phonecando
GitHubDownload APK

Privacy note · FM-01

What it sends home.

PhoneCanDo shares anonymous usage stats so we can see how many phones run it and what breaks. It is on by default and one switch turns it off. Your prompts, sessions, files and keys never leave the phone for us.

Hi from a phone!

Still running. Opened the terminal, finished setup step 2, the engine started fine. Nothing broke.

P.S. no prompts, files or keys in here.

— an install ID, not a name

To
our own server
On
Cloudflare
Sold
never
Flip it. It only changes this page; the real one is in the app, under Settings → Privacy.
  • No cookies
  • Nothing sold or shared
  • One switch turns it off
  • Delete my data, any time
  • Development builds send nothing
  • Your prompts stay on the phone

tl;dr · for the busy

The short version

  • On by default

    Release builds send usage stats by default. A notice on first launch says so, and nothing is sent until you answer it.

  • One switch

    Settings → Privacy has one switch that turns it off. Off means nothing more is sent, and whatever was waiting to be sent is thrown away.

  • A delete button

    Delete my data erases what the server holds for your phone, then turns sharing off.

  • Dev builds keep quiet

    Development builds send nothing.

  • Not for sale

    Nothing is sold or shared, and none of it goes into the public code repository.

The packing list

What the app sends

  • Your phone, roughly

    Maker and model, Android version, processor type, memory in whole gigabytes, language setting, and which app installed PhoneCanDo (a browser, a file manager, its own updater).

  • The app

    Version and build (full, lite or play).

  • Usage

    Named events such as "update offered", "terminal opened", "setup step 2 done", "phone control unlocked", and which phone-control features were used and how often. Update events add the version and the step they reached. Never what you typed or what came back.

  • Health

    How long the engine took to start, how often it started, failed to start or stopped unexpectedly, and the exit code of such a stop. Its log is never sent automatically, because it can contain text from your chats; it goes only into a report you choose to send. Also low-memory warnings, and whether battery optimisation, the background service and the accessibility service are on.

  • Errors and crashes

    The error type, a short message and the top few lines of the stack trace, with folder paths on your phone blanked out.

  • Where, coarsely

    The server notes the country and the network operator from the connection. It does not store your IP address. To stop abuse, Cloudflare's rate limiter counts requests per IP address for one minute; that count is never logged or stored with your data.

Name tags, minus the names

So we can count the same phone over time, each send carries IDs. None of them is your name, number or account, and the hardware ones are scrambled (hashed) on the phone before they leave it:

  • Install ID

    random

    Random, made on first launch. New after a reinstall, after Reset anonymous ID, or after Delete my data.

  • Device ID

    hash(android id)

    A hash of Android's ID for this app on this phone. It stays the same across reinstalls and changes after a factory reset.

  • Device key

    hash₂(android id)

    A second, different hash of the same ID, which only your phone can compute. The server uses it to make sure only your phone can add to or delete your phone's data.

  • Hardware hash

    hash(model + build)

    A hash of the phone's model and system build details. It groups phones of the same model and build; identical phones on the same build share it, and it changes with a system update.

DRM ID An ID from the phone's DRM system is in the code but switched off, so it is never sent.

The no-fly list

What it never sends

Stays on the phone

    • Prompts
    • Chats
    • Model replies
    • Files
    • Folder paths
    • Anything in the terminal
    • Environment variables
    • API keys
    • Screenshots
    • Anything on the screen
    • Which apps the agent opened or used
    • Contacts
    • Messages
    • Notifications
    • Your IP address
    • Precise location
    • Advertising ID
    • Name
    • Email
    • Phone number
    • Android's raw device ID

Your buttons, your call

Your controls

All in the app, under Settings → Privacy:

  • The switch

    Off stops all sending at once. Turn it back on any time.

  • Delete my data

    Deletes every row the server holds for your phone (device, every install, app runs, events, errors, reports), even from before a reinstall or an ID reset, then turns sharing off and makes a new install ID. If nothing was stored, the app says so. Only the 7-day database backups still hold the deleted rows until they expire; there is no other copy.

  • Reset anonymous ID

    Starts over with a new install ID and throws away anything not yet sent. Past data from this phone stays linked to it; use Delete my data to remove it.

  • Send report

    Only when you tap it. Sends your note, the last 50 usage events and the last 2 KB of the engine's log from its last crash, with folder paths, passwords and keys blanked out.

This very page

This website

Page view

One count per page load, to our own server

The page's path
/privacy/
Site you came from
its name only
Your country
yes
Kind of browser
phone, computer or bot
Cookies
0
Third-party scripts
0
Stored in your browser
nothing

Total1 count

Skipped when your browser asks not to be tracked (Do Not Track or Global Privacy Control).

The cookie jar is empty, on purpose. No cookies, no third-party scripts, nothing stored in your browser.

How many, never who

Page views and downloads are also added up per day, page (or download channel) and country, and those totals are kept for good. They say how many, never who.

The download buttons

The download buttons and the QR code pass through our server, which counts the download (channel, version, country, Android version) and sends you on to the file on GitHub. GitHub counts it too. The computer commands download from GitHub directly.

Shelf life · best before

Where it is kept, and for how long

On Cloudflare, which runs this website and its server and stores the data on our behalf (a database and an analytics store). There is no archive: once its time below is up, data is deleted.

  1. The server's own request logs

    3 days, for debugging

  2. Database backups

    7 days, so deleted rows are fully gone after that

  3. Usage events

    90 days, then deleted

  4. Reports you send

    90 days, then deleted

  5. Site page views and downloads in detail

    about 3 months

  6. Errors and crashes

    180 days, then deleted

  7. Device, install and app-run rows

    until you tap Delete my data

  8. Daily site totals

    kept for good: counts per page or download channel and country, nothing about you

Who else it calls

Everything else the app connects to

  • At start · on install

    GitHub

    To check for updates when the app starts (full and lite), and to download an update when you tap install.

  • At start · every 5 min

    opencode's model catalog

    models.opencode.ai, which the engine downloads when it starts and every 5 minutes while it runs, so it knows which models exist.

  • Your key · direct

    The model providers you set up

    Straight from your phone with your key. Our server is never in between.

  • Your call

    Whatever you or the agent start

    A web search, a download in the terminal.

Still curious?

Every field, and questions

The full list of fields, limits and network calls is the published schema, next to the code that sends it. Questions or a problem: open an issue on GitHub.

Read the published schemaOpen an issue on GitHub