Rocket Pocket
Request a demo

Legal

Privacy policy

Who we are

This policy covers the rocketpocket.app website, your Rocket Pocket account on it, and the Rocket Pocket service, provided by Rocket Pocket, a business based in Pakistan. Questions about privacy: support@rocketpocket.app or +92 308 4375579 (phone and WhatsApp).

This website

What we collect

  • What you send us in a form: your name, club name, city, number of tables, phone number, email address, club address (sign-up only) and any message you add. A sign-up request also records that you agreed to the terms of service and this privacy policy.
  • If you email, call or message us: your email address or phone number and what you send us. WhatsApp messages are also handled by WhatsApp (Meta) under its own terms.
  • Server logs: like any website, our server records your IP address, browser type, the page requested, the page that linked to it and the time. We use these only to keep the site secure and working, and keep them for up to 14 days.

Cookies and browser storage

This website uses no analytics, no advertising trackers and no third-party scripts or fonts. Its only cookies are the essential ones of your Rocket Pocket account, described below, and they are set only when you sign in. If you switch between light and dark mode, that choice is saved only in your own browser. If you play the demo video, the point you reached and the player’s size are kept in that browser tab’s session storage, so the video can carry on on the next page; your browser clears it when that tab’s session ends. If you sign in from one of the sign-up pages, that page’s own link details (such as which sign-up you were following) are kept the same way until you’re back on it.

How we use form details

Only to reply to your request, arrange a demo, and set up and bill your subscription if you sign up. Your request is delivered as an email to our support mailbox (hosted by our email provider, Hostinger). Form requests aren’t stored in our account database.

Where this website runs

This website and its account database run on a server we operate on Oracle Cloud Infrastructure in Chicago, United States.

Your Rocket Pocket account (signing in with Google)

Club owners sign up and sign in on rocketpocket.app with their Google account; there is no Rocket Pocket password. Club managers also sign in to their club with Google through rocketpocket.app.

What we receive from Google

  • your name;
  • your email address, and whether Google has verified it;
  • your profile photo;
  • your Google account ID: a number that identifies your Google account to us, which we use to recognise you because an email address can change;
  • for a Google Workspace account, your organisation’s domain.

Nothing else. We ask only for Google’s basic sign-in information (“openid”, “email” and “profile”). We get no access to your Gmail, Drive, contacts or any other Google data, we never see your Google password, and we keep no Google access key after you have signed in.

Why we use it

  • to sign you in and keep you signed in;
  • to show your name and photo in your account;
  • to create your club’s owner account in your club and link it to the same Google account, so you can sign in to your club with Google;
  • to let the managers your club adds sign in to it with their own Google accounts;
  • to send you receipts and messages about your subscription and your club.

We don’t use it for advertising, we don’t sell it, and we don’t use it for anything unrelated to your account and your club.

What you add to your account

  • Your profile: your name, a username, your club’s name and its address. We keep a copy of your Google profile photo in your account, or a photo you upload instead.
  • Your mobile number: we call it once before your club is created, and again only if you ever lose access to your Google account and ask us to move your account to another one. It isn’t shown to anyone else or used for marketing.
  • Two-step verification (optional): if you turn it on, we keep the secret for your authenticator app encrypted, and your backup codes only in a one-way scrambled (hashed) form that can’t be read back.

Payments

Card payments are handled by Safepay, our card processor. You enter your card on Safepay’s own page; we never see or store your card number. From Safepay we receive the state of your subscription and of each payment: amounts, dates and Safepay’s reference numbers. We keep these with your receipts.

Cookies on rocketpocket.app

Signing in uses three essential cookies. They aren’t used for tracking or advertising, and no other website can read them.

  • one that keeps you signed in: it ends after 7 days without use, and after 30 days at most, or when you sign out;
  • one that protects a sign-in while it is in progress, for 10 minutes;
  • one for the two-step verification code, if you use it, for 5 minutes.

Security records

When you sign in, and for important account actions such as payments, changes to two-step verification or signing out everywhere, we record the time, the action and your IP address. A signed-in session also records your IP address and a short description of your browser, so you can see where you’re signed in. IP addresses are removed after 14 days.

The Rocket Pocket service

Clubs use Rocket Pocket to record their operations: tables and sessions, bookings and the waitlist, food and drink orders, stock, payments received, and staff names and logins. Where a club chooses to, it can also record customers’ names and phone numbers.

  • The club decides what it records and is responsible for it. We process it only to provide and support the service.
  • Each club’s data is kept in that club’s own private deployment, on a server we operate on Oracle Cloud Infrastructure in Toronto, Canada. This means club data is stored outside Pakistan.
  • We access a club’s deployment only to set it up, maintain it, or when the club asks us for help.
  • Signing in to a club’s Rocket Pocket uses essential cookies that keep you signed in and protect the sign-in form. They aren’t used for tracking or advertising.
  • We don’t sell personal information, and we don’t use club data for advertising.

Google Drive backup (optional)

A club’s Administrator can connect a Google account of their choice to their club’s Rocket Pocket.

