Privacy Policy
Last updated: August 30, 2026
1. Introduction
Socketo ("we," "our," or "us") operates the Socketo service and website at socketo.dev (the "Service"). This Privacy Policy explains how we collect, use, disclose, and protect information about you when you use our Service.
By using the Service, you agree to the collection and use of information in accordance with this policy.
2. Information We Collect
2.1 Account Information
When you sign in with GitHub or Google, we receive and store:
- Your username and display name
- Your email address (as provided by the authentication provider)
- Your avatar URL
- A unique user ID
- OAuth tokens (access token, refresh token) — stored securely to maintain your connection and enable re-authentication
This data is stored in our database and is used solely to identify you, provide the Service, and communicate with you about your account.
2.2 Session Data
When you sign in, we create a session that stores:
- A session token (randomly generated)
- The session's expiration time
- Your IP address and user agent (for security purposes)
These are stored as cookies in your browser (see Section 8).
2.3 Team and App Data
You may create teams and applications within the Service. We store:
- Team names and membership information
- App names, app keys, and configuration settings (enabled/disabled, client events)
- Subscription plan and billing status
2.4 WebSocket Connection Data
When you connect to our WebSocket service, we process — but do not permanently store — the following transient data:
- Socket IDs — randomly generated per connection
- Channel subscriptions — public, private, and presence channel names
- Presence channel data —
user_idanduser_info(as provided by your application's auth endpoint) - Client event payloads — messages sent between connected clients
This data exists only in-memory for the duration of the WebSocket connection and is discarded when the connection closes. Socketo does not store or log the content of your WebSocket messages.
2.5 Usage Analytics
We collect aggregated usage metrics for billing and service operation:
- Broadcast count — number of messages published
- Delivery count — number of message deliveries to subscribers
- Delivered bytes — total bytes delivered
These metrics are associated with your team ID and app ID and used solely for billing and aggregate analytics. We do not collect or inspect the content or payload of broadcasts.
2.6 Payment Information
Payments are processed by Polar ("Polar"), our payment processor and merchant of record. We do not collect, store, or have access to your credit card numbers or bank account details. Polar processes payment information in accordance with their own Privacy Policy.
We receive your email address and a customer ID from Polar for billing and support purposes.
3. How We Use Your Information
We use the information we collect to:
- Provide and maintain the Service — authenticate you, manage your teams and apps, deliver WebSocket connections
- Bill you accurately — track broadcast usage against your plan limits
- Display real-time statistics — show connection counts, channel counts, and usage stats in your dashboard
- Improve the Service — analyze aggregated, anonymized usage patterns
- Communicate with you — send service-related notices (e.g., billing receipts, plan changes)
- Ensure security — detect and prevent abuse, fraud, and unauthorized access
4. Data Retention
| Data Category | Retention Period |
|---|---|
| Account information (user, team, app) | Until account deletion |
| Session data | Until session expiry or logout |
| Usage analytics (broadcast/delivery counts) | 3 months |
| WebSocket connection data | Duration of connection only (in-memory) |
| Presence channel data | Duration of connection only (in-memory) |
If you delete your account, we will delete all associated personal data within 30 days, except for anonymized analytics data and records we are legally required to retain.
5. How We Share Your Information
We do not sell, rent, or trade your personal information. We share your information only:
5.1 Service Providers
| Provider | Purpose | Data Shared |
|---|---|---|
| Cloudflare | Hosting infrastructure (Workers, D1, Durable Objects, Analytics Engine) | All service data is processed on Cloudflare's global infrastructure |
| Polar | Payment processing & merchant of record | Team ID (external customer identifier), user email, user ID, subscription events, and broadcast counts for metered billing |
| GitHub, Google | Authentication | Profile data received via OAuth flow |
5.2 Legal Requirements
We may disclose your information if required by law, court order, or governmental regulation.
5.3 Business Transfers
If Socketo is involved in a merger, acquisition, or asset sale, your information may be transferred. We will notify you before your information becomes subject to a different privacy policy.
6. Data Security
We implement appropriate technical and organizational measures to protect your personal data. However, no method of transmission over the Internet or electronic storage is 100% secure. You are responsible for keeping your app secrets confidential.
7. Your Rights
Depending on your jurisdiction, you may have the following rights:
- Access — request a copy of your personal data
- Rectification — correct inaccurate or incomplete data
- Erasure — request deletion of your personal data ("right to be forgotten")
- Restriction — limit how we process your data
- Portability — receive your data in a structured, machine-readable format
- Objection — object to certain processing activities
To exercise any of these rights, contact us at support@socketo.dev. We will respond within 30 days.
8. Cookies
We use the following cookies:
| Cookie | Purpose | Attributes | Duration |
|---|---|---|---|
| Session cookie | Authentication | SameSite=Lax, Secure, Partitioned (CHIPS) | Session duration |
| OAuth state cookie | CSRF protection during sign-in | SameSite=Lax, Secure | Single request |
We do not use tracking cookies, advertising cookies, or third-party analytics cookies.
9. Children's Privacy
Our Service is not intended for anyone under the age of 13. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided us with personal information, please contact us.
10. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page. Your continued use of the Service after changes become effective constitutes acceptance of the updated policy.
11. Contact Us
If you have questions, concerns, or wish to exercise your data rights:
Email: support@socketo.dev
Website: https://socketo.dev