Temps Fleet Privacy Policy

• Fleet has no account and no sign-in. We don't know who you are.
• Your agents, projects, code, prompts and conversations live on the computer that runs Fleet. We never receive them.
• The iPhone app talks to your computer through an end-to-end encrypted tunnel. Our relay forwards ciphertext it cannot read.
• If you turn on push notifications, a conversation title and short preview pass through our relay to Apple so iOS can display them.
• If you turn on background keep-alive for port previews, the iPhone app asks for location access used only to keep the app running while a preview is open; it never reads, stores, or sends your location.
• The iPhone and iPad app sends anonymous, opt-out usage and performance data; the desktop app doesn't yet. Both send privacy-filtered crash reports so we can fix bugs.
• No advertising, no tracking across apps or websites, and we never sell data.

On the computer running Fleet (your Mac, PC, or a server you control): agent conversations and their history, your project files, prompts, attachments you upload, sandbox profiles, notification preferences, paired-device records and the list of Temps servers you manage. Fleet keeps these in a local database and files under ~/.temps-fleet/. We have no access to them.

On your iPhone or iPad: the pairing credential for each Fleet you connect to, stored in the iOS Keychain; your notification preferences; and a small cache of recently viewed conversations (up to 50 recent messages for at most 20 conversations, expiring after seven days) so chats open instantly. Removing a pairing clears its cached conversations.

The iPhone app does not access your contacts, photo library, microphone or camera. It may ask for local network access, which it uses only to reach your own Fleet or Temps servers directly when they are on the same network. If you turn on Keep Fleet running in the background, it also asks for location access, used only as described below to keep a port preview loading; it is off by default and the app never reads, stores, or sends your location. Files and images you choose to attach are sent to your own Fleet through the encrypted tunnel. Pairing by QR code uses the iOS Camera app, not Fleet.

Fleet runs the agent command-line tools you install on your computer: Claude Code, Codex and OpenCode. Those tools send your prompts and relevant code to their providers (for example Anthropic or OpenAI) under your own account and your agreement with that provider. Fleet does not proxy that traffic, and the iPhone app never talks to an AI provider directly. Check each provider's privacy policy for how they handle your data.

If you use Fleet to manage self-hosted Temps servers, Fleet connects to them directly with API keys you provide. That data stays between Fleet and your servers.

Your phone and your computer are rarely on the same network, so by default they connect through a relay operated by Temps. Both sides open an outbound connection to it, and everything between them travels inside an end-to-end encrypted Noise protocol session whose keys exist only on your devices.

The relay can see routing identifiers, when devices connect, the size and timing of encrypted messages, and the network (IP) addresses they connect from, as any internet service does. It cannot see your prompts, code, messages, files, request paths or API tokens, and it does not store the traffic it forwards. When your phone can reach your computer directly over a local network or tailnet, Fleet uses that direct path instead and the relay is not involved. You can also run your own relay and point Fleet at it.

Pairing uses one-time invitations that expire after five minutes and require your approval on the computer. Each paired device gets its own credential, which you can revoke at any time.

Push notifications are off until you enable them in the iPhone app. When you do, your device's Apple Push Notification service (APNs) token is registered with the Fleet on your computer, which stores it encrypted in its local database.

When an agent finishes, fails, or needs your input, your computer sends the notification through our relay to Apple. It contains the conversation title (up to 100 characters), a short preview of the reply, question, or permission request (up to 240 characters), opaque device, conversation and route identifiers, the sound you chose, and your APNs token. This notification content is not end-to-end encrypted: the relay passes it straight to Apple without storing it, and Apple delivers it to your device. Previews may contain text from your conversations and can appear on your lock screen; you can hide previews in iOS notification settings or disable Fleet push entirely.

Undelivered notifications expire from your computer's outbox after one hour. Disabling push removes the phone's subscription and its queued notifications; revoking the device stops all delivery to it. Apple handles push delivery under its own privacy policy.

