Privacy Policy
Comprehensive privacy disclosures for the PocketSQL Android Mobile Application and official web services.
1. Executive Summary: The Zero-Knowledge Commitment
PocketSQL is engineered from the ground up as a 100% offline-first, private embedded SQL database engine and local REST API server for Android (app.pocketsql.database).
02. Scope & Applicability
This Privacy Policy describes how PocketSQL ("we", "us", "our", or "the Application") treats data when you:
- Install, configure, or execute the PocketSQL Android Application (available via Google Play Store, direct APK download, or GitHub Releases).
- Utilize the embedded local HTTP/TLS REST and WebSocket API server hosted directly on your physical Android hardware.
- Visit, interact with, or submit inquiries through the official PocketSQL website (
https://pocketsql.prahlix.com).
This policy does not apply to third-party tools, remote database drivers, or local networks configured by the end-user outside of PocketSQL's embedded runtime.
03. What We Never Collect: Zero-Telemetry Guarantee
Unlike conventional software, PocketSQL is architected on the principle of zero data collection. We categorically state that:
We do not collect names, phone numbers, email addresses, government IDs, physical addresses, or Google Account identities through the mobile app.
Your SQL schemas, table structures, column definitions, stored records, queries, and transaction histories never leave your device. We have zero visibility into what you store.
PocketSQL requests zero GPS, coarse Wi-Fi triangulation, accelerometer, camera, microphone, or Bluetooth peripheral permissions.
We do not bundle Google Advertising IDs (GAID), tracking pixels, Facebook SDKs, Adjust, AppsFlyer, or any monetization analytics software.
04. Android System Permissions & Strict Technical Justifications
Compliant with Android 13/14/15 GuidelinesPocketSQL requests solely the minimum operating system permissions required to provide offline SQL processing and local network API server execution:
Technical Justification: Required strictly to bind local network server sockets (127.0.0.1 and your local LAN IP e.g. 192.168.x.x). This allows your PC, IoT devices, or other LAN clients to send SQL queries to your phone over local Wi-Fi. PocketSQL never initiates outbound connections to external surveillance or cloud tracking servers.
Technical Justification: Required exclusively to determine the Android device's assigned local IP address (e.g., http://192.168.1.42:8080) and display it directly on the app's dashboard screen so you know which address to query from your development machine.
Technical Justification: Keeps the embedded SQL engine daemon alive when the user navigates away, opens another IDE/app, or turns the device screen off. Without this, Android's aggressive Doze mode and memory killer would abruptly terminate active database connections and corrupt ongoing transactions.
Technical Justification: Required on Android 13 (API 33) and higher to display the permanent, transparent status bar notification while the server is active. The notification shows the active server port, connection status, and provides an immediate one-tap "Stop Server" button for user peace of mind.
Technical Justification: Prevents the CPU from entering deep sleep during intensive batch query executions, database migrations, or large CSV table imports.
Technical Justification: PocketSQL does not request broad external storage access. When you manually export a database (.sqlite, .sql, or .csv) or import a schema, Android's native system file picker is triggered. PocketSQL only accesses the exact file you selected.
05. On-Device Storage, Sandboxing & Hardware Encryption
PocketSQL adheres to strict Android security sandboxing standards:
-
Internal App Sandbox: All raw database files are stored inside internal scoped application storage (
/data/data/app.pocketsql.database/databases/). Android OS security prevents any other non-root application from accessing, reading, or tampering with these files. - Hardware-Backed Keystore: Master application secrets and encrypted authentication tokens are secured with AES-256 GCM backed by the Android Keystore System (utilizing hardware TEE / StrongBox where available on your device).
- Optional At-Rest Encryption (SQLCipher): Users may activate native 256-bit AES encryption across the entire database file, rendering physical storage dumps unreadable without the passphrase.
06. Local Network API Server Security
When the PocketSQL API server is toggled on:
All REST endpoints (/v1/query, /v1/schema, /v1/tables) require a secret API token in the Authorization: Bearer <token> header. Queries without a valid token are immediately rejected with HTTP 401 Unauthorized.
