This Privacy Policy describes how Stedfast Softworks LLC ("we," "us," or "our") collects, uses, and protects information when you use the Socket application and related services (collectively, the "Service").
If you are looking for deletion instructions, go to the Data Deletion section.
1. Information We Collect
1.1 Account Information
Socket asks you to sign in when you make a purchase, so that what you bought follows you to your other devices. When you sign in with Apple or Google, we store the account identifier that provider gives us and, when the provider supplies a verified email address, a one-way hash of that address. A hash cannot be reversed back into an address: we use it only as a support-time hint that you may already have a Socket account, and we never store the address itself. We do not ask for or store your name.
If you subscribe to a paid tier, our payment processor collects your payment information. We do not store credit card numbers or bank account details directly.
1.2 Workflow Data
When you create and run automations ("Arcs"), Socket processes the data involved in those workflows. This may include the content of emails, calendar events, documents, messages, and other information from services you connect through Links. This data is processed solely to execute your requested automations.
Some Arcs are ones you keep on — a plan you work through over days or weeks. So that the same plan is there on every device you use Socket from, that plan is stored on our servers: the goal you wrote, the tasks and their titles, the notes and messages you add to it, and the places you saved to it. It is encrypted at rest with a key held for this purpose alone, and it is used only to run that plan and keep your devices in agreement about it. Section 4 says how long it is kept.
1.3 Data Sent to AI Providers
Socket uses third-party large language model (LLM) providers to power its AI agents. When your agents execute workflows, relevant portions of your data are sent to these providers for processing. We select providers who contractually commit to not training their models on your data. The specific providers used may change over time, and the current list is available within the application.
1.4 Connected Service Data
When you connect third-party services through Links (such as email providers, calendar services, cloud storage, messaging platforms, or smart home devices), Socket accesses data from those services as authorized by you and only to the extent necessary to execute your automations. We do not retain data from connected services beyond what is needed to run your Arcs, which for an Arc you keep on means the plan described in Section 1.2.
1.5 Usage and Analytics Data
We collect usage data to improve the Service, including which features are used, workflow success rates, error logs, and general performance metrics. This data is aggregated, and the content of your conversations and Arcs is not part of it and cannot be reconstructed from it. The device and install identifiers used for install attribution are the one exception to that, and Section 1.7 describes them separately.
1.6 Device Information
We collect basic device information including device type, operating system version, app version, and unique device identifiers. This information is used for troubleshooting, security, and ensuring compatibility.
1.7 Install Attribution
To know which ads and posts actually bring people to Socket, we work with AppsFlyer, an install-attribution provider. AppsFlyer receives device and install identifiers, install and launch events, and the campaign parameters of the link you arrived through. Nothing about your conversations or your Arcs is part of it, and we never use it to show you ads.
You decide whether your device's advertising identifier is part of that. On iOS, it is included only if you allow tracking when Apple asks; on Android, Socket asks you directly and sends nothing until you answer. If you decline on either platform, attribution still runs, but with advertising identifiers switched off and your install anonymized. You can change your answer later in Socket's Settings on Android, and in the iOS Settings app on iPhone and iPad.
2. How We Use Your Information
We use the information we collect for the following purposes:
- To provide and operate the Service, including executing your workflow automations
- To process payments and manage your subscription
- To communicate with you about your account, service updates, and support requests
- To improve the Service through aggregated, anonymized analytics
- To measure which ads and posts bring people to Socket, as described in Section 1.7
- To detect and prevent fraud, abuse, and security incidents
- To comply with legal obligations
We do not use your workflow data or connected service data to train AI models. We do not sell your personal information to third parties.
3. How We Share Your Information
We share your information only in the following circumstances:
- AI Providers: Workflow data is sent to LLM providers to execute your automations, subject to the terms described in Section 1.3.
- Payment Processors: Payment information is processed by Apple (App Store), Google (Play Store), and RevenueCat to manage subscriptions.
- Connected Services: When you authorize a Link, Socket interacts with that service on your behalf using the permissions you granted.
- Install Attribution: AppsFlyer receives the device and install identifiers, install and launch events, and campaign parameters described in Section 1.7, subject to the choice you made in Apple's tracking prompt or Socket's own attribution question on Android.
- Legal Requirements: We may disclose information if required by law, legal process, or government request.
4. Data Retention
Account information is retained for as long as your account is active. When you ask us to delete your account, we delete the personal information we hold about you, except where retention is required by law. Section 6.1 explains how to make that request and what we may need to keep.
Arcs you keep on. A plan you keep on is stored while it is on. When you remove it, or turn it off and abandon it, its plan and its history are kept for 30 days and then deleted from our servers automatically. A verified account-deletion request removes them along with the rest of your data.
Data from a one-off Arc run is retained only for the duration necessary to complete the requested automation, plus a short period for error recovery and support purposes.
Anonymized analytics data may be retained indefinitely as it cannot be linked to individual users.
5. Data Security
We implement industry-standard security measures to protect your information, including encryption of data in transit (TLS 1.2+) and at rest. Access to user data is restricted to systems and personnel that require it for service operation.
While we take reasonable measures to protect your data, no method of electronic transmission or storage is completely secure. We cannot guarantee absolute security.
6. Your Rights and Choices
Depending on your location, you may have the following rights regarding your personal information:
- Access: Request a copy of the personal information we hold about you.
- Correction: Request correction of inaccurate personal information.
- Deletion: Request deletion of your personal information and account.
- Portability: Request a copy of your data in a portable format.
- Withdrawal of Consent: Revoke consent for data processing at any time by disconnecting Links or deleting your account.
To exercise these rights, contact us at [email protected].
6.1 Data Deletion
To request deletion of your Socket account or personal data stored by Socket, email [email protected] from the email address associated with your account and use the subject line Data Deletion Request.
- Send your request from the email address tied to your Socket account, or include enough information for us to verify ownership.
- Tell us whether you want us to delete your full account or only specific data connected to the Service.
- We may ask you to verify the request before we delete anything.
We work through verified requests as quickly as we can and write back to you when the deletion is done.
What We Delete: Once we verify your request, we delete or de-identify the personal data stored by Socket that is associated with your account, including account profile information, saved settings, stored connection credentials, the plans of any Arcs you kept on, and support messages linked to your request.
What We May Retain: We may retain limited records when required for legal compliance, fraud prevention, security incident response, subscription or billing disputes, and anonymized analytics that cannot identify you. When retention is required, we limit access and keep the data only as long as necessary for those purposes.
7. Children's Privacy
The Service is not directed to children under the age of 13 (or the applicable age of consent in your jurisdiction). We do not knowingly collect personal information from children. If we become aware that a child has provided us with personal information, we will take steps to delete that information.
8. International Data Transfers
Socket's servers are in the United States, and our service providers may process your information in the United States and in other countries where they operate. By using the Service, you consent to the transfer of your information to countries that may have different data protection standards than your country of residence.
If you are in the United Kingdom or the European Economic Area, we rely on the European Commission's Standard Contractual Clauses — with the UK International Data Transfer Addendum where the United Kingdom applies — as the safeguard for those transfers, together with the technical measures described in Section 5. Write to [email protected] for a copy of the clauses that cover your data.
9. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy within the application and, where required, by email. Your continued use of the Service after changes take effect constitutes acceptance of the updated policy.
10. Contact Us
If you have questions about this Privacy Policy or our data practices, contact us at:
Stedfast Softworks LLC Email: [email protected] Website: https://socket.link/privacy