Privacy Policy

Introduction

Agent Approve LLC (“we”, “our”, or “us”) is a California limited liability company that provides a governance layer for AI coding agents. This Privacy Policy explains how we collect, use, and protect your information when you use our Service.

Information We Collect

Account Information

When you create an account, we collect your email address and authentication credentials (via Sign in with Apple). We do not collect your name unless you voluntarily provide it.

Data We Store

When you use Agent Approve, we store the following data, subject to your privacy tier and retention settings:

• Cleartext metadata (always stored): Tool names, event types, agent names and types, conversation identifiers, timestamps, approval decisions, and decision method (manual, allowlist, or denylist).
• Command content (stored per your privacy tier): Depending on your privacy tier setting, command content may be stored in full, truncated, or not at all. See “Privacy Tiers” below.
• Security and audit logs: IP addresses, rate limit events, configuration changes, and hook installation events.
• Usage statistics: Aggregate counts of approvals, denials, and auto-decisions; response times; device information (iOS version, device type).
• App activity: We record when you open the app to maintain your login streak and badges. We do not track in-app navigation, taps, scrolling, or screen views.

Data We Process Transiently

When server-side policy evaluation is enabled (Approval Mode), your development machine sends the complete command or tool input for the action being decided, because a partial command is not enough to tell a safe action from a destructive one. Our server processes that approval copy in memory to evaluate it against your active policy: its Deny List, its Allow List and, if you have enabled Policy Rules, the rules described in “Policy Rules and Assisted Authoring” below. When end-to-end encryption is enabled, this approval copy is encrypted for our server separately from the copy encrypted for your devices, and our server decrypts it in memory for this purpose. The approval copy is discarded when the request finishes. It is not written to our database or logs as command content; what is retained is the history copy governed by your privacy tier.

Information We Do Not Collect

We do not collect file contents from your machine, source code, environment variables or secrets (unless they appear in a command you submit), browsing history, or location data.

How We Use Your Information

We use collected information to provide and operate the Service, relay approval requests between your development machine and iOS device, evaluate commands against your configured policies, improve features and performance, detect and prevent security threats, enforce usage limits, and send service-related notifications.

Data Security

Agent Approve provides multiple layers of encryption to protect your data:

• Transport encryption: All data is encrypted in transit using HTTPS (TLS).
• Encryption at rest: Data stored in our database is encrypted using organization-scoped keys managed by our hosting infrastructure. These keys are unique to each organization.
• End-to-end encryption (optional): When you enable end-to-end encryption (E2E), the copy of your command content that is stored as event history and shown on your devices is encrypted on your development machine with keys we do not hold, so we cannot read that copy. In Approval Mode, your development machine also sends a separately encrypted approval copy that our server decrypts in memory to evaluate your active policy, as described in “Data We Process Transiently”. E2E keys are transferred between your devices via QR code pairing or Apple iCloud Keychain sync—they never pass through our servers.

When end-to-end encryption is not enabled, command content stored in our database is encrypted at rest using organization-scoped keys managed by our infrastructure. While we implement commercially reasonable technical and organizational measures to protect personal data, no method of electronic storage is 100% secure.

When end-to-end encryption is enabled, certain metadata remains unencrypted because it is required for routing, policy evaluation, and system operation. This includes: tool names, event types, agent names, conversation identifiers, timestamps, approval decisions, and status fields. This is comparable to how encrypted messaging services protect message content while metadata remains visible for delivery.

Privacy Tiers

Agent Approve offers three privacy tiers that control what command content is stored in your event logs:

• Minimal: Only tool names are logged. No command content or parameters are stored.
• Summary: Command content is truncated in logs (first 50 characters).
• Full: Complete command content is stored in your event history.

When end-to-end encryption is enabled, privacy tier filtering happens on your machine before the history copy is encrypted, so the event history we store never contains more content than your configured tier allows. The privacy tier does not reduce the approval copy: in Approval Mode the complete command or tool input is still processed transiently for policy evaluation, as described in “Data We Process Transiently”.

