Privacy Policy

Last updated 22 October 2026.

Bokka is a keyboard-first inbox and light CRM for your own LinkedIn messages: a web app at app.gobokka.com, its Chrome extension, and the website at gobokka.com. Bokka is run from Deoghar, Jharkhand, India. This policy says what we collect, where it is kept, why, who helps us, and what you can do about it. "We" and "us" mean Bokka; "you" means the person using it.

In short

• Your messages stay on your device. Their text, attachments and the full profiles of the people you talk to are kept in your browser, never on our servers.
• Our servers keep your account, what you organise (labels, stages, notes, reminders, snippets) and a list of your conversations without their messages, so your work follows you across devices.
• AI features send text to our AI provider only to answer you; nothing is kept there or used to train a model.
• We don't sell your data, show ads, or use it for anything but running Bokka.
• You can delete your account, and everything we keep for it, from Settings.

1. What stays on your device

When Bokka reads your LinkedIn inbox, it keeps the messages, their attachments and the profiles of the people in your conversations in your browser's own storage on the computer you use. They are never written to our database, logs, analytics or emails. Signing out on a device, clearing the app's data, or removing the extension deletes them from that device. Another device reads your inbox from LinkedIn again.

2. What our servers keep

• Your account: your email, your name, and if you sign in with Google, your Google account id and profile picture. Your plan and trial dates.
• Your LinkedIn account: its LinkedIn profile id and name, to tie your workspace to it and to give each LinkedIn account one trial.
• Your conversation list, without the messages: for each conversation, the LinkedIn profile ids and names of the people in it, the other person's LinkedIn headline, when it was last active, who wrote last, and whether it is read, archived or snoozed. Never the text of a message or an attachment. This is what lets your labels, stages, reminders and follow-up lists work on every device.
• What you create: labels, pipelines and stages, notes, custom fields and their values, reminders, snippets, saved views and your settings.
• Numbers for your analytics: daily totals such as new connections and replies, as numbers, not people.
• Billing: your plan, your subscription's status and your customer id at our payment provider. Your card details stay with the payment provider; we never see them.
• AI use: how many AI calls you made each day, for which feature, and their tokens and cost. Never what was sent or answered.
• Connections you set up: the integrations you add (webhook addresses, and Notion or Google access, encrypted with our own key) and the AI assistants you connect, with a log of which tool was used and when, never what it read.
• Email and security: which emails we sent you and whether you unsubscribed; your IP address and email, hashed, for a few minutes, to limit repeated sign-in attempts.
• The waitlist: if you join it on our website, your email and, if you choose one, what you'd use Bokka for, to send you one thank-you email and tell you when your early access opens. Your IP address, hashed, for a few minutes, to limit repeated sign-ups.

3. The Chrome extension

The extension lets the web app read and send your own LinkedIn messages through your own LinkedIn session, from your own computer, only while you have Bokka open. It adds nothing to LinkedIn's pages and doesn't read them; it runs no background sync. Each permission is used for this alone:

• Access to www.linkedin.com: to make the requests the app asks for (your inbox, a conversation, sending a message you wrote), one at a time and paced. It also sees the address of each LinkedIn tab, only to open Bokka when you go to LinkedIn's messaging page. It keeps which tabs are there until you close the browser and sends none of it anywhere.
• Cookies: to read LinkedIn's JSESSIONID cookie, which LinkedIn requires as a security token on each request. It is used inside the extension only, never shown to the page, logged or sent to us. Your LinkedIn sign-in cookie (li_at) is never read.
• Storage and alarms: to keep the extension's settings and refresh its configuration.
• Network rules: to remove the extension's own origin from its requests to LinkedIn, which LinkedIn otherwise refuses. Nothing else is changed.
• Menu: the switch in the toolbar icon's menu that turns opening Bokkafrom LinkedIn's messaging page on or off.

What the extension fetches goes to the Bokka tab on your computer, not to our servers.Bokka's use of information received through the extension complies with the Chrome Web Store User Data Policy, including its Limited Use requirements: it is used only to provideBokka's features, never sold, never used for advertising, credit or lending decisions, and never read by people except with your permission, for security, or where the law requires.

4. AI features

AI is included, with daily limits, in the trial, and on Pro and Team. When you use an AI feature, the text it needs (a conversation's recent messages, a voice message you ask to transcribe, or your snippets) goes to our AI provider to produce the answer. Sorting new messages and summaries when you open a conversation run without a click only if you turn them on in Settings. Our AI provider routes requests to model hosts in the United States and the European Union under zero data retention: neither it nor they keep what was sent, and it is never used to train a model. Drafts, summaries and transcripts stay in your browser; nothing the AI writes is kept on our server. AI never sends, archives or changes anything on LinkedIn by itself.

