Privacy Policy

1. Introduction

Welcome to PocketBase Cloud. When you use our Sites and Services, we collect information about you, your device, and your usage. We are committed to protecting your privacy and ensuring the security of your personal information.

2. Information We Collect

We collect information that you provide directly to us, as well as information automatically collected from your use of our Services.

• Account Information. When you create an account, we collect your name and email address.
• Payment Information. If you purchase a subscription, our payment processor (Stripe) collects your billing address and payment card details.
• Usage Information. We automatically collect information about how you interact with our Services, such as pages visited and resource usage.
• Analytics and Advertising. Our marketing site uses Google Analytics (GA4) to count visits and see which pages people read, and Google Ads to learn which ads bring visitors. Both set cookies in your browser. Our marketing site and dashboard also load OpenAI's ads measurement tag, which records when someone signs up or starts a subscription so we can tell which ads worked. You can block these with your browser's tracking protection or an ad blocker; the Services keep working without them.

3. How We Use Information

We use the information we collect to provide, maintain, and improve our Services, such as to:

• Process transactions and send related information.
• Send you technical notices, updates, security alerts, and support messages.
• Monitor and analyze trends, usage, and activities.
• Detect, investigate, and prevent fraudulent transactions.

4. Browser Errors on Your Sites

If you turn on Browser Errors for a frontend in the dashboard, we add a small script to that site on its next deploy. It reports problems your visitors hit so we can show them to you and propose fixes. It is off until you, or your organization's default, turns it on, and you can turn it off at any time.

From each visitor's browser, the script sends:

• JavaScript errors and unhandled promise rejections: the error message and stack trace.
• Failed requests: the domain the request went to and the HTTP status. Never the full URL, the request body, or the response.
• Page speed (Web Vitals: LCP, INP, CLS), page views, and a count of rapid repeated clicks on a page.
• The page path, with the query string and fragment removed and IDs replaced by a placeholder.

The script sets no cookies and stores nothing in the visitor's browser. It does not record keystrokes, form input, screen contents, or what was clicked. We use the visitor's IP address only in memory to limit abusive traffic, and never store it. Error messages and stack traces are stored as your code produced them, so keep personal data out of them.

The data is stored on our own servers in the EU and is never sold or shared with advertisers. Page-level counts are deleted after 30 days and error samples after 14 days.

For this data, you decide what is collected from your visitors and we process it on your behalf. You are responsible for telling your visitors about it, for example in your own privacy policy. Settingwindow.__pbcOptOut = true before the script loads stops it from sending anything for that visitor.

5. AI Assistants (MCP Server)

You can connect an AI assistant, such as Claude or ChatGPT, to your account through our MCP server at mcp.pocketbasecloud.com. The assistant then works with your PocketBase Cloud resources on your behalf, within the access you approve on the portal: read-only or read and write, and all projects or one. How to connect is in Connecting an AI assistant.

When you connect an assistant, we collect and keep:

• The connection you approved. Your account ID and email address, the access and project you chose, and your PocketBase Cloud session, encrypted, so the assistant can act for you. A connection that goes 30 days without use is deleted automatically. Access tokens issued to the assistant expire after an hour, and the records made while you sign in after at most 10 minutes.
• The assistant app's registration. The name the app gives itself, the addresses it returns to after sign-in, any website, logo, policy or contact addresses it registers, and when it registered. It is deleted at most 90 days after the app last used it.
• A record of each tool call. Which tool ran and when, whether it worked, how long it took, the names of the arguments, the instance or collection it targeted, a shortened error message (which can name your projects, instances, collections, domains or files), the app that called it, whether you signed in or used a token, a request ID, and a pseudonymous ID derived from your account ID. The same is recorded when the assistant connects or lists the tools. We use these records to keep the service reliable and to diagnose problems, and delete them after 90 days. Totals per hour and per day contain no user ID and are kept indefinitely.
• Logs. Our web servers log each request's IP address and address (URL), and our application logs record the calls without a user ID; both are overwritten once they reach a fixed size. The databases behind the server keep their own request logs, which can contain account IDs, for 5 days and without IP addresses.

We do not store the records, files or logs from your instances that pass through the server, the other values you send to tools, or your conversations with the assistant. What a tool returns goes to the assistant you connected; its provider, for example Anthropic or OpenAI, handles it under its own privacy policy. This data is stored on PocketBase Cloud's own servers, run on the infrastructure providers listed in section 7, and we do not sell it or use it for advertising.

You stay in control: choose read-only access or a single project when you connect, and remove the connector in your assistant to stop using it. To have a connection or its call records deleted sooner, email [email protected].

6. Data Storage & Security

We use industry-standard security measures to protect your data. Your application data is stored in secure data centers located in the regions you select. We use encryption for data in transit (TLS). While we strive to protect your personal information, we cannot guarantee its absolute security.

7. Third-Party Services

We may share your information with third-party vendors who need access to carry out work on our behalf:

8. Your Privacy Rights

Depending on your location, you may have the right to:

• Access and receive a copy of your personal data.
• Rectify or update inaccurate data.
• Request deletion of your personal data.

9. Contact Us

If you have any questions about this Privacy Policy, please contact us at:
[email protected]