Regardless of your privacy tier, the iOS app always receives full command content so you can make informed approval decisions. The privacy tier only controls what is retained in your event history after the approval decision is made.

Key Rotation and Forward Secrecy

If you enable end-to-end encryption, you may also configure automatic key rotation with configurable periods (hourly, daily, weekly, or monthly). Key rotation provides forward secrecy: if a current key is compromised, past communications encrypted with earlier keys remain protected. You control the key retention policy, including how many past keys are kept and whether old keys are discarded.

Data Retention

You control how long your event data is retained, from as little as 1 day to up to 1 year. When the retention period expires, data is automatically and permanently deleted. Retention cleanup runs daily.

If you delete your account from the iOS app settings, we delete your live Agent Approve account data. This includes pairing records and stored account encryption keys. Uploaded agent images are removed in the background, with retries if removal fails. Older account security logs are removed, and retained Apple notification records have their account and transaction identifiers and purchase payloads removed. We may retain a limited set of security, billing, and audit records after deletion for up to 24 months, including hashed account identifiers and security event logs, when needed to prevent abuse, investigate misuse, comply with law, or resolve billing disputes. Separately, we retain a minimal record of used trial eligibility for as long as we offer introductory trials. It contains hashed account or purchase identifiers and eligibility dates and reasons, so deleting and recreating an account does not provide another trial. It does not contain commands, tool inputs, or purchase payloads.

Policy Rules and Assisted Authoring

Policy Rules is available on eligible plans. Before you first add, create or enable a rule, or use Generate New Rules, the app asks for permission to share the information described below with AI providers. You can browse the rule library and provider information without accepting. Browsing does not send your content to these providers. Accepting does not enable a rule by itself: rule checks begin only when you have enabled rules, and rule generation begins when you submit a description.

Rule Evaluator

Policy Rules adds a further check to actions that your Deny List and Allow List did not already decide. Rules are checked by a rule evaluation provider that you choose in the app: Agent Approve Fast, which is included in your plan and uses Jev through Agent Approve's TypeSafe account with SubQ Snap and Perplexity Decider through OpenRouter as included fallbacks; Jev, the same TypeSafe rule evaluator using an API key from your own TypeSafe account, in which case TypeSafe may bill you and your own terms with them apply; SubQ Snap, using your own SubQ API key and account terms; Google Gemini, using an API key from your own Google account, in which case Google may bill you and its terms apply; Cloudflare Workers AI with your own Cloudflare account and API token; OpenRouter with your own API key, which routes requests to the host of your selected decision model; OpenAI Decisions with your own OpenAI API key; or, where we have enabled it, a custom endpoint that you configure and that we only allow on hosts we have approved. The first-use disclosure explains these data flows and links to our terms before you give permission. Provider details remain available in Settings. Your own provider account may have different retention and training settings from Agent Approve Fast. You can withdraw permission or turn off your rules. Withdrawing permission pauses the evaluator and keeps saved rules; actions that need an enabled rule check are sent to you for approval until permission is restored. Selecting None as your Rule Evaluator also stops provider checks.

For each action that reaches a rule check, the rule evaluation provider receives: the name of the tool your agent wants to use and its complete arguments, such as the full shell command or tool input, including any file contents or message text already embedded in those arguments; and the working directory, platform, shell and agent type, when your agent supplies them. Agent Approve Fast sends actions that are too large for Jev to its included fallback by default, subject to that provider's input limits. You can choose a different oversized-action behavior in Settings. When truncation applies, the processor receives a prefix of the action content with a note stating how many bytes were sent and omitted. The omitted content is not checked. This does not truncate the complete action used by our lists or live approval. It does not receive earlier commands, tool outputs or conversation history, and we do not read files from your computer to check a rule. Nothing is sent while no rules are enabled, or for actions your lists already decided. The processor returns match probabilities only; our server, not the processor, decides whether to deny, ask or allow.

