Privacy Policy

The short version

The app doesn't track you. Pokey sits on your screen, moves a hand cursor around, and minds its own business. It has no analytics, records nothing, and sends nothing anywhere except to check your license and look for updates.

This website does. pokeyapp.com runs Google Analytics and an X (Twitter) advertising pixel, because ads are how people find a $9.99 Mac app. Those are two different stories, and the rest of this page keeps them apart.

Part 1 — The app

What Pokey accesses on your Mac

• Your screen — to render the cursor overlay. Nothing is recorded or transmitted.
• Mouse position — to follow your cursor. Processed locally, never stored.
• Keyboard input — to detect the hotkey toggle. No keystrokes are logged.

Pokey does not access your microphone, camera, location, contacts, calendar, or any other system data. Your settings live locally in macOS UserDefaults; your license key lives in the macOS Keychain.

What the app sends over the network

• License activation and deactivation — your license key and your computer's name (the one macOS shows in Sharing settings, often containing your first name) are sent to Polar, so a key can be tied to a device and the activation limit enforced. This is necessary to give you the licence you paid for.
• Update checks — the app periodically requests an update file from pokeyapp.com. It sends no system profile; as with any web request, our host sees the IP address and the request itself.

That is the complete list. No usage data, no behavioural data, no crash telemetry.

Part 2 — This website

When you visit pokeyapp.com, the following happens.

Analytics

We use Google Analytics 4 to see how the page performs: pages viewed, where visitors came from, whether they played the demo video, clicked the buy button, or completed a purchase. Google receives your IP address (which it uses to derive an approximate location and then discards) and an analytics identifier stored in a cookie.

Advertising

We advertise Pokey on X (Twitter), and we measure whether those ads lead to purchases. This happens through two channels:

• The X pixel in your browser — a script from X that loads with the page, sets cookies, records a page view, and records a purchase on the confirmation page. X uses this to measure ads and to build advertising audiences.
• A server-to-server report — when a purchase completes, our server tells X about it directly. That report contains the purchase amount, the ad-click identifier if you arrived from an X ad, your IP address and browser user-agent, and a SHA-256 hash of your email address so X can match the purchase to an account. A hash is not anonymous, and we treat it as personal data. Note that this report is sent by our server, so an ad blocker or tracker blocker in your browser does not prevent it.

Buying

Purchases are processed by Polar, which acts as merchant of record. We never see or store your card details. After payment, our server asks Polar for the order status, the amount, and your email address — the email is used only to produce the hash described above and is deliberately stripped out before anything is sent back to your browser.

Emailing yourself the link

If you are on a phone and ask us to send the download link to your inbox, the address you type goes to Resend, which delivers that one email. We do not add you to a mailing list and we do not email you again.

Hosting

The site runs on Vercel, which keeps short-lived server logs (IP address, requested URL, user-agent) as part of running and securing the service.

Cookies and local storage

None of the below is set until you allow it. The site itself needs no cookies to work — there is nothing to log into and no cart to remember — so if you decline, nothing is stored on your device at all. Set in your browser once you've said yes:

• _ga, _ga_PZMRGDR1H6 — Google Analytics visitor identifier.
• _twclid, _twpid — X pixel: the ad-click reference and a visitor identifier.
• pokey-twclid (local storage) — the ad-click reference from the URL you arrived on, kept for 30 days so a purchase can be credited to the ad that led to it.
• pokey-purchase-… (local storage) — a note that a given purchase has already been reported, so it isn't counted twice.

Set by X when its pixel loads, on X's own domains:

• guest_id, guest_id_ads, guest_id_marketing, personalization_id on x.com and twitter.com, and muc_ads on t.co — X's own advertising and personalisation cookies, governed by X's privacy policy.

One exception, and it is the reason a “reject everything” still leaves a trace: the purchase report our server sends to X doesn't travel through your browser, so it isn't stopped by clearing cookies. It is governed by your consent all the same — decline, and the server doesn't send it.

Why we're allowed to do this

• Selling you the app and activating your licence — performance of our contract with you.
• Sending the download link you asked for — your request.
• Keeping the site up and secure — our legitimate interest in running it.
• Analytics and advertising measurement — your consent, which we ask for before anything loads and which you can withdraw at any time. Withdrawing doesn't undo what happened before you did it.

Who else gets your data

We don't sell your data, and we share it only with the services that make Pokey work: Polar (payments and licensing), Vercel (hosting), Google (analytics), X (advertising measurement), and Resend (that one email).

Several of these are based in the United States, so using this site involves transferring personal data outside the EU/EEA and the UK, under the safeguards those providers rely on — the EU–US Data Privacy Framework or standard contractual clauses.

How long it's kept

• Analytics data — retained by Google for up to 14 months.
• Advertising data — retained by X under their own schedule.
• Purchase and licence records — kept by Polar for as long as tax and accounting law requires.
• The download-link email — the address is not stored by us after the email is sent.
• Local storage on your device — as listed above; clearing site data removes it immediately.

Your choices

• Change your mind here — open cookie settings to turn analytics or advertising on or off. The same link sits in the footer of every page, and it works whether or not you were ever shown the banner.
• Clear what's already there — your browser can block cookies and site data for this site; clearing site data removes everything listed above.
• Opt out of Google Analytics — Google's browser add-on disables it across every site that uses it.
• Opt out of X's ad personalisation — in your X privacy settings.
• Ask us directly — email pokey@talktomike.link and we'll do it for you, including asking X and Google to delete what relates to you.

Your rights

If you're in the EU/EEA or the UK, you can ask us for a copy of your personal data, ask us to correct or delete it, object to how we use it, ask us to restrict it, or ask for it in a portable form. Write to pokey@talktomike.link and we'll answer within one month.

You can also complain to a data protection authority. In Spain, where Pokey is run from, that is the Agencia Española de Protección de Datos; in the UK, the ICO.

If you're in California, you have the right to know what we collect, to have it deleted, and to opt out of the sharing of personal information for cross-context behavioural advertising — which is what the X pixel does. Use cookie settings, linked in the footer, to switch it off — or email us and we'll do it for you. We do not sell personal information for money, and we do not knowingly collect anything from children under 16.

Who's responsible

Pokey is an independent Mac app, made and operated from Madrid, Spain. The data controller is Yana Kosenkova (autónomo), Madrid, Spain, reachable at pokey@talktomike.link — that address reaches a person, not a ticket queue.

Changes

If what we collect changes, this page changes with it and the date at the top moves. There is no version history to dig through — what's on this page is what's true today.