Privacy policy

1. Information we collect

• Account — your name, email address, and a hashed password, or the profile Google or GitHub shares when you sign in with them (see section 2).
• Organization — workspace name, member list and roles, invitations, and audit events for actions taken in the dashboard.
• Billing — your plan, credit balance, and invoices. Payments run through Stripe; card numbers never touch Sokko's servers.
• Workloads and content — the agents and devboxes you deploy, their configuration, workspace files, and the environment secrets you store. Secrets are kept encrypted in an isolated vault and are only released to the workload they belong to.
• Agent memory — when you enable the memory add-on, the notes your agents choose to remember are stored in your organization's private memory workspace.
• Usage and logs — request logs, IP addresses, and operational metrics we need to keep the platform healthy and to prevent abuse.
• Support — emails you send us and the context needed to answer them.

2. Signing in with Google or GitHub

If you use social sign-in, Google or GitHub sends us your name, email address, and avatar, and we use them only to create and sign in your account. We request no further scopes: no access to your repositories, contacts, files, or calendars, and we never post or act on your behalf. Connecting a GitHub account for repository access is a separate, explicit step with its own consent screen.

3. How we use your data

We use the data above to operate the service: running your agents, authenticating you, billing your plan, sending transactional email (sign-in verification, password resets, invitations, billing notices), answering support requests, and protecting the platform against abuse.

We do not sell personal data, we do not share it with advertisers, and we do not use your workspace content or agent conversations to train models.

4. Cookies and analytics

Sokko sets session cookies that keep you signed in; they are essential and first-party. Website analytics run on Plausible, which is cookie-free and collects no cross-site identifiers. There are no third-party advertising cookies.

5. Where your data lives and how it is protected

Sokko's core infrastructure runs on Hetzner in the European Union. Each organization's workloads run in their own isolated environment, traffic is encrypted in transit, and stored secrets are encrypted with keys protected by a cloud key-management service. Access to production systems is restricted to the operators who run the platform.

6. Subprocessors

We rely on a small set of providers to run Sokko. Each one processes only what its role requires:

• Hetzner — cloud infrastructure (EU).
• Google Cloud — encryption key management.
• Stripe — payments and invoicing.
• Cloudflare — storage and content delivery.
• Resend — transactional email.
• Plausible — cookie-free website analytics.
• OpenRouter — model routing when you use Sokko credits instead of your own model keys.

Services you connect yourself — model providers such as OpenAI or Anthropic, and integrations such as GitHub, Slack, Telegram, Tailscale, or Cloudflare tunnels — receive data only after you connect them, under their own terms.

7. Your model providers

When you bring your own model keys, we store them encrypted and use them only to run the agents you configured. Prompts and outputs flow directly between your workloads and the provider you chose, under that provider's terms and privacy policy.

8. Retention and deletion

We keep your data for as long as your account is active. Deleting an agent or devbox removes its workload and the secrets bound to it. Deleting your organization, or asking us to delete your account at support@sokko.ai, removes the associated data from live systems, after which it ages out of operational backups. We may retain what invoicing and tax law requires us to keep.

9. Your rights

You can access, correct, export, or delete your personal data. If you are in the European Economic Area or the UK, you additionally have the rights the GDPR grants, including the right to object to processing and to complain to your supervisory authority. To exercise any of these rights, email support@sokko.ai.

10. Changes to this policy

When this policy changes, we update this page and its date. If a change meaningfully reduces your rights, we notify account owners by email first.

11. Contact

Sokko · https://sokko.ai · support@sokko.ai