructure, without fingerprints of device keys⁠—and we keep the identifier of each notification for 14 days to ignore duplicates. The legal basis is the performance of the contract — providing the plan you’ve bought (Article 6(1)(b) GDPR) — and our legitimate interest in protecting the relay from abuse (Article 6(1)(f) GDPR). We remove a device from the list after 30 days without a connection through the relay. We delete the data of a subscription 60 days after it expires, or after its last change if that comes later. The relay’s technical logs may contain a short tag derived from the hash; they are overwritten as described under “The relay”. ## PocketRocket Host updates PocketRocket Host checks for updates at launch and every 24 hours by downloading a file from update.pocketrocket.click (using Sparkle), and installs updates automatically. The server receives your IP address and the app version. Sparkle doesn’t send a profile of your system. You also download the PocketRocket Host installer from the same server, including from the PocketRocket app on a Mac. The update server’s logs (IP address, time, file downloaded) are used to run the service and keep it secure, and are kept like the website logs. ## Downloads and the App Store The PocketRocket app is currently in testing on TestFlight. Apple handles the download under its own terms. If you send feedback or a crash report through TestFlight, Apple passes it to us together with any information you choose to include. PocketRocket Host is a disk image signed and notarized by Apple that you download from update.pocketrocket.click. ## Who receives data Data may be received by our authorized staff and by organizations that process it on our behalf or on their own account: - OVHcloud — provider of the server in Warsaw that runs the website, the relay, the update server, the help desk and the idea board, and of the support@pocketrocket.click mailbox (processor); - Google Ireland Limited — Google Analytics (processor; data may be transferred to Google LLC in the US); - Apple Distribution International Ltd. — iCloud, the App Store (including the sale of subscriptions) and TestFlight (an independent controller, under Apple’s terms); - Automattic Inc. (US) — Gravatar, limited to a hash of the email address of idea board users; - authorities and other bodies entitled by law — where the law requires us to disclose data. We don’t sell personal data. ## Transfers outside the EEA Google, Apple and Automattic may process data in the United States. Such transfers rely on the European Commission’s adequacy decision of 10 July 2023 (EU-US Data Privacy Framework) for organizations it covers, or on standard contractual clauses adopted by the European Commission. We’ll tell you more about the safeguards on request. ## Your rights You have the right to access your data and get a copy, to have it rectified, erased or its processing restricted, to data portability for data processed under a contract, and to object to processing based on legitimate interests — including the Google Analytics statistics. Send your request to [support@pocketrocket.click](mailto:support@pocketrocket.click). We’ll reply without undue delay and within one month at the latest; in justified cases this period may be extended as Article 12 of the GDPR allows. We may ask for information to confirm that the request comes from you. You can also lodge a complaint with the President of the Personal Data Protection Office in Poland (ul. Stawki 2, 00-193 Warszawa, [uodo.gov.pl](https://uodo.gov.pl)) or with the supervisory authority in the EU country where you live or work. ## Other information Providing data is voluntary. Without an email address, however, we can’t reply to your message or accept your idea. We don’t make decisions based solely on automated processing that produce legal effects for you or similarly significantly affect you. Automatic limits on messages and votes serve to protect against abuse. We use technical and organizational measures appropriate to the risk, including encrypted connections (TLS), end-to-end encryption in the apps and restricted access to our servers. ## Changes to this policy We may update this policy, for example when the apps, the services or the law change. We publish the new version on this page with the date of the last change. The Polish version is binding; versions in other languages are translations. ## Leave your Mac at home. Take it everywhere. 1. Install PocketRocket Host On the Mac you want to reach. It lives in the menu bar. 2. Get the PocketRocket app On iPhone, iPad, Apple Vision Pro or another Mac. 3. Tap your Mac Use the same Apple Account, and your Mac shows up on its own. PocketRocket Host needs a Mac with Apple silicon and macOS 26.1 or later. The PocketRocket app is coming soon to the App Store. ## One Mac. Four ways in. - [iPhone Your Mac fits in your pocket.](https://pocketrocket.click/en/iphone/) - [iPad Your Mac, tailored to iPad.](https://pocketrocket.click/en/ipad/) - [Apple Vision Pro A world away. Right in front of you.](https://pocketrocket.click/en/apple-vision-pro/) - [Mac Home is where your Mac is.](https://pocketrocket.click/en/mac/) [**And on your Mac: PocketRocket Host ›**The menu bar app for the Mac you connect to.](https://pocketrocket.click/en/host/)