Last updated: October 2026
Pocket Archive moves recordings you already own from HeyPocket into cloud storage you already own. We are the pipe in between. This page says exactly what passes through it, what stays behind, and for how long.
The security page covers the same system in more technical detail, including how each item below is encrypted. The two pages are kept consistent on purpose; if you find them disagreeing, that is a bug and we want to hear about it.
1. What we collect
From you, directly. Your email address and name, which arrive when you sign in with Google. Your HeyPocket API key and webhook signing secret, which you paste in so we can fetch your recordings. Participant names, if you type them for enhanced transcripts.
From the services you connect. An authorisation token from Google or Microsoft that lets us write to the folder we create in your storage. We never receive your password for either.
Generated as you use the service. Which recordings have been synced or enhanced, how many syncs you have used against your plan's quota, your plan and trial dates, and identifiers linking your account to its Stripe subscription. If you open a checkout page and do not pay, we keep a record of your email and the amount so we can see how often that happens.
Cached from your recordings. This is the part people do not expect, so we are putting it in its own paragraph. To render your action-item page without re-fetching every recording, we cache your action items, including each item's text and the title of the recording it came from. We also keep each synced recording's current Pocket title, folder name, and cloud folder/file identifiers so later edits update the same archive. To sort your recordings by date without re-fetching the whole list from HeyPocket on every page, we also keep a list of your recordings: each one's title, when it was recorded, its length and, once synced, when. This is meeting content, it is stored encrypted, and you can see the full list on the security page.
2. What we do not collect
We do not store your audio files, your transcripts or your summaries. They are streamed from HeyPocket through our Worker into your own cloud storage within a single request, held in memory for the seconds that takes, and never written to any disk we control.
We never see your Google, Microsoft or HeyPocket password. We never see or store your card number; Stripe collects payment details on its own form and we receive only an identifier.
We do not use advertising trackers, we do not run third-party analytics inside the app, and we do not sell or rent your personal information to anyone, for any purpose.
Website analytics. Our public pages — the
home page, guides, FAQ, policies and the sign-up page — use Google Analytics to
count visits, see how people found us, and measure how many go on to sign up. It records
the page viewed (never its query string, apart from campaign tags such as utm_source, so invitation links stay private), the referring
site, an approximate location, and the browser and device type. Outside the EU, UK and
Switzerland it sets first-party cookies (_ga, _ga_…, kept
up to two years) so a return visit counts once; in the EU, UK and Switzerland it sets no
cookies. Advertising features, Google signals and ad personalisation are off, and reports
are kept for 14 months. Google Analytics never runs once you are signed in: not on your
dashboard, your recordings, your settings or your billing pages. You can opt out with
Google’s browser add-on or any
content blocker.
3. How we use it
Your storage authorisation is used for exactly one thing: writing your recordings into the folder we created. On Google Drive that is enforced by the permission itself, which cannot open files it did not create. On OneDrive the permission Microsoft offers is broader, and we explain that plainly in the security page.
Your email address is used to identify your account, to send transactional mail such as sync failures and trial notices, and to send occasional product updates. Every non-essential email has an unsubscribe link that works.
Usage counters exist to enforce your plan's limits and for nothing else.
4. Enhanced transcripts and AI
Enhanced transcripts are optional and paid. Nothing here happens unless you request it for a specific recording; ordinary syncing never involves any of it.
When you do, the audio is transcribed by a Deepgram model running on Cloudflare's own infrastructure. To label who is speaking, a sample of the conversation is sent to Anthropic's API — up to eight turns per speaker plus up to forty lines that look like they mention a name, each truncated, never the full transcript. The model returns only a mapping of speaker numbers to names and never rewrites what was said.
Anthropic does not train models on data submitted through its API. If you would prefer no part of a conversation leave Cloudflare's network, simply do not use enhanced transcripts.
5. Who else receives your data
Only the companies needed to run the service: HeyPocket, Cloudflare, Google, Microsoft, Anthropic, Stripe and Resend — plus Google Analytics for visits to our public website, described above. Each is listed on the security page together with exactly what it receives. If a company is not on that list, your data does not reach it.
We will disclose information if legally compelled. If that happens and we are permitted to tell you, we will.
6. How long we keep it
Account data is kept while your account exists. Action items are capped at the most recent 500; synced and enhanced recording IDs at the most recent 200 each. Older entries fall off automatically.
When you delete your account, we cancel any subscription, hand your Google authorisation back to Google, and remove our records. An archived copy is retained for 30 days so that signing in again restores your account; after that it expires and is gone. Email us if you want it purged immediately instead.
A line recording that an account was created, deleted or restored, including its email address, is kept for about 13 months as an audit trail.
Your recordings in your own cloud storage are never deleted by us, at any point, including when you close your account. They are yours.
7. Your rights
You can export everything at any time without asking us, because it is already in your own Drive or OneDrive, as ordinary audio files and plain Markdown that open without Pocket Archive existing.
You can revoke our access to your storage at any moment, directly with the provider and without our involvement: Google or Microsoft.
You can delete your account yourself from your profile page. You can unsubscribe from product email from any such email. To request a copy of what we hold, or correction of anything wrong, email contact@pocketarchive.us.
If you are in the UK, EU, or a jurisdiction with comparable law, these rights are yours regardless of what any policy says. We do not require you to invoke a statute to get them.
8. Waitlist and marketing
If you joined the waitlist we kept your name, email, storage preference and any feature request you wrote, to prioritise development and tell you when we launched. That data is not sold or shared for marketing.
9. Children
Pocket Archive is not directed at children under 13 and we do not knowingly collect their information. If you believe a child has created an account, email us and we will remove it.
10. Changes to this policy
If we change how data is handled in a way that matters, we will update this page and say so in the release notes rather than quietly editing it and changing the date. Material changes affecting existing accounts get an email.
11. Contact
Privacy questions: contact@pocketarchive.us. Security issues: security@pocketarchive.us, or see our disclosure policy.