For each rule check we retain an evaluation record: which rules and rule versions were checked, match probabilities, the decision, timing and token counts. It does not contain the command or tool input. These records are removed on the same schedule as your event history under your data retention setting. Match probabilities for identical actions may be cached for up to five minutes, keyed by a hash and encrypted, so a repeated action is not sent to the processor again.

Agent Approve Fast: included providers

Agent Approve Fast checks rules with Jev through Agent Approve's TypeSafe organization, which has zero data retention enabled. TypeSafe processes the submitted tool information and rule conditions to return match probabilities. TypeSafe states that it does not use inputs to train or fine-tune its models.

Under the default oversized-action setting, actions beyond Jev's input limit can be checked by SubQ Snap through Agent Approve's SubQ account, which has zero data retention enabled. SubQ does not retain request or response content under this agreement. It may retain operational metadata such as the model, token counts, and timing. See SubQ's data retention documentation.

When an included provider is unavailable or busy, Agent Approve can send the action and rules through its OpenRouter account to Perplexity Decider, subject to input limits and the time remaining for the check. We require zero data retention routing and deny provider data collection for these requests. Prompt and completion logging is disabled on our OpenRouter account. OpenRouter restricts this route to endpoints whose providers declare zero data retention. Its zero data retention policy permits temporary in-memory prompt caching and relies on the hosting provider's stated handling of requests.

These zero data retention controls apply to provider handling of Agent Approve Fast rule checks. They do not remove Agent Approve's event history, evaluation records, or temporary evaluation cache, which follow the retention practices described in this policy. The models used to generate draft rules have separate data-handling terms. You can also configure a backup provider using your own account. Its credentials and data terms apply to those checks, including when included credits run out. The event in the app identifies which provider checked the action and whether the input was truncated.

If you connect OpenAI Decisions with your own API key, your OpenAI organization's data controls govern those checks. OpenAI lists 30-day abuse-monitoring retention by default for the Decisions endpoint; Zero Data Retention is available only to eligible organizations that have it enabled. We do not use our OpenAI account for these checks or control your account's retention setting. OpenAI states that API data is not used to train its models by default unless your organization opts in.

Assisted authoring

“Generate New Rules” lets you describe the rules you want in your own words and receive draft rules to review. When you submit a description, it is processed by a language model provider under Agent Approve's own account: the app discloses the configured primary and backup providers before you submit. These may include Anthropic, OpenAI, and Google Gemini. Nothing is sent when you open the feature; the first request is sent when you submit your description.

What is sent: your description and follow-up messages; the draft rules in that session; and, for the policy you selected, its existing rules (names, conditions, actions and exact target identifiers), its Deny List and Allow List entries, and its default behavior. What is not sent: your agents' tool-call history and tool inputs, events, files, encryption keys, rule evaluator keys or endpoints, and your other policies.

Drafts are stored encrypted, expire after 30 minutes of inactivity (and no later than two hours after they start), and are removed by a scheduled cleanup within 24 hours of expiring. Discarding a draft removes it immediately. When you save draft rules, the session and its drafts are deleted; the rules you saved become part of your policy. A record of the save is kept: its encrypted copy of the save response, which exists so a repeated save request is not applied twice, is cleared after 24 hours, while non-content usage and provenance metadata (counts, timestamps, and session and policy identifiers) may remain. Rules you save are created turned on, so they take effect on the next action your lists did not already decide; you can turn any rule off or remove it at any time. We do not log your descriptions, messages or draft rules; our logs carry counts and status codes only.

Handling of data by the rule evaluation providers and language model providers on their own systems is governed by their terms and privacy policies. The TypeSafe, SubQ, and OpenRouter zero data retention controls described above cover Agent Approve Fast rule checks. These controls do not extend to Rule Generator or your own provider accounts. Our Rule Generator requests to OpenAI are sent with storage of the response as reusable application state disabled; that setting only prevents reuse of the response as stored state on OpenAI's side. OpenAI Decisions rule checks use your account when you connect your own key, as described above. Beyond these statements, we make no claim about what a provider retains.