PocketSQL includes an on-device self-signed X.509 certificate generator, allowing HTTPS over local Wi-Fi to prevent any packet sniffing or man-in-the-middle attacks on your local subnet.
By default, the server can be restricted to loopback (127.0.0.1) so that only ADB tunnels or apps on the same phone can communicate, or opened to the Wi-Fi interface (0.0.0.0) with explicit user consent.
07. Website Data Collection, Forms & Cookies
When accessing our web portal (https://pocketsql.prahlix.com):
If you send a message through our Contact form (https://pocketsql.prahlix.com/contact), we collect your name, email address, subject, and message. This data is used exclusively to answer your question, debug reported bugs, or provide developer assistance. We never sell, lease, or share your contact info with marketing syndicates.
Our web servers temporarily record standard HTTP connection metadata (client IP address, user-agent string, timestamp, requested URL, response code). This data is strictly utilized for DDoS mitigation, bot blocking, rate limiting, and computing aggregated download numbers. Raw IP addresses are automatically truncated or discarded within 30 days.
We do not use third-party tracking, advertising, or cross-site profiling cookies. We only set strictly necessary first-party session cookies (XSRF-TOKEN and laravel_session) to protect against Cross-Site Request Forgery (CSRF) and authenticate administrative logins.
08. Crash Diagnostics & Bug Reporting
PocketSQL does not include silent or background crash uploaders (such as Google Firebase Crashlytics or Sentry).
If an unhandled exception or crash occurs in the app, the error stack trace is stored purely within local private app storage. If you choose to file an issue on our GitHub repository or email our support desk, you may optionally attach the sanitized stack trace. We explicitly advise users to review and sanitize logs prior to sharing.
09. Third-Party Platforms & External Links
Our application and website may contain links to external platforms:
- Google Play Store: Subject to Google’s Privacy Policy when downloading from the Play Store.
- GitHub: Used for public source code, release tags, and bug tracking. Interacting with GitHub is governed by GitHub’s Terms of Service and Privacy Statement.
- Donations / Sponsorships: We provide links for optional donations (GitHub Sponsors, Buy Me a Coffee, USDT/BTC). Transaction processing is handled entirely by these platforms; PocketSQL never handles, stores, or sees your financial account details.
10. Children's Privacy Protection (COPPA & GDPR-K)
PocketSQL is an advanced developer utility designed for software engineers, database administrators, and computer science students. It is not directed at or targeted towards children under the age of 13 (or under 16 in the European Union). We do not knowingly collect, request, or solicit personal data from children. If we learn that personal data of a child has been submitted to us through the website, we will promptly delete it.
11. Your Global Legal Rights (GDPR, CCPA/CPRA, LGPD)
Regardless of your geographical location, you have comprehensive rights regarding your data:
Because 100% of your SQL data is stored on your device, you have immediate, unfettered access to all tables, indexes, and records at all times.
You can export your databases into universal, open formats (.sqlite, .sql dump, or CSV) with zero vendor lock-in.
Dropping a table or clearing app data in Android Settings instantly and permanently deletes your data with zero residual cloud copies.
We do not sell personal data (as defined under CCPA). You will never receive degraded functionality for exercising privacy rights.
12. Data Retention & Disposal Timeline
- Android App Data: Retained locally on your device for as long as you keep PocketSQL installed. Uninstalling the app permanently purges all sandboxed databases.
- Website Contact Submissions: Retained for a maximum of 12 months following resolution of your support inquiry, after which messages are purged from our database.
- Ephemeral Server Logs: Rotated and overwritten within 30 days.
13. Modifications to this Privacy Policy
We may update this Privacy Policy from time to time to reflect modifications in operating system APIs, regulatory compliance requirements, or new embedded engine capabilities. Any revisions will be published immediately on this URL with an updated "Last Updated" timestamp. We encourage users to periodically review this page.
14. Contact & Data Protection Inquiries
If you have questions, feedback, or legal inquiries concerning this Privacy Policy, our offline architecture, or your privacy rights, please reach out directly: