This Policy explains which personal data PocketDocs collects, why it collects it, who it shares it with, how long it keeps it, and what rights you have. It applies to the website https://pocketdocs.dev, the admin dashboard, the sync API, the CLI, and the public documentation sites we host. We follow the Brazilian General Data Protection Law (LGPD, Law 13,709/2018) and the Brazilian Civil Rights Framework for the Internet (Marco Civil da Internet, Law 12,965/2014). The rules for using the Service are in the Terms of Service.
1. Who is responsible
The party responsible for the processing of the data described in this Policy (the controller, under the LGPD) is Anderson Luis Polo Allgayer, CPF 038.323.940-01, located at Rua Souza Doca, n. 69, bairro São Luiz, Sapiranga, RS, doing business as AlphaSystem.
The data protection officer (encarregado) is Anderson Luis Polo Allgayer. To talk about privacy or exercise your rights, write to support@alphasystem.dev.
2. Our role in each situation
- Your Account, billing, security, and support data. Here we are the controller: we decide why and how this data is processed.
- Organization Content. The Content an Organization publishes may include personal data of third parties. In that case the Organization is the controller, and we act as the processor, handling that data on its behalf and only to provide the Service. Requests from data subjects about that Content should go to the Organization, and we help it when needed.
- Visitors of public sites. When you visit a public documentation site we host, we receive your IP address and technical browser data to deliver the page and protect the Service. The content of the site is the responsibility of the Organization that publishes it, which may also load images or other resources from other sites (see section 6).
3. Data we collect
| Data | Where it comes from | What we use it for | Legal basis (LGPD, art. 7) |
|---|---|---|---|
| Name, email address, and password (we store only a password hash) | You, when you register | Create and authenticate your Account and send Service messages | Performance of a contract (V) |
| Role and membership in Organizations | You, or the Owner or Admin who added you | Control access | Performance of a contract (V) |
| Content (projects, versions, pages, FAQ articles, changelogs, project logos, site icon, and site settings) | You | Provide the Service | Performance of a contract (V) |
| API access tokens (we store only a hash, the name, the last characters, the expiry date, and the date of last use) | You | Allow the CLI and syncing | Performance of a contract (V) |
| Billing data: the Owner's email address, the Organization name, and the Organization identifier sent to Stripe, plus Stripe identifiers, status, billing interval, and renewal date of the subscription | You and Stripe | Charge, renew, cancel, and change plans | Performance of a contract (V) and legal obligation (II) |
| Custom domain: domain name, verification token, and status | The Owner | Set up and verify the domain | Performance of a contract (V) |
| Technical logs. In the web server: IP address, date and time, address requested, result of the request, and browser (user agent). In the application: request identifier, address requested (without the query string), result, browser, a partly masked IP address when a rate limit is triggered, and the account, organization, project, or subscription identifiers involved in an action, with sensitive values masked. When a search on a public site fails, the search term is also logged | Generated automatically | Security, abuse and fraud prevention, rate limiting, and diagnosing failures | Legitimate interest (IX) and, where applicable, legal obligation (II) |
| Support messages and reports | You | Respond to and resolve the matter | Performance of a contract (V), legitimate interest (IX), legal obligation (II), and regular exercise of rights in legal proceedings (VI) |
We do not ask for sensitive personal data. We do not collect banking data: your card number is entered directly with Stripe.
4. How we use the data
We use the data to create and protect your Account, provide the Service, charge for the Pro plan, send necessary messages (email confirmation, password reset, and notices about your Account, billing, and these documents), answer support requests, comply with the law, and defend our rights.
We do not sell personal data, we do not use it for advertising, we do not build behavioral profiles, and we do not make automated decisions that have legal effect on you. We do not send newsletters or marketing messages.
5. Cookies and local storage
We use only cookies that are essential for the Service to work. We do not use analytics, advertising, or tracking cookies. All of them have the SameSite=Strict attribute and, in production, Secure. The first three in the table are also HttpOnly, which means the scripts on the page cannot read them.
| Name | What it is for | Duration |
|---|---|---|
pd_auth |
Keeps you signed in | 7 days |
pd_organization |
Remembers which Organization you are using | 1 year |
pd_csrf |
Protects forms against forged requests | Until you close the browser |
pd_download |
Tells the dashboard that the ZIP download you asked for has finished | 1 minute |
Public documentation sites do not set cookies for people who only read them.
We also use your browser's local storage, which is not sent to us: the pd_theme key, which stores your light or dark theme choice, and the drafts the Markdown editor saves automatically while you write. You can erase this data in your browser settings.
6. Who we share data with
We share data only with those who need it to provide the Service:
- Stripe (payments). Receives the Owner's email address, the Organization name, and the Organization identifier, and directly collects card details and device information for fraud prevention. Stripe handles this data under its own privacy policy, at https://stripe.com/privacy.
- Resend (Service emails). Receives the recipient's email address and the content of the email confirmation or password reset message.
- Hostinger (hosting). Our servers are located in the United States, and that is where we store the Service's main database and files. The other providers in this list process the data we send them on their own infrastructure.
