AgentDeck orchestrates Claude Code on a computer you own. The desktop app runs a local daemon on your Mac, and your repositories, agent sessions, tickets and usage ledger live in that daemon's SQLite database on that machine — not on a server of ours. There is no AgentDeck-operated machine that your code runs on, and there never has been. AgentDeck drives Claude Code with your Anthropic account: traffic between Claude Code and Anthropic is governed by Anthropic's own terms and privacy policy, exactly as when you run the CLI by hand.
All of it, without exception:
That is the complete list. We do not collect health metrics from your machine, we do not index your repositories, and we have no database of your tickets, threads or agent output.
Your phone's push token is deliberately not on that list. The phone hands it to your own Mac — that message travels through the relay to get there, like every other message — and it is the daemon on your Mac that stores it and sends the notification. We never keep a copy.
The relay is the piece that lets your phone reach your Mac, and it is worth being exact about. When you open a thread on your phone, the request goes to the relay, the relay hands it to your Mac, and your Mac's answer comes back the same way. So the contents of that answer — a thread, a diff, an approval prompt — pass through our server in transit.
We route those messages and we do not store them: they exist in the relay's memory for as long as the round trip takes, they are never written to a database, and their contents are never logged. What our logs do record is that an account connected, disconnected, or changed subscription state — an email address and a timestamp, never what was said. Two things are held in memory for seconds rather than passed straight on: a call waiting on your Mac to answer (dropped after 30 seconds), and up to 64 frames a client sends before it has finished signing in.
On encryption, plainly: every hop is TLS — phone to relay, relay to Mac — but the relay terminates it, so a message is readable inside the relay for the instant it is being forwarded. That is not end-to-end encryption and we are not going to describe it as if it were. The path exists only while a Mac of yours is signed in and paired; without one the relay has nothing to route and none of this applies.
The desktop app and the iOS app send crash reports to Sentry. This is on by default in the builds we ship, and it is the only thing either app reports back to us. It exists because a crash on a machine we cannot see is otherwise invisible: before this, the only way we heard about one was somebody typing it into a chat.
A report carries the error, the stack trace, the app version and the platform. It does not carry your IP address or your username — the client is configured with personal information off — and every report is run through a redactor before it leaves, which strips session tokens, pairing tokens, Anthropic keys and anything named like a key, token, secret or password. We do not send your code, your prompts, your tickets or your agent output.
On a Mac you can turn it off completely: set AGENTDECK_TELEMETRY=off in the app's environment, and it is off by default when AgentDeck runs from a source checkout. On iPhone there is no switch — an iOS app has no environment to set one in — so today the only way to opt out there is not to install the app. That is a gap, and we would rather name it than let it read as a choice you already have.
agentdeck.run sets no tracking cookies and runs no third-party analytics. Standard web-server logs (IP address, user agent, requested page) are kept briefly for abuse prevention and then discarded. The subscribe page loads PayPal's checkout SDK, which is PayPal's own code under PayPal's privacy policy.
Email us from the address on the account and we delete it, along with every machine pairing on it. There is nothing else of yours for us to delete: your repositories, sessions and agent output were only ever on your own Mac, and removing the app removes them with it. Billing records are retained only as long as tax law requires, and crash reports age out on Sentry's own retention schedule.
Pairing tokens are stored hashed, never in the clear, and a token is shown to you exactly once when it is minted. On your Mac the account file holds a credential and is written owner-read-only. Every connection to the relay is TLS, and each one is pinned to a single account for its whole life, so no daemon or phone can be addressed as somebody else. A lost laptop costs one revocable pairing token rather than the account.
Found a vulnerability? Mail security@agentdeck.run — we respond fast, and please don't open a public issue first.
Paying changes nothing on this page. A subscription unlocks the relay — phone pairing, remote control and push approvals — and it does not give us access to your machine, your repositories or your agents. Concierge adds human help with setup: we see whatever you choose to show us during that work, and nothing else.
If this policy changes materially, we'll note it here with a new date and email account holders before it takes effect.
Privacy questions: hello@agentdeck.run.