Rocky — privacy policy
Last updated: 18 September 2026
Rocky is a personal assistant app built by one person for their own household. It is distributed only through Google Play internal testing and is not offered to the public.
Who runs it
Rocky has no company behind it and no shared servers. The app talks to a server the user runs themselves, on their own computer at home. There is no Rocky account, no sign-up, and no hosted backend operated by anyone else.
How the phone reaches that server
The phone reaches the home server over the public internet through a Cloudflare Tunnel, with Cloudflare Access in front of it and a device token as a second lock. Nothing is exposed to the internet without both.
Being straightforward about what that means: a tunnel terminates TLS at Cloudflare's edge, so the connection is encrypted from the phone to Cloudflare and again from Cloudflare to the home server, but Cloudflare is technically able to see the traffic in between. It is not end-to-end encrypted. This was a deliberate trade for a connection that works reliably on mobile data.
What the app collects
Nothing is collected by the developer. The app sends no analytics, no crash reporting, no advertising identifiers and no usage data anywhere. There are no third-party SDKs for tracking or ads.
What the app handles — and where it goes:
| Data | Why | Where it goes |
|---|---|---|
| What the user types or says to Rocky | To answer and to act on it | The user's own server; kept in a database file on their own machine |
| Photos the user sends Rocky | So Rocky can read what is in them (a delivery note, a bill, a recipe) | The user's own server, where the picture is read and then deleted. Only a record the user keeps (a recipe's own photo) is stored |
| Microphone audio | The voice screen turns speech into text | Handled by Android's own speech recognition on the device. Rocky receives only the resulting text, and never stores or transmits audio |
| Notifications | Reminders and check-ins the user asked for | Sent by the user's own server to their own phone |
| Household data the user enters (shopping lists, pantry, recipes, notes, reminders) | The features themselves | The user's own server only |
Where data leaves the house
- Anthropic's Claude. The user's own server sends text — and a photo, when the user sends one — to Claude to produce Rocky's replies, under the user's own subscription and Anthropic's terms.
- Public information fetched on the user's behalf: web searches, recipe pages and the weather for their town.
- A nightly backup of the database to Cloudflare R2 (private object storage on the user's own account, the last 30 kept), so a broken machine does not lose the household's data. This means a copy of everything Rocky knows is held by Cloudflare on the user's behalf.
- Firebase Cloud Messaging sends a content-free "check in" ping so notifications arrive in seconds. The ping carries no message text — it only tells the phone to ask the home server whether anything is waiting. Google therefore sees that a ping happened, never what it was about.
The app itself contacts nothing but the user's own server. Android's speech recognition and text-to-speech are provided by the device and governed by the device maker's and Google's own policies.
Google account access
If the user connects their Google Calendar, Rocky asks for permission to read their calendar and to create, move and delete events. It never asks for whole-calendar management. Calendar changes are always proposed first and only carried out after the user says yes. The access token is stored on the user's own server and nowhere else, and access can be withdrawn at any time from the user's Google account permissions. Gmail, when connected, is read-only and uses an app password the user creates themselves.
Permissions
- Microphone — only while the voice screen is open, to turn speech into text.
- Photos — only the pictures the user picks to send to Rocky.
- Notifications — to show the reminders and check-ins the user set up.
- Internet — to reach the user's own server.
- Alarms — to show time-based reminders.
Keeping and deleting data
All data lives on the user's own server and phone, plus the nightly backup described above. Deleting the app removes its local copy; deleting the database file and the backups on the user's own accounts removes the rest. There is nothing held by the developer to request or delete, because nothing is held by the developer.
Children
Rocky is not intended for children and is not distributed publicly.
Changes
If this policy changes, the updated version replaces this page.
Contact
Questions about this policy: the developer, via the email address on the Play listing.