- jsDelivr (content delivery network, CDN). We load a few files from it: the code highlighting stylesheet on public pages, the Markdown editor in the dashboard, and, when a page uses diagrams, the Mermaid library. Your browser requests these files directly from the CDN, which receives your IP address and basic technical data.
- Let's Encrypt (HTTPS certificates for custom domains). An Organization's domain name becomes visible in public certificate transparency logs.
- Cloudflare (Turnstile, bot protection). The account creation page loads a challenge from Cloudflare that tells people from automated programs. Your browser sends Cloudflare your IP address and technical data about the browser, and we send Cloudflare the challenge result and your IP address to confirm it. The legal basis is our legitimate interest in protecting sign-up against abuse (art. 7, IX). Cloudflare handles this data under its own privacy policy, at https://www.cloudflare.com/privacypolicy/.
- Sites chosen by Organizations. Organizations can include images hosted on other sites in their pages. When you open such a page, your browser requests the image directly from that site, which receives your IP address, browser data, and the address of the page. We do not control those sites.
- Owners and Admins of the same Organization, who see your name and email address.
- Authorities and third parties, when the law or a court order requires it, or to protect rights and security. If there is a corporate reorganization, the data may go along with the service, and we will notify you.
7. International transfers
Some of these providers process data outside Brazil, including in the United States, and the CDN operates in several countries. Our own servers are in the United States. The CDN and the bot protection service receive data directly from your browser. We rely on art. 33 of the LGPD for the transfers we make, mainly the hypothesis in which the transfer is needed to perform the contract and to exercise rights in legal proceedings (art. 33, IX, with art. 7, V and VI), and, where a provider offers them in its data processing terms, contractual clauses (art. 33, II). We send providers only the data they need.
8. How long we keep data
| Data | Retention |
|---|---|
| Account (name, email address, password hash) | As long as the Account exists. After your deletion request, we delete or anonymize it within 30 days. An Account whose email address was never confirmed cannot sign in and stays in our database until you ask us to delete it. |
| Organization Content | Until the Organization is deleted, which removes its projects and settings from the production database. |
| Billing data in our database | Deleted together with the Organization. Stripe keeps payment records for as long as it and the law require. |
| Access tokens | An expired token cannot be used, but its record (hash and metadata) stays until it is revoked or the project or Account is deleted. |
| Email confirmation and password reset links | Confirmation links expire in 24 hours and password reset links in 30 minutes. Expired links cannot be used. Expiry does not delete the email confirmation record (email address, token hash, and timestamps). We keep it until you confirm or a new link replaces it. When we delete or anonymize the Account, we delete it too. |
| Technical logs (section 3) | 7 days. |
| Backups | 7 days. Deleted data stops existing in backups when they expire. |
| Support messages | As long as needed to resolve the matter and to exercise rights in legal proceedings. |
| Financial and tax records required by law | The legal period, generally up to 5 years. |
After these periods we delete or anonymize the data, unless the law requires us to keep it longer.
9. Security
We adopt technical and organizational measures to protect data:
- encrypted HTTPS connections across the Service;
- passwords and access tokens stored only as hashes;
- session cookies with HttpOnly, SameSite=Strict, and Secure, and protection against forged requests (CSRF);
- rate limiting of access attempts and usage by IP address;
- role-based access control in Organizations;
- masking of sensitive data in application logs;
- backups for disaster recovery.
No system is completely secure. If an incident occurs that may cause relevant risk or harm, we will notify the Brazilian National Data Protection Authority (ANPD) and the affected data subjects, as article 48 of the LGPD requires.
10. Your rights
Under article 18 of the LGPD, you can ask at any time for:
- confirmation that we process your data;
- access to the data;
- correction of incomplete, inaccurate, or outdated data;
- anonymization, blocking, or deletion of unnecessary or excessive data, or data processed in violation of the law;
- data portability;
- deletion of data processed on the basis of consent;
- information about who we share data with;
- information about the possibility of refusing consent and its consequences;
- withdrawal of consent, when consent is the legal basis;
- objection to processing carried out on a basis other than consent, if the law is not being followed.
To exercise these rights, write to support@alphasystem.dev. If you have an Account, preferably write from the email address registered on it. Visitors, other data subjects, and their authorized representatives can also write to us. We may ask for information to confirm your identity in a proportionate way. We respond within 15 days. Account deletion is done through this request, and Organization deletion is done in the dashboard, in Settings. You can also lodge a complaint with the ANPD at https://www.gov.br/anpd.
11. Children and teenagers
The Service is intended for people aged 18 and over. We do not knowingly collect data from minors. If we learn that an Account belongs to a minor, we will close it and delete the data.
12. Changes to this Policy
We may update this Policy. For material changes, we will notify account holders by email at least 30 days in advance. The effective date appears at the top of the page. This Policy is published in Brazilian Portuguese and in English. If the two differ, the Portuguese version prevails.
13. Contact
- Anderson Luis Polo Allgayer, CPF 038.323.940-01
- Rua Souza Doca, n. 69, bairro São Luiz, Sapiranga, RS
- Data protection officer: Anderson Luis Polo Allgayer
- Email: support@alphasystem.dev