  • What is sent. Copies of the club’s records go to that Google Drive as spreadsheet (CSV) files, every day at the time the Administrator chooses and whenever they press “Upload now”:
    • transactions and payments;
    • table sessions;
    • food and beverage orders;
    • reservations;
    • stock levels and stock movements;
    • the staff roster.
    These files include the names and phone numbers of the club’s customers, and, for reservations, email addresses when given. They never include passwords, sign-in accounts, security keys or tokens.
  • Who receives it. Google receives these files at the Administrator’s direction and keeps them in the Administrator’s own Google account, under Google’s own terms and privacy policy. Rocket Pocket does not send them to anyone else.
  • What access Rocket Pocket has. Only Google Drive’s “files this app creates” permission (drive.file): Rocket Pocket can create files there and see or change only the files it created. It cannot see anything else in that Drive. It also reads the account’s email address, to show which account is connected.
  • What we keep. The club’s own Rocket Pocket server keeps an encrypted access key from Google (a “refresh token”) and a log of each upload: time, number of files, size and result. We keep no other copy of the files.
  • How to stop it. The club’s Administrator can choose Disconnect in Rocket Pocket (Settings → Google Drive backup). This revokes Rocket Pocket’s access at Google and deletes the stored key. Anyone can also remove Rocket Pocket’s access at any time at https://myaccount.google.com/permissions. Files already saved stay in that Google Drive until the account’s owner deletes them.
  • Responsibility. The club is responsible for its customers’ information once it is in the club’s own Google account.

Google user data

This section sums up how Rocket Pocket handles the information it receives from Google, for Google sign-in and for Google Drive backup. The sections above give the details.

  • What we access. For sign-in, only your name, your email address and whether Google has verified it, your profile photo, your Google account ID and, for a Google Workspace account, its domain (Google’s “openid”, “email” and “profile”). For Drive backup, only the files Rocket Pocket creates in the connected Drive (“drive.file”) and that account’s email address.
  • How we use it. Only to sign you in, to show your name and photo in your account, to link your club’s owner and manager accounts to the same Google accounts, to send you messages about your account and your club, and to save a club’s backup files to the Drive its Administrator connected. Never for advertising, and we don’t sell it.
  • How we store and protect it. Your sign-in details are kept in our account database on our server in Oracle Cloud Infrastructure in Chicago, United States, and what your club needs to recognise you is kept in our control center and on your club’s own server, both in Oracle Cloud Infrastructure in Toronto, Canada. Drive backup’s access key is kept encrypted on the club’s own server. Everything travels over encrypted (HTTPS) connections, and access to these servers is limited to our own team.
  • Who we share it with. Only as described under “Who we share information with” below. We don’t transfer it to anyone else, except where the law requires it.
  • Who looks at it. Our team looks at it only when you ask us for help, to keep the service secure, or when the law requires it.
  • No AI training. We don’t use information from Google APIs to develop, improve or train artificial intelligence or machine-learning models.
  • How long we keep it, and deleting it. Your sign-in details stay until you close your Rocket Pocket account, and closing it deletes them (see “How long we keep it” and “Your choices” below). Drive backup’s access ends when the club’s Administrator chooses Disconnect, which also deletes the stored key.

Rocket Pocket’s use and transfer of information received from Google APIs, for Google sign-in and for Google Drive backup, adheres to the Google API Services User Data Policy, including the Limited Use requirements.

You can remove Rocket Pocket’s sign-in access at any time at https://myaccount.google.com/permissions. Google then asks you again the next time you sign in to Rocket Pocket; it doesn’t close your Rocket Pocket account. To close your account, see “Your choices” below.

Who we share information with

  • Our control center and your club’s own server, both on our servers in Oracle Cloud Infrastructure in Toronto, Canada: your Google account ID, email address and name, so your club’s owner account can be created and linked to your Google account. The control center also receives your mobile number and your subscription’s state, to check new clubs, keep them running and support you.
  • Safepay, our card processor, for your card payments.
  • Hostinger, our email provider, which sends our emails: receipts, messages about your subscription and club, and our own team’s alerts, such as a new club waiting for our check.
  • Oracle Cloud Infrastructure, which hosts our servers.
  • Google, only as part of signing in with Google, and when a club’s Administrator connects Google Drive backup as described above.
  • Anyone the law requires us to share it with.

How long we keep it

  • Server logs: up to 14 days.
  • Form emails: as long as needed to handle your request and keep proper business records.
  • Your account (Google sign-in details, profile, photo, mobile number and two-step verification): until you close your account, as long as you own no active club.
  • Signed-in sessions: they end after 7 days without use, and after 30 days at most.
  • IP addresses in sign-in and security records: 14 days.
  • Payments and receipts: 6 years, for tax.
  • Backup copies of the account database: up to 14 days.
  • Club data: for as long as the subscription is active, then for 30 days so the club can export it, then deleted.

Security

The website and every club deployment are served over HTTPS. Account cookies are sent only over HTTPS and can’t be read by scripts or by other websites, including club addresses. You can add two-step verification to your account. Access to club deployments is limited to the club’s own logins and, for set-up and support, to us.

Your choices

You can ask us what personal information we hold about you, or ask us to correct or delete it, or to close your Rocket Pocket account, by emailing support@rocketpocket.app. Closing your account deletes your Google sign-in details, profile, photo, mobile number and sessions; payment records and receipts are kept for the time above. If your details are in a club’s records, we’ll pass the request to that club.

Changes

If we change this policy, we’ll update the date above and, for material changes, tell subscribers by email.