Privacy policy

By Matt Kerr·Published 6 August 2026

Docket is desktop software that runs on your Mac. This policy covers both the application and this website.

The application

Nothing about the sites you audit reaches us, Kerr & Company: the crawl and the report stay on your Mac. The requests that do leave it are listed below with who receives each one, and the only ones that come to us are for two public files on this website. What our payment provider receives on our behalf is your licence key and a name for each Mac you activate it on. There is no account, no telemetry and no crash reporting. The licence key is checked with our payment provider when you activate it and about once a day after that.

An earlier version of this policy said the only network requests the app makes are to the website you ask it to audit, and the next one named three kinds of destination. Neither was accurate, and a privacy policy is the last document that should be approximately true. This is every request the shipped app makes, read from its code, starting with the ones it makes unless you switch them off.

What it does by default

• The licence check, to Dodo Payments. Dodo handles our checkout and issues the licence keys. When you activate Docket, the app sends Dodo your licence key and a name for that activation: Docket @ followed by your Mac's hostname, the network name macOS usually builds from the computer's name. After that it sends the key with that activation's id about once a day, when the app opens or an audit starts, and again if you deactivate. None of these requests carries anything about your audits, and no switch turns them off.
• The update check, to this website. When the app opens, and every thirty minutes while it stays open, it asks docketseo.app/updater.json whether a newer version exists; Check for Updates… in the Docket menu asks on demand. It sends nothing but the request for that file. If you accept an update, the new build is downloaded from this site's releases on GitHub, and nothing installs without you saying yes. No switch turns the check off.
• The offer, to this website and to our offer server. Only on a copy with no licence key, and only while its activation screen is open, the app asks docketseo.app/offer.json for the current price and any founding offer, and asks kerr-lead-agent.kerrco.workers.dev, a server we run, whether the founding offer is still open, sending only this site’s name. That is how it avoids showing an offer that has ended. Nothing else is sent. With “Keep it private” ticked in the crawl settings it asks neither, and shows the list price alone. Buy opens our buy page in your browser.
• Google PageSpeed Insights, for Core Web Vitals. The addresses of up to five of your shallowest pages, homepage first, each sent to Google's PageSpeed Insights API, which then measures that page. It works without an API key, and the desktop app never sends one.
• DNS, for email deliverability. The mail domains of the addresses your pages publish, leaving out free providers such as Gmail. Docket looks up their mail-server (MX) and address records, asking your Mac's own DNS servers first and Cloudflare's and Google's public resolvers if those do not answer. Where a domain has no MX record, it also opens a connection to port 25 on that domain's server to see whether anything is listening, and closes it without sending a message.
• Google's autocomplete, for topic suggestions. The topic you type in “What is this site about?” or, if you leave it empty, up to three words that recur in the titles, headings and descriptions of at least a quarter of your pages, leaving out the site's own name unless nothing else recurs. Each is sent to Google's public autocomplete on its own and with question and buying phrases added, such as “how to” and “cost”. If you type nothing and no word recurs, nothing is sent.
• This website, for the knowledge file. The knowledge refresh fetches docketseo.app/data/knowledge.json: the current AI crawler list, Core Web Vitals thresholds and ranking notes. It is a plain request for one public file. Its user-agent says Docket, and it carries nothing about you or what you are auditing.
• The site you asked it to audit. The crawl itself, from your machine, naming itself as Docket, and the edge-access checks, which request your homepage again as Docket, as Googlebot and as each AI crawler Docket knows (OpenAI's, Perplexity's and Anthropic's), naming Docket in each, to see what your server tells them.
• Other sites your pages point to. Docket checks that a sample of your links to other sites still work, and that the share images your pages name load, with a request to each address and a second if the first fails. It fetches the stylesheets your pages link, including ones served from other hosts. And it renders three of your pages in the WebKit engine macOS already ships, which runs their scripts the way a browser would, so whatever those pages load, such as analytics or advertising pixels, is requested too.

What turns each off

The offline switch turns off five of these together: PageSpeed Insights, the deliverability lookups, topic suggestions, the knowledge refresh and the edge-access checks. In the app it is the box labelled “Keep it private: only contact this site”, and on the command line it is --offline. It also keeps stylesheet fetches to the site you audit. It does not turn off the licence check, the update check, the link check or rendering. Unticking “Also check that links to other sites still work” in the app, or --no-link-check, turns off the link check, and rendering can be turned off only on the command line, with --render 0. There is no separate switch for each of the five: the offline switch is the one control. These runs ignore it, and always make the five checks and render pages as usual: re-audits of the sites you save, whether on their schedule, which runs only while Docket is open, or from “Check now”; docket diff; and docket logs --url.

What it does only when you ask

• docket backlinks and docket attack read Common Crawl's public link graph from commoncrawl.org. Each download reads a public file from its beginning rather than asking for your domain, so the request does not name the domain you are asking about. --referring streams larger files the same way, and --no-authority skips it in docket attack.
• docket attack --demand sends the phrase you give, or one Docket reads off the site, to Google's autocomplete in the same way as topic suggestions.
• docket logs --verify looks up each address in your log file that claims to be Googlebot in DNS, to confirm it is Google's.
• --psi-key on the command line sends your own PageSpeed Insights key to Google with those requests.
• An AI assistant you connect with docket mcp runs audits that make the same requests as any other, and it can ask for offline mode.

Audit results, your saved-site list and any crash reports are stored on your machine in ~/.docket/ as plain JSON files. They are never transmitted. Deleting that folder removes them permanently.

