What we store, and what we don’t.

Socketly does not store your messages

Messages you publish are delivered to the connected clients and are not written to disk. We record how many messages an app sent and how many bytes they came to, per app, per minute, hour and day. We do not record what was in them, and we do not record the channel names they went to.

This is a property of how metering works rather than a promise about restraint. The counters are integers in Redis, flushed to a table of counts. There is nowhere in the system a message body is written.

What we do store

• Your account. Email address, name, and an avatar URL if you sign in with Google. A password is stored only as a hash, and accounts created through Google have no password at all.
• Your sessions. A hash of the session token, its expiry, and the IP address and browser user-agent of the session, so you can see where your account is signed in.
• Your workspaces, apps and keys. Public keys are stored as written. Secret keys are stored encrypted, because verifying a channel authorization needs the original value.
• Usage. Message and connection counts per app, per time bucket, kept for as long as your plan’s usage history allows.
• An audit log. Administrative actions — a key rolled, an app deleted, an origin changed — with who did it, when, and from which IP.
• Billing references. A Stripe customer and subscription id. Card details are held by Stripe and never reach us.

Who else touches it

Running this service means other companies process some of your data on our behalf. Each holds what it needs to do its job and nothing more. These are the companies we contract with directly; they in turn run on cloud infrastructure of their own — our database, for instance, runs on Amazon Web Services in US East.

• Neon — the database, on AWS in US East.
• Railway — the gateway and its Redis, in US East.
• Vercel — this website and the documentation, plus anonymous analytics and performance measurement. No cookies are set for analytics. Pages are served from whichever region is nearest the reader, so a visitor in Mumbai is served from Mumbai — but nothing is stored there. Your account data stays in US East.
• Stripe — payments. They hold your card details; we hold an id that points at them.
• SendGrid — account email: verification, password resets, and notices about your account.
• Google — only if you choose to sign in with Google, and only the verified email, name and avatar on that account.

Where it lives

Socketly runs in one region, US East, and your data is stored there. If you are outside the United States, using the service means your data is transferred there.

How long we keep it

Account data is kept while your account exists. Usage history is kept for the window your plan includes and then rolls off. Sessions expire on their own; you can end them by signing out. Audit entries are kept after the account they describe is deleted, with the account reference removed — losing the record of an administrative action is worse than keeping a row that no longer names anybody.

What you can ask for

You can ask for a copy of what we hold about you, ask us to correct it, or ask us to delete your account and its data. Ask on the contact page or write to support@socketly.co and we will do it. Deleting an account removes its workspaces, apps and keys, which stops every application depending on them — so we will confirm before we do.

Cookies

One cookie, for your session, set when you sign in and cleared when you sign out. There is no advertising or tracking cookie, and no third-party cookie is set by this site.

Changes

If this policy changes in a way that affects what we do with your data, we will say so by email before it takes effect. The date at the top is when the text last changed.

Contact

White Leaf LLC — support@socketly.co.