Agent Pager — Privacy Policy

Privacy Policy

Effective July 12, 2026 · Eudaimonia Software

The whole policy in one sentence: your prompts and answers are end-to-end encrypted between your computer and your devices, we operate no accounts and no analytics, and the only data our relay ever stores is a random pairing identifier and a push-notification token.

What the relay stores

The relay is a small forwarding service (hosted on Cloudflare) whose only job is to move sealed messages between your computer and your devices, and to trigger push notifications. Per pairing, it stores exactly two things:

A pairing identifier — a random UUID that means nothing outside your own devices.
An Apple push token — an opaque device address issued by Apple, used only to deliver your notifications. It cannot be used to identify you.

While a prompt is waiting for your answer, its encrypted form is held briefly in memory so a freshly opened app can catch up; it is discarded the moment the prompt resolves or expires.

What the relay can never see

Message contents — commands, file paths, directory names, questions, your answers, machine names — are encrypted on your computer with keys created during pairing and held only on your devices (in the iOS Keychain, hardware-backed). The pairing QR code travels over your screen and your camera, never over the network, so the relay has no opportunity to intercept the keys. What the relay forwards is ciphertext it cannot open; push notifications carry that same ciphertext, and your device decrypts it locally before anything appears on your lock screen.

What stays on your devices

Encryption keys — iOS Keychain, never transmitted.
Your history and activity lists — stored only on the phone, capped to the most recent entries, deleted with the app.
On your computer: pairing configuration in your home directory, readable only by your user account.

The Teams edition

Agent Pager Teams follows the same design with a shared inbox: your whole team sees each prompt, and the first answer wins. Everything a team exchanges is sealed with a team key created on the founding device and handed to each new device inside an encrypted grant that only that device can open — the relay stores and forwards these grants but cannot unwrap them. Per team, the relay stores:

Random team and device identifiers — meaningless outside your team.
A roster — for each device: the display name its owner typed at enrollment (visible to the whole team — use any name you like), a device model label, its public keys, and whether it's active. No emails, no accounts.
One-time invite codes — random, single-use, expiring after 15 minutes.
Push tokens — one per phone, used only to deliver notifications.
Pending prompts and recent activity, encrypted — so a phone that was asleep can catch up when it next opens. Prompts are discarded when answered or expired; activity entries within a day. All of it is ciphertext the relay cannot read.

Removing a device from the team rotates the team key: every remaining device moves to a new key, and the removed device cannot decrypt anything sent afterwards. Invite QR codes and links carry the one-time code in a form that is never sent to any server (the code travels in the URL fragment, which browsers keep local).

What we don't do

No accounts, sign-ins, or email collection.
No analytics, telemetry, tracking, or advertising — in the app or on this site.
No selling, sharing, or monetizing of data of any kind. There is nothing to sell.

Third parties

Two infrastructure providers touch your (encrypted) data in transit: Cloudflare, which hosts the relay, and Apple, whose push-notification service delivers messages to your devices. Both see ciphertext and routing metadata only. If you prefer zero third parties, the relay is open source and self-hostable — the app accepts any relay URL at pairing time.

Deleting your data

Unpair a desktop (or delete the app) and the keys are destroyed, which permanently orphans anything the relay holds — ciphertext without keys is noise. Re-pairing replaces the relay's stored identifier and token. To remove the desktop side, use the plugin's hook-removal option; it cleans its entries out of your agent's hook settings (Claude Code, and Copilot where installed).

Changes

If this policy changes materially, the effective date above changes with it, and the app's release notes will say so. The policy's history is public in the project repository.

Contact

Questions about privacy: [email protected].