Privacy Policy

Last updated July 13, 2026

Pokobot (“Poko”, “we”, “us”) is a reminder assistant you talk to inside WhatsApp. This policy explains what data we collect, why, and how we protect it — with a dedicated section on the Google user data we access when you connect Google Calendar.

Who we are

Pokobot is operated as an independent service reachable at our WhatsApp number and at pokobot.com. For any privacy question, email sudhanshu@radicallabs.io.

What we collect

• Your WhatsApp number and messages to Poko. We use these to understand your reminder requests and reply to you. We do not read messages you send to anyone else — only what you send to Poko.
• Reminders and preferences you create — the text, time, recurrence, and timezone of each reminder, so we can poke you at the right moment.
• Google account data — only if you explicitly connect Google Calendar (see below). This is entirely optional; reminders work without it.

Website click measurement

When you tap a WhatsApp button, we record the page, original landing page, referral and campaign information, browser information, language, and timezone. We use this to understand how people find Poko. A random identifier in your browser tab's session storage helps us distinguish repeat clicks and preserve the original source as you navigate. It renews after 30 minutes without a page change or tap and is not sent to WhatsApp. Our click log does not store your IP address.

Google Calendar integration & Google user data

Connecting Google Calendar is optional and initiated by you through a Google sign-in screen. When you connect, we request the following scopes:

• openid and email — to identify your Google account and show you which account is connected.
• https://www.googleapis.com/auth/calendar.events — to view and manage events on your calendar on your behalf, entirely in response to your WhatsApp requests: reading your agenda when you ask, creating events and meetings you dictate, and deleting events you tell Poko to cancel.

We only access your calendar in direct response to a message you send — for example “what’s on my calendar tomorrow?” or “set up a meeting with Priya at 3pm.” We do not access, scan, or sync your calendar in the background.

How Google data is stored

• We store the OAuth refresh token Google issues so you don’t have to reconnect each time. It is encrypted at rest using AES-256-GCM.
• We do not keep a copy of your calendar events. Event data is fetched from Google live when you ask and used only to form the reply — it is not stored in our database.

Limited Use disclosure

Pokobot’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, we do not:

• use Google user data for serving advertisements;
• transfer or sell Google user data to third parties, data brokers, or for any purpose unrelated to providing the reminder and calendar features you requested;
• allow humans to read your Google data, except with your explicit consent, to comply with law, or as strictly necessary for security (e.g. investigating abuse);
• use Google user data to train generalized AI/ML models.

How your data is used

Solely to operate the service: parse your requests, schedule and send reminders, and — if connected — read and manage your calendar as you direct. To interpret your natural-language messages we send the relevant message text to our language-model provider for processing; your Google refresh token is never shared with them.

Sharing

We do not sell your data. We share it only with the infrastructure providers needed to run Poko (messaging, hosting, database, and the language-model provider that parses requests), each acting on our instructions.

Retention & deleting your data

• Disconnect Google Calendar anytime by asking Poko to disconnect, or by revoking access at myaccount.google.com/permissions. On disconnect we delete your stored refresh token.
• Delete everything — message Poko or email sudhanshu@radicallabs.io and we will remove your reminders and account data.

Security

Sensitive credentials such as Google refresh tokens are encrypted at rest. Access to production systems is restricted, and data is transmitted over encrypted connections.

Children

Pokobot is not directed to children under 13.

Changes

We may update this policy; material changes will be reflected by the “last updated” date above.

Contact

Questions? Email sudhanshu@radicallabs.io or say hi on WhatsApp.

← Back to Pokobot