This Privacy Policy explains how Commonly Works("we", "us"), handles personal data in connection with the Poch application for Windows (the "Software") and this website (the "Website"). It is written to meet the requirements of Indonesian Law No. 27 of 2022 on Personal Data Protection (the "PDP Law"), Law No. 11 of 2008 on Electronic Information and Transactions (as amended), Government Regulation No. 71 of 2019, the EU General Data Protection Regulation ("GDPR"), the UK GDPR, and the California Consumer Privacy Act as amended by the CPRA ("CCPA").
Who is responsible for your data
Commonly Works is the data controller for personal data processed through the Website and for the limited network requests the Software makes, described below. Contact: one@riotrevenger.xyz. Commonly Works.
Summary in plain language
Poch has no account, no sign-up, no advertising and no analytics. Your to-do items, water log, shelf and notes stay in files on your own computer, and we never receive them. The only thing the Software may send over the internet is the title and artist of a track, to look up album artwork when your media player does not supply it. We do not sell or share personal data for advertising.
The data involved
| Data | Where it lives | Sent to us or others? |
|---|---|---|
| To-do items, water log and settings, shelf entries (file paths), Scrap notes | Plain-text files in %APPDATA%\poch on your device | No. Never transmitted by Poch. |
| Currently playing media: title, artist, album, playback state, position, artwork | Read from Windows media controls and held in memory to display | Not stored. Title and artist may be sent to Apple for artwork lookup (see below). |
| Foreground window state and process name (to detect fullscreen, maximized or Adobe apps) | In memory only | No. Not stored or transmitted. |
| Clipboard content, dragged files | Used only when you copy or paste in Scrap, or drag files to or from the shelf | No. |
| IP address and technical request data (browser, time, page) | Processed by the hosts that serve the Website and downloads | Yes, to those hosts (see "Recipients"). |
| Email and message content, if you write to us | Our mailbox | Only if you contact us. |
We do not intentionally collect special categories of personal data (such as health, biometric or political data). If you type such information into the notepad or to-do list, it remains on your device only.
How the Software behaves
Local-only processing
Poch works offline for nearly all features. Reading what is playing, the clock, the reminders, the shelf, the notepad, the hotkey and the busy-mode detection all run locally. The data files are not encrypted by Poch. They are protected by the permissions of your Windows user profile, so anyone with access to your account or device could read them.
Artwork lookup
When media is playing and the source application provides no artwork, Poch sends an HTTPS request to the Apple iTunes Search API containing the track title and artist as search terms, and may download the matching image. Apple receives your IP address and these search terms, and processes them under its own privacy policy. No account identifier is included. You can avoid this request by using a player that provides artwork, or by blocking Poch's network access in Windows Firewall, in which case artwork may not appear.
No telemetry
The Software does not include analytics, advertising identifiers, crash reporters or tracking SDKs, and it does not create a user profile. If this ever changes, we will update this policy and, where required, ask for your consent first.
The Website
The Website does not use cookies, advertising trackers or analytics, and it has no forms or accounts. To display it, your browser connects to third parties that necessarily receive your IP address and browser information: Google Fonts (typeface), GitHub (3D icon images), and the hosting provider that serves the pages. Clicking a download button takes you to GitHub Releases, which is governed by GitHub's own privacy statement. Our hosting provider may keep standard server logs for security and operation for a limited period set by that provider.
Purposes and legal bases
| Purpose | Legal basis (GDPR / PDP Law) |
|---|---|
| Serving the Website and downloads, and keeping them secure | Legitimate interests (GDPR Art. 6(1)(f); PDP Law legitimate interest) |
| Looking up artwork you see in the Software | Performance of the service you requested (Art. 6(1)(b)); legitimate interests |
| Replying to your messages and support requests | Legitimate interests; your consent where you provide it |
| Complying with legal obligations and defending legal claims | Legal obligation (Art. 6(1)(c)); legitimate interests |
We do not use personal data for automated decision-making or profiling that produces legal effects. Where we rely on consent, you can withdraw it at any time without affecting the lawfulness of earlier processing.
