# Privacy Policy for AgentOS

**Last updated: March 17, 2026**

## Overview

AgentOS ("the App") is an autonomous AI agent operating system that runs entirely on your device. We are committed to protecting your privacy. This privacy policy explains what data the App accesses, how it is handled, and your rights.

## Developer

AgentOS is developed and published by Substitution Art.

## Data Processing Principles

AgentOS is designed with a **privacy-first, on-device architecture**:

- **All AI inference runs locally on your device.** No voice input, text, or personal data is sent to cloud AI services.
- **There are no user accounts.** You do not need to register or sign in.
- **There is no analytics, tracking, or telemetry.** We do not use any third-party analytics SDKs (no Firebase Analytics, no Crashlytics, no ad networks, etc.).
- **We do not collect, store, or transmit your personal data to our servers.** We do not operate any backend servers that receive user data.

## Data Accessed On-Device

When you instruct the AI agent to perform tasks, it may request access to the following device capabilities. Each requires your explicit permission via the operating system's permission dialog:

| Data Type | Purpose | Stored/Shared? |
|---|---|---|
| **Microphone** | Voice input (speech-to-text), VoIP calls | Processed on-device only. Not stored or transmitted to external servers. |
| **Calendar** | Read/write calendar events on your behalf | Accessed locally via system APIs. Not transmitted. |
| **Contacts** | Look up contacts for tasks like calling or messaging | Accessed locally via system APIs. Not transmitted. |
| **Health Data** | Read/write health metrics (steps, heart rate, weight, sleep, etc.) via Apple HealthKit / Google Health Connect | Accessed locally via system APIs. Not transmitted. |
| **Location** | Location queries and geofence-based automations | Accessed locally via system APIs. Not transmitted. |
| **Photos** | Access or save photos on your behalf | Accessed locally via system APIs. Not transmitted. |
| **Reminders** | Read/write reminders on your behalf | Accessed locally via system APIs. Not transmitted. |
| **Notifications** | Send local notifications for scheduled tasks and automations | Generated locally on-device. |

## Network Connections

The App makes the following network connections:

### 1. AI Model Downloads
On first launch, the App downloads AI model files (~7.5 GB) from GitHub Releases. This is a one-time download. No personal data is transmitted during this process.

### 2. Data Sources (User-Initiated)
When you ask the agent to fetch information, it connects to public APIs:
- **News:** Tagesschau, SPIEGEL, BBC (RSS feeds), Hacker News
- **Weather:** Brightsky (DWD open data)
- **Finance:** CoinGecko (cryptocurrency prices), ECB (exchange rates)

These requests contain no personal data or identifying information beyond your device's IP address (which is inherent to any internet connection).

### 3. Online Banking (User-Initiated)
If you choose to use the banking feature, the App connects directly to your bank via the FinTS 3.0 protocol over HTTPS. Your banking credentials (BLZ and username) may be stored locally on your device in app preferences for convenience. Your banking PIN is **never stored** and must be entered each time. No banking data passes through our servers.

### 4. VoIP / Phone Calls (User-Initiated)
If you use the VoIP calling feature, the App establishes direct SIP connections. Call audio is processed on-device for the AI conversation. No call data is transmitted to our servers.

## Data Storage

All data is stored locally on your device:
- **App preferences** (theme, companion name, haptics setting, banking configuration) are stored in SharedPreferences / UserDefaults.
- **Automation triggers and scheduled tasks** are stored in a local SQLite database.
- **AI model files** are stored in the app's documents directory.

No data is synced to any cloud service.

## Third-Party Services

The App does **not** integrate any third-party services that collect user data. Specifically:
- No advertising SDKs
- No analytics SDKs
- No crash reporting SDKs
- No social media SDKs
- No attribution or tracking SDKs

## Children's Privacy

AgentOS is not intended for use by children under the age of 18. The App includes features such as financial services and health data access that are designed for adult users. We do not knowingly collect any data from children.

## Your Rights

Since AgentOS does not collect or transmit personal data to external servers, there is no personal data held by us to access, modify, or delete. All data resides on your device and can be removed by uninstalling the App.

Under the EU General Data Protection Regulation (GDPR) and other applicable laws, you have the right to:
- **Access** any personal data we hold about you (we hold none)
- **Delete** your data by uninstalling the App
- **Withdraw consent** for any device permission at any time through your device's settings

## Changes to This Policy

We may update this privacy policy from time to time. Changes will be reflected in the "Last updated" date at the top of this document. Continued use of the App constitutes acceptance of the updated policy.

## Contact

If you have questions about this privacy policy, please contact us at:

**Substitution Art**
Email: privacy@substitution.art

## Open Source

The privacy policy is part of the AgentOS source repository and its revision history is publicly auditable.