5. AI assistants you connect (MCP)

On Pro and Team you can connect an AI assistant, such as Claude or ChatGPT, to Bokka. Only after you choose Allow, and only while Bokka is open in your browser, the assistant can ask for the conversations, people and invitations stored there. Your browser answers; the answer passes through our servers in memory, encrypted, to the assistant you connected. We don't keep it or log it. What the assistant does with it is governed by its provider's terms. Disconnect any assistant in Settings.

6. Integrations you connect

On Pro and Team you can send conversations to a webhook, a Notion database or a Google Sheet you choose. Your browser builds what is sent, with only the fields that destination's settings allow (message text is off unless you turn it on), and it passes through our servers in memory to that destination. We keep whether a delivery worked, never what it carried. Once delivered, it is governed by that destination's terms.

7. Google sign-in and Google Sheets

If you sign in with Google, we receive your name, email and profile picture, and nothing else. If you connect Google Sheets, Bokka asks only for access to the spreadsheets you create or choose with it (the drive.file permission), adds rows to them, and can't see any other file. Bokka's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We don't use Google user data for advertising, don't sell it, and don't let people read it except with your permission, for security, or where the law requires.

8. Why we use your information

• To run Bokka for you: your account, sync across devices, AI and integrations you ask for (our contract with you).
• To keep it working and safe: preventing abuse, limiting sign-in attempts, fixing problems (our legitimate interest in a reliable, secure service).
• To improve it: counting which features are used, without message content, names or emails (our legitimate interest; you can ask us to stop).
• To email you about your account, your trial and your plan; you can unsubscribe from all but essential account emails.
• To bill you, keep records the law requires, and answer legal requests.
• Where we rely on your consent, such as AI that runs without a click, you can withdraw it at any time in Settings.

9. Who helps us

These service providers process data for us, only to provide their service, under contract:

• Supabase: our database and sign-in (United States).
• Vercel: hosting the app and website (United States).
• Our AI provider: AI features, under zero data retention (United States and EU).
• Dodo Payments: our merchant of record, which sells you the subscription and handles payment, invoices and tax.
• Resend: sending our emails.
• PostHog: product analytics, with no cookies, no recorded sessions and your IP address discarded.
• Upstash: limiting repeated sign-in attempts.
• Inngest: running background jobs such as processing payment notices.
• Cloudflare: our domain, the bot check on sign-in forms, and forwarding our email.

Beyond them we share data only with the destinations and assistants you connect, when the law requires it, to protect our users or Bokka, or as part of a sale or merger of Bokka, under this policy. We don't sell or rent your data.

10. Cookies and browser storage

We set one cookie to keep you signed in, and one to remember your theme. There are no advertising or tracking cookies, and our analytics uses none. The bot check on sign-in forms may set its own short-lived cookie. Your messages and preferences are kept in your browser's storage, as described above.

11. Where your data is kept

Our servers and database are in the United States. If you use Bokka from India, the UK, the EU or elsewhere, your information is transferred there, and our providers protect such transfers with the safeguards the law requires, such as standard contractual clauses.

12. How long we keep it

• Your account and everything you organise: while you have an account. When you delete it, they are deleted at once, and from our backups within 30 days.
• After deletion we keep only a record that your LinkedIn account used its trial, and the billing records the law requires (held by our payment provider).
• Product analytics: up to 12 months.
• The waitlist: until your early access opens and you've had time to sign up, or sooner if you ask us to remove you.
• On your device: until you sign out, clear the app's data or remove the extension.

13. Security

Data travels encrypted, is encrypted at rest, and each workspace's data is kept apart by rules in the database itself. Secrets for your integrations are encrypted again with our own key. Only what's needed reaches our servers in the first place. No system is perfectly secure; if a breach affects your data, we will tell you and the authorities as the law requires.

14. Your rights

Depending on where you live, including under India's Digital Personal Data Protection Act, the GDPR in the EU and UK, and US state laws such as California's, you can ask to access, correct, delete or receive a copy of your information, object to or restrict how we use it, withdraw consent, and nominate someone to act for you. You can delete your account yourself in Settings; for anything else, write to support@gobokka.com. We may need to confirm it's you, and we answer within a month. You can also complain to your data protection authority. We don't sell or share personal information for advertising, as US state laws define those terms.

15. Children

Bokka is for people aged 18 and over. We don't knowingly collect information from anyone younger; if you believe we have, write to us and we'll delete it.

16. Changes

If we change this policy in a way that matters, we'll tell you in the app or by email before it takes effect, and update the date above.

17. Contact and grievances

Bokka, Deoghar, Jharkhand, India. For privacy questions, requests or complaints, including to our Grievance Officer under India's information technology rules, write to support@gobokka.com. We acknowledge every complaint and resolve it within one month. See also our Terms of Service.