This website

This site is static and runs six third-party scripts. The first is Plausible, which counts page views. Plausible states that it uses no cookies, collects no personal data and does not track visitors across sites; it is hosted in the EU. Nothing about your audits reaches it. Audits run on your Mac and this website never sees them. Standard server logs may record IP addresses and requested URLs, which are used only to keep the site running.

The second is Sled, which credits the right person when somebody recommends Docket. It is conditional: arrive through an affiliate link and a single ta_ref cookie records which affiliate sent you, so they are paid if you buy. Arrive from a search result, a bookmark or a link of ours and no cookie is set at all, which is what almost every visitor does. It records which affiliate sent a visit, never who the visitor is.

The third is the Meta pixel. It is here because we advertise on Facebook and Instagram, and without it we cannot tell which adverts bring people who actually download Docket: only how much we spent. It records that a page was viewed and sets a _fbp cookie, which lets Meta connect a visit here to an advert you saw there. Its id is 2344029433088526, visible in this page's source; that is normal for a pixel and not a secret. It sees pages on this site. It does not see your audits, which run on your Mac and are never uploaded.

This is the most intrusive thing on the site and it is the one we would least like to need. A content blocker stops it, as does Meta's own off-Facebook activity setting, and nothing here depends on it loading.

The fourth is the chat assistant in the corner of the page, which answers questions about Docket. Its script is loaded from kerr-lead-agent.kerrco.workers.dev, a server we run. The assistant stores nothing in your browser (no cookie of its own, no local storage, no session storage), and it reads nothing about your device. It draws itself in an isolated shadow root, so it cannot see or change the rest of the page. If you type a question into it, that question is sent to that server so it can be answered; if you never open it, nothing is sent. It knows only published facts about Docket, and the price it quotes comes from the payment provider rather than from this page, so it cannot quote you a price the checkout will not honour.

The fifth is on the front page only, and not on this one: a “tell me when Windows is ready” form, loaded from kerr-subscribe.kerrco.workers.dev, a server we run. Like the assistant it draws itself in an isolated shadow root and stores nothing in your browser: no cookie, no local storage, no session storage. Nothing is sent unless you type an address and press the button, and what is sent is that address and which site it came from, so the Windows list stays separate from every other list. If you never use the form, it makes no request at all.

The sixth is also on the front page only: the founding-offer bar across the top of the page, loaded from kerr-lead-agent.kerrco.workers.dev, the same server as the assistant. When the page loads it asks that server whether the offer is still open, and the only thing it sends is this site's name. If you close the bar, the time you closed it is kept in your browser's local storage so the bar stays away for seven days; nothing else is stored and it sets no cookie. It draws itself in an isolated shadow root, like the assistant.

One more thing runs here, written into this site's own pages rather than loaded from anywhere. If you arrive from a link that says where it was shared, such as ?ref=producthunt, from a fixed list of such names (Product Hunt, Hacker News, Reddit, a newsletter and the like), the page keeps that one word in your browser's session storage for this visit and adds it to its Download and Buy links, so we can count how many downloads came from a launch. It is never an affiliate id, nothing else is stored, and it is gone when you close the tab. Arrive any other way and it does nothing at all.

These paragraphs have been rewritten three times as the answer changed. They once said the site “sets no cookies” and runs “one third-party script”; both were true until Sled was added. The line calling Sled the only thing here that can set a cookie was true until the Meta pixel was. The count said three until the chat assistant was added, and the description on this page still said three after the body said four. Our own audit caught that, and it was corrected to five, which is when the Windows form on the front page was counted too. It said five while the front page loaded six: the founding-offer bar was missed until a count of every script on every built page was checked against this list, and that count now runs before every deploy. This paragraph is the reason that was noticed: each correction is made above rather than quietly deleted. A privacy page that enumerates what a site does not do is only worth reading if the enumeration stays complete.

If you would rather not be counted, any content blocker stops it, and nothing on this site depends on it loading.

Data you give us

The free checkers send the address you type, and nothing else about you, to ai-crawler-check.kerrco.workers.dev, a server we run. Nothing is sent until you press the button. The AI crawler checker and the robots.txt tester make that server fetch the site's robots.txt. The title and meta tag checker and the JSON-LD checker make it fetch the page at that address, read its title, meta tags, headings and structured data, and send back only the result of the checks, not the page. The server names itself in each request, keeps a copy of what it fetched for a few minutes so repeated checks do not hit the site again, counts checks per connection for a minute to stop floods, and keeps nothing else. The pages set no cookie and store nothing in your browser.

After a purchase, the page you return to asks kerr-affiliate-hub.kerrco.workers.dev, a server we run, what that payment came to, sending only the payment’s id, so our own sales count and advertising records show what you actually paid rather than the list price. Nothing about you is sent or returned.

The home page has one email field. Leave your address and we will email you once, when the free audit is ready. It is not a newsletter and there is no series to subscribe to. The form sends exactly two things, and only when you press the button: the address you type, and a hidden field naming which of our sites it came from. Nothing is sent if you never use it.

What is kept is that address, the site name, and the date. No IP address, no user agent, no referer, no fingerprint: the write stores those three columns and reads nothing from the request. To be removed, ask and the row is deleted.

This section said “there is no contact form and no mailing list” until 2026-08-24. The field went live on 2026-08-18, so the denial stood for six days while addresses were being collected. It is corrected here rather than quietly rewritten, for the reason given two paragraphs above: an enumeration of what a site does not do is worth nothing unless it is kept complete, and this is the enumeration failing.

If you open an issue on GitHub, that issue is public and GitHub's privacy policy applies to it; we hold nothing separately.

Changes

If this policy changes, the updated version appears on this page.

Contact

Questions about privacy or anything else: get in touch.