The short version

What we keep, and why

• • Your account email — for sign-in and for the invite links that bring your operators in.
• • Your org and its members — who is in the org and what role they hold (owner or operator). That's the tenancy the whole product hangs off.
• • Your Macs and their phones — each machine's name and last-seen time, and each enrolled phone's UDID and name. The phone rows are the licence: that's what the bill is counted from.
• • The audit trail — every gesture and agent action: which device, what action, and the instruction behind it. Typed text is recorded by length only, never by content, so a 2FA code can't leak through the audit trail.
• • The token ledger — an append-only record of agent token grants, purchases, and usage (with the model used per run), plus your org's chosen agent model.
• • Media you upload for scheduled posts, in storage scoped to your farm.

Card data never touches us

Subscriptions are billed by Stripe. Your email and payment details are handled on Stripe's side, under Stripe's privacy policy. We store what Stripe reports back — subscription status, the licensed phone count, the period end — plus Stripe's identifiers for the subscription. We never see or store your card number.

What a model call sends, said plainly

When you run the built-in agent, the content of the run — the instruction you gave it and what it needs from the screen — is sent through the control plane to OpenRouter, which serves the model your org picked from the catalog. OpenRouter processes that content under its own terms and privacy policy. Don't put into an agent instruction what you wouldn't send to that model provider.

You have two ways around that, both first-class: pick a different model in the catalog (the choice is yours, per org), or bring your own agent — Claude Code, Codex, or your own harness — over MCP. BYO runs use your model and your provider directly; the model content never routes through us. We still audit the actions either way, length-only for typed text.

Secrets become hashes, once

• • Raw machine credentials. When your Mac registers, the secret is shown once and kept on your Mac; the control plane stores only its SHA-256 hash.
• • Raw personal access tokens. Same rule: shown once when you mint one, stored only as a hash. Revoke it and access dies on the next request.
• • The content of typed text. The audit trail records that text was typed and how long it was — never the characters.
• • Your card number. That lives with Stripe, full stop.

What cancelling and deleting remove

Cancelling your subscription stops the billing. Deleting your org in the portal then removes its rows: memberships, machines and their credential hashes, enrolled phone rows, the audit trail, the token ledger, and media you uploaded. An org with a live Stripe subscription can't be deleted until billing is closed out — cancelling first is the order.

Two honest edges: Stripe keeps the billing history it is required to keep (on Stripe's side, and it never included your card number), and backups can retain data for a short window before it ages out. The stored credential hashes are useless on their own — the raw secrets never left your Mac.

Real windows, not “as long as necessary”

Your org's rows — machines, phones, the audit trail, the token ledger, your media — exist for exactly as long as your org does. Deleting the org removes them, as described above; there is no archive after that, no analytics copy, no shadow database.

• • Failed sign-in attempts are recorded (just the email and the time) to throttle abuse — only the last 15 minutes of failures ever count against a sign-in.
• • Backups can hold deleted data for a short window before it ages out; the backup and the live data are the only copies.
• • Stripe keeps the billing history the law requires it to keep, on Stripe's side — and it never included your card number.

Get a copy, get it fixed, get it gone

Whatever your local privacy law gives you — GDPR-style access, correction, and erasure, or CCPA-style know-and-delete — you get it the same way: deletion lives in the portal (above), and for a copy of what we hold about you or a correction, email sam@phonepanel.app. A human reads it and answers; there are no forms and no verification maze.

Two things you shouldn't have to ask for: we don't sell personal information — there is no advertising and no data-broker business anywhere in this product — and your data stays in the three places named on this page. If you ever want to complain to a data-protection authority, you can; we'd rather you emailed us first, and you'll get the same answer faster.

A human answers

Phonez is built and run by Sam Ovington. Questions about this page, your data, or deletion: sam@phonepanel.app.