Data Sharing and Sub-Processors

We do not sell your personal data. We use a limited number of third-party service providers (“sub-processors”) to operate the Service, including providers for database hosting, authentication, real-time messaging, application hosting, push notifications, payment processing, error monitoring, and usage metering. These parties process data only as necessary to perform services on our behalf and are required to protect your data consistent with this Privacy Policy.

When end-to-end encryption is enabled, your device-encrypted event history is unreadable to us and to our sub-processors. The approval copy described in “Data We Process Transiently” is processed in memory on our hosting infrastructure. After you give permission and use the relevant feature, two disclosed data flows send content to an AI provider: if you enable Policy Rules, the rule evaluation provider you chose receives the approval copy of the actions being checked, and if you use assisted authoring, the language model providers named in “Policy Rules and Assisted Authoring” receive what that section lists. Error monitoring services receive only error metadata and diagnostics, not command content. Usage metering services receive only aggregate counts, not content.

For security reasons, we do not publish our complete sub-processor list publicly. You may request our current sub-processor list at any time by contacting us at hello@agentapprove.com. We will notify active users via email or in-app notification before adding any new sub-processor that materially changes our data processing practices.

We may also disclose data if required by law, court order, or government request, or in connection with a merger, acquisition, or sale of assets. If you have enabled end-to-end encryption, we cannot produce the plaintext of your encrypted event history in response to legal requests because we do not have access to your encryption keys.

Data Breach Notification

In the event of a data breach affecting your personal information, we will notify affected users in accordance with California law (Cal. Civ. Code § 1798.82) and any other applicable laws, without unreasonable delay. Notification will be provided via email or in-app notification and will include the nature of the breach and recommended protective steps.

Your Rights

You may:

• Request access to or export of your data at any time by contacting us. Data exports will be provided in JSON format within 30 days of your request.
• Delete your account from the iOS app settings.
• Update your privacy tier, data retention period, and encryption settings at any time from the iOS app.
• Revoke consent for data collection by deleting your account or disabling specific features within the app settings.
• Request our current sub-processor list by contacting us.

Deleting your Agent Approve account does not cancel any App Store subscription. Apple manages subscriptions separately through your Apple account settings.

Children's Privacy

Our Service is not intended for users under 16 years of age. We do not knowingly collect information from children under 16. If we become aware that we have collected personal information from a child under 16, we will take steps to delete that information promptly.

International Users

Agent Approve is operated from the United States. If you are located outside the United States, your data will be transferred to and processed in the United States. By using Agent Approve, you consent to this transfer and processing. We comply with applicable privacy laws in the jurisdictions where the Service is made available.

The Service may not be available in all countries or regions. We may restrict availability in certain jurisdictions for regulatory compliance reasons, including encryption export regulations.

California Privacy Rights (CCPA)

California residents have the right to know what personal information is collected, request deletion, opt out of the sale of personal information (we do not sell data), and exercise these rights without discrimination. To exercise these rights, contact us at hello@agentapprove.com.

Voice Dictation

Voice dictation is optional and starts only when you use a dictation control and grant microphone and speech-recognition permission. Apple's Speech framework processes the audio to produce text. Recognition may run on your device or on Apple's servers; we do not require on-device-only recognition. Agent Approve does not save audio recordings or upload them to its own servers. The resulting text follows the data handling of the feature where you submit it, such as a follow-up instruction to your agent.

Push Notifications

When end-to-end encryption is enabled, push notifications use generic text (for example, “Approval request from Cursor”) and do not include command details. The actual command content is only visible after the iOS app decrypts the message on your device.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes via email or in-app notification at least 14 days before they take effect. Continued use of the Service after changes take effect constitutes acceptance of the updated policy.

Contact Us

For privacy-related questions, email us at hello@agentapprove.com.