PocketBees (pocketbees.ai) scans websites for marketing and AI-visibility gaps and, when you ask it to, applies fixes through services you connect. It is operated by Jacky Goh in Singapore ("we"). This policy explains what we collect, why, and what you can do about it. We follow Singapore's Personal Data Protection Act 2012 (PDPA).
What we collect
| Data | Why |
|---|---|
| Name, email address, password (stored only as a hash) | To create and secure your account and send account emails |
| When you last used the app (to the hour) | Running the service and seeing which accounts are active |
| Websites you add, how you verified them, scan results, jobs and before/after results | To run the service and show your progress |
| Cloudflare access tokens, if you connect Cloudflare (encrypted at rest) | To read your zone settings and apply changes you approve |
| An audit log of actions (for example "fix applied", "site verified") | Security, accountability and undo |
| Your email address and chosen plan, if you join a paid-plan waitlist | To email you when that plan opens. You can ask us to remove it at any time. |
| If you connect Google: read-only access to the Search Console and Google Analytics properties for your site (encrypted tokens), and daily totals we copy from them (clicks, impressions, top pages and searches, visits, key events) | To show your traffic and rank jobs by it. We change nothing in your Google account unless you let us submit your sitemap (see below), and disconnecting revokes our access. |
| Questions you track in AI answers, and the answers your own AI agent reports back (answer text, cited links, which AI and model) | To show whether AI assistants mention or cite your site. Your agent runs the questions with your own AI accounts; PocketBees does not send them to any AI provider. |
| Content briefs: content ideas worked out from your own Search Console data and AI checks, and the address of any page you publish from one | To suggest what to write next and check whether it helped. Your own agent writes the content; PocketBees does not. |
| Social posts: post ideas, the drafts your agent or you write, links to posts you made, and GA4 visits from PocketBees-tagged links | To help you share your work and show which posts brought visitors. PocketBees never connects to or posts on your social accounts. |
| Autopilot: the levels and limits you set per channel, and a log of every automatic decision | To act only within the limits you chose, and to show and undo what was done. Autopilot never publishes, posts or deletes anything. |
| Weekly briefs: a saved copy of the numbers in each weekly email, and whether you want the email | To send you the weekly brief and let you look back at past weeks. Turn it off anytime from the email or the Briefs page. |
| Free quick scans: the domain scanned and a one-way hash of your IP address | Abuse prevention and rate limiting |
| A random cookie ID (stored only as a hash) and which landing page version you saw | Measuring which page version works better. It is not linked to your name or email. |
| Where you first came from: the referring website's name (for example linkedin.com, never the full address), any campaign tag in the link you followed, and the first page you opened. Kept in a cookie for 30 days and saved with your waitlist entry or account if you join. | To see which places bring people to PocketBees. Only PocketBees admins see it. |
| Server logs (IP address, page requested, browser type) | Security and troubleshooting |
We do not sell personal data, show ads, or use third-party analytics or tracking pixels.
How PocketBees learns which fixes work
When a job is fixed, we record when and how it was fixed and which pages it touched. 7, 28, 56 and 90 days later we compare the Google traffic for those pages (from the data you connected) with your other pages over the same days, and show you the result under the job.
Unless you turn it off in Settings → Data sharing, an anonymised copy of each result is added to a shared dataset: the kind of fix, the change in clicks, impressions or visits, the month, and broad bands for your site (CMS, number of pages, traffic level and type of business). It does not contain your domain, page addresses, search terms, content or account details, and it is not linked back to you. We use it only to rank jobs by what has actually worked and to describe results in aggregate. Turning sharing off removes the results already shared from your sites. Anonymised results are kept after a site or account is deleted.
What we access in your Google account
If you connect Google, you grant read-only access to Search Console (webmasters.readonly) and Google Analytics (analytics.readonly). We use it only to copy daily totals for the verified site you connected (clicks, impressions, top pages and searches, visits, key events), and Google's index status for the pages in your sitemap, show them to you, and rank your jobs by real traffic.
Sitemap submission is optional. Only if you press "Allow and submit" on the sitemap job do we ask Google for Search Console management access (webmasters). We use it for one thing: submitting your own site's sitemap to Search Console when you ask. We never remove sitemaps, properties or users, and we change nothing else. Disconnecting Google revokes it.
PocketBees' use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not sell this data, use it for advertising, or use it to train AI models, and people at PocketBees do not read it except with your permission, for security, or where the law requires. Disconnecting Google, or deleting your account, revokes our access at Google; you can also remove it at myaccount.google.com/permissions.
What we access on your website and Cloudflare
Scans fetch public pages of your site the way a visitor or crawler would. Deep scans run only on sites you have verified you own.
If you turn on IndexNow for a site, we send the addresses of public pages from your sitemap to IndexNow (api.indexnow.org), which shares them with participating search engines such as Bing. We send page addresses only, never content or account details. If you add directory listings, we read the listing pages you give us to check that they link to your site.
If you connect Cloudflare, you grant these permissions for the zones you choose: Zone Read, Bot Management Read and Write, Zone WAF Read and Write, and Analytics Read. We use read access to diagnose problems. We only make a change after you approve it, we record what was changed, and we keep what is needed to undo it. Cloudflare sessions currently last about an hour; you can disconnect at any time, which revokes our access.
Who processes data for us
| Provider | Purpose | Location |
|---|---|---|
| Hetzner Online | Server hosting and database | Finland (EU) |
| Cloudflare | DNS, network protection, email forwarding; and your Cloudflare account if you connect it | Global |
| Resend | Sending account emails | United States |
| Stripe | Taking payments for paid plans. Stripe collects your card details directly; we keep only your Stripe customer ID, the card brand and last 4 digits, and your subscription status | Global |
| Google (Drive) | Off-site database backups | Global |
| Google Analytics | Counting visits to our public pages and sign-in/sign-up pages (not inside your account) | Global |
| Google Fonts | Fonts on the landing page (your browser requests them from Google) | Global |
Some of these providers are outside Singapore. We use reputable providers with their own security commitments to protect data transferred to them.
How long we keep it
- Account, site and scan data: while your account exists.
- When you delete your account, your sites, scans, jobs, results and connected-service tokens are deleted from the live database immediately, and we revoke connected Cloudflare access.
- Database backups are taken nightly and kept on our server and in Google Drive. Deleted data can remain in backups until those backups are removed. Ask us and we will remove it from backups too.
- Server logs are short-lived and rotate automatically.
- Anonymised fix results (see "How PocketBees learns which fixes work") are kept after a site or account is deleted, because they cannot be linked back to it. Turn sharing off first to remove them.
Your choices and rights
- Delete your account any time in Settings → Profile.
- Disconnect Cloudflare any time from your site page.
- Stop sharing anonymised fix results any time in Settings → Data sharing; results already shared from your sites are removed.
- Access or correct your data, or withdraw consent, by emailing [email protected]. We aim to reply within 30 days.
Security
Connections use HTTPS. Integration tokens are encrypted in our database, and the database is not reachable from the internet. No system is perfectly secure; if a breach affects your data, we will tell you as required by law.
Children
PocketBees is a business tool and is not intended for anyone under 18.
Changes
If we change this policy, we will update the date above and, for significant changes, email account holders.
Contact
Questions or requests: [email protected].