Privacy Policy
Updated: September 18, 2026. This policy describes PocketHook 1.4 and the related optional services.
Your device, iCloud and your server#
PocketHook connects to the HTTPS endpoint you configure. Messages, the conversation identifier and attachments you choose to send go to that server. Its operator controls processing, logs, retention, backups and any onward transmission to AI providers or other integrations. PocketHook does not operate a mandatory intermediary for these requests.
Authentication tokens are stored per profile in Apple Keychain, accessible to PocketHook’s Share Extension through its access group. When server sync is enabled, the server URL and token also sync together through end-to-end encrypted iCloud Keychain on devices using the same Apple Account. iCloud Keychain must be enabled on those devices. Tokens are never placed in CloudKit records or the replication journal. Profiles that have never enabled sync keep device-local credentials. You can optionally sync server names, emojis, addresses, connection settings, conversation identifiers, delivered messages and saved links through your private iCloud database. The catalog is available on your devices; each device chooses which profiles to activate before downloading their additional histories. Local-only profiles, active selection, drafts, pending sends and delivery receipts remain on the device. The original profile retains its previous SwiftData/iCloud sync and shared conversation identifier; disabling its new profile sync does not disable its original conversation sync. If iCloud is unavailable, local data remains available.
QR setup sends a temporary, single-use code to the server named in the invitation over HTTPS and receives its configuration and credential. Agent Server invitations expire after five minutes; the QR does not contain the permanent token. Anyone who redeems a valid invitation receives access as the existing server owner. It does not create an isolated user account.
Removing a profile from this device disconnects it and removes its local credentials while preserving its cloud copy and historical local records. Turning sync off keeps a local credential copy and leaves the shared Keychain item available to other devices. Remove from iCloud removes that shared credential item and the additional profile’s cloud history zone and stops that server sync on other devices while preserving their local copies. It does not delete the original conversation’s legacy iCloud history or data held by the connected server.
Images selected as chat wallpapers are stored on the device and, when you enable iCloud for that server, sync through CloudKit with bubble colors and opacity. Choosing or applying a wallpaper does not attach it to messages or send it to the server or its AI provider. Applying a wallpaper to all servers preserves each profile’s sync choice.
Photos, files and permissions#
Pasting an image adds it to the composer; sending it uploads it to the selected server. Camera, photo library and sharing permissions let you select content for the app. A local photo link queries your device’s library; opening that link alone does not upload its photos. When you send a selected photo or file, its contents and display filename go to your configured server. Agent Server can send images and extracted document text to the model provider selected by its operator.
Agent Server 0.8.0 requires authentication for uploading and downloading attachments. Files expire after 30 days by default, configurable by the operator, and expired files are removed at startup or during periodic cleanup. This does not delete copies already sent to providers, included in server backups or saved elsewhere. Chat/job databases have a separate lifecycle controlled by the operator.
App links, external web pages, Shortcuts, Apple Bridge and Safari integrations may disclose the data needed for the action to the destination app, website or service. Their own permissions and privacy practices also apply. Voice dictation uses Apple’s speech services according to the device and language configuration.
PocketHook-operated services#
The iOS app contains no third-party advertising or analytics SDK. Native diagnostics use Apple’s platform facilities. Purchases are processed by Apple; PocketHook does not receive your payment card details.
The optional App Review endpoint is a separate demonstration service. It receives messages and attachments only when its URL and credentials are configured. It uses deterministic replies, not an AI provider. Demo job data and files expire after 24 hours and are removed on the next request. Do not send personal content to this demonstration endpoint.
The website uses Umami for page-traffic measurement, separately from the iOS app. The app does not send chat contents to website analytics. Visiting the website also involves its hosting and delivery services. Information you send to our support email is used to handle your request. Any information previously submitted to the waitlist remains subject to the retention commitment given when it was submitted.
Your choices and rights#
You can remove messages, export chat history, change or remove credentials and revoke system permissions. Manage PocketHook’s iCloud data through Apple’s account/device controls. Uninstalling the app does not necessarily erase Keychain, iCloud, server or provider copies. Contact the relevant server operator for data held by your chosen endpoint; contact us for information held by PocketHook-operated services.
You may request access, correction, deletion or portability of personal information we hold, and withdraw consent where processing relies on it. Applicable data protection rights, including the right to complain to a supervisory authority in the EU, remain available. PocketHook is not intended for children under 13.
Contact: info@pockethook.app. PocketHook is responsible for the personal information it processes through its own services. Policy changes are published here with an updated date.