Recipients and processors
| Recipient | Why | Data |
|---|---|---|
| Apple Inc. (iTunes Search API) | Artwork lookup from the Software | Track title, artist, IP address |
| GitHub, Inc. (Microsoft) | Hosting of installers, source code and 3D icon images | IP address, request data, download activity |
| Google LLC (Google Fonts) | Delivery of the Website typeface | IP address, browser data |
| Hosting and email providers | Operating the Website and our mailbox | Request logs, emails you send |
We do not sell personal data and do not share it with advertisers or data brokers. We may disclose data if required by law, a court order or a competent authority, or to protect rights and safety, limited to what is necessary.
International transfers
Some recipients above are located in, or operate infrastructure in, other countries, including the United States. Where personal data is transferred across borders, we rely on safeguards required by law, such as adequacy decisions, standard contractual clauses, or the recipient's equivalent or higher level of protection as required by the PDP Law.
Retention
Data in the Software stays on your device until you delete it or uninstall and remove %APPDATA%\poch. Emails you send us are kept only as long as needed to handle your request and for up to 24 months afterwards, unless the law requires longer. Server logs are retained by our hosts for the period they set, generally no longer than needed for security and operation. Afterwards data is deleted or anonymized.
Security and breach notification
We apply measures appropriate to the risk, including HTTPS, minimizing the data we handle, and keeping the Software local-first. No system is perfectly secure. If a personal data breach affecting you occurs and notification is required, we will notify you and the competent authority within the time limits set by law, including 72 hours under the GDPR and within 3 x 24 hours under the PDP Law.
Your rights
Depending on where you live, you may have the right to:
- be informed about, access and obtain a copy of your personal data;
- have inaccurate or incomplete data corrected or completed;
- have data erased or destroyed, or restrict or end its processing;
- object to processing based on legitimate interests;
- withdraw consent at any time;
- receive your data in a portable format and have it transferred where technically feasible;
- object to decisions based solely on automated processing; and
- lodge a complaint and, where applicable, claim compensation for violations.
These rights come from the PDP Law (Indonesia), the GDPR and UK GDPR (EEA and UK), and, for California residents, the CCPA: the right to know, delete, correct, and to opt out of sale or sharing, and the right not to be discriminated against for exercising rights. We do not sell or share personal information for cross-context behavioral advertising. We do not respond differently to "Do Not Track" signals because we do not track you across sites.
How to exercise your rights
Email one@riotrevenger.xyz. We may need to verify your identity. We will respond within one month, or sooner where the law sets a shorter period, and may extend it where permitted for complex requests. Data stored by the Software is on your device, so you can view, edit, export or delete it yourself in %APPDATA%\poch. Because we do not hold that data, we cannot retrieve it for you. Requests are free unless they are manifestly unfounded or excessive.
Children
The Service is not directed to children under 13, or under the higher age of digital consent in your country, and we do not knowingly collect their personal data. If you believe a child has sent us personal data, contact us and we will delete it. Where processing of a child's data requires parental or guardian consent under the PDP Law or other law, we will obtain it.
Cookies and similar technologies
The Website sets no cookies of its own and uses no analytics or advertising technologies. The Software does not use cookies or tracking identifiers. If we add any non-essential cookies or analytics in the future, we will update this policy and request consent where the law requires it.
Changes to this policy
We may update this policy when our practices or the law change. We will post the new version here with a new "Last updated" date and, for material changes, give additional notice where feasible. Earlier versions are available in the project repository history where we publish them there.
Contact and complaints
Commonly Works. Email: one@riotrevenger.xyz. If you are not satisfied with our response, you may complain to the competent authority: in Indonesia, the Ministry of Communication and Digital Affairs (Komdigi) or the personal data protection authority designated under the PDP Law; in the EEA or UK, your local data protection authority; in California, the California Attorney General or the California Privacy Protection Agency.