If you turn on Keep Fleet running in the background, Temps Fleet asks for location access While Using the App and runs low-accuracy location updates only while a port preview is open on your iPhone, so iOS keeps the app running and your preview keeps loading in Safari. Temps Fleet never reads, stores, logs, or transmits your location: each update is discarded as soon as it arrives, and nothing about your location is sent to your Fleet, to Temps, or to anyone else. The option is off by default; turn it off any time in Settings › Port previews, or revoke location access in iOS Settings.

When the Fleet app crashes or hits an unexpected error, including on iPhone, it sends an error report to an error-tracking service that we run ourselves on Temps. Before a report leaves your device, Fleet removes error messages, request URLs and bodies, headers, cookies, hostnames, user identity, project context, local variables, file paths, agent names and message text. What remains is the kind of error, the app version, and the location in Fleet's own code where it happened, so we can group and fix it. Session replay and performance tracing are not used.

These reports are not linked to you or your device, and are used only to fix bugs in Fleet. The app currently has no in-app switch for them; if you'd rather not send them, tell us and we'll help. The Settings › Privacy switch controls usage and performance data only, not crash reports.

The iPhone and iPad app from the App Store and TestFlight sends anonymous usage and performance data: app launches; the device family (iPhone, iPad, Android phone or tablet, or computer operating system); the operating system's major version (for example 18); the app version and build number; and summaries of how fast the app starts, connects, loads data, reconnects, and shows the first word of an agent's reply (sample count and typical/slow/slowest times in milliseconds). It uses a random identifier created by the app and stored only on your device. It never uses your device's advertising or vendor identifier or any hardware serial. We store a salted one-way hash of that random identifier, never the identifier itself, and never your IP address (it is used transiently to derive a country). Nothing sent includes conversations, prompts, code, files, paths, project or host names, email addresses, or logs.

The desktop app currently sends no usage or performance data.

Turn this off anytime in Settings › Privacy › Share anonymous usage and performance data. On a phone the choice applies to that device; turning it off stops collection immediately and deletes anything not yet sent.

The standalone temps-fleet command-line service (for example on a Linux server) may send a small set of pseudonymous product events, such as “server started” or a stable error code, tied to a random installation ID, the Fleet version, operating system, its major version, architecture, device family, and anonymous performance summaries. They never contain prompts, code, paths, hostnames, names, email addresses or logs. Our receiver hashes the installation ID, derives only a country code from the connecting IP address and discards the address, and deletes raw events after 90 days (aggregate counts are kept longer). Turn it off with temps-fleet start --no-telemetry or by setting TEMPS_FLEET_NO_TELEMETRY=1. The CLI also honours the Settings › Privacy switch for its Fleet service, so turning sharing off there covers the CLI too.

The optional activity-score leaderboard is separate and off by default. If you opt in, Fleet publishes only a weekly score, day count and streak, plus a handle if you choose one. Turning sharing off withdraws what you published.

• Data on your computer and phone stays until you delete it. Uninstalling Fleet or deleting ~/.temps-fleet/ removes it from the computer.
• Revoke a phone or tablet from Manage paired devices or Settings › Fleet connections on the computer. It loses access immediately and receives no further notifications.
• Raw usage and performance events (mobile and CLI) are kept for 90 days; the aggregate counts and summaries derived from them are kept longer.
• The relay keeps no copy of your traffic or notification content.
• Crash reports are kept only as long as needed to diagnose and fix the problem. Because they carry no identity, we can't look up “your” reports, but we'll delete reports on request if you can tell us roughly when and where the crash happened.

We don't sell or rent data, and we don't share it for advertising. The only third party involved in the iPhone app's data flows is Apple, which delivers push notifications and distributes the app. AI providers are involved only through the tools you install and sign in to yourself. We may disclose information if required by law, but for the reasons above we hold very little.

Temps Fleet is a developer tool and is not directed at children. We don't knowingly collect personal information from children under 13 (or the minimum age in your country). If you believe a child has sent us personal information, contact us and we'll delete it.

You can ask us what we hold about you, or ask us to correct or delete it. Email david@temps.sh or use the contact form. A person reads every message. For help using the app, see Temps Fleet support.

If Fleet's data handling changes, we'll update this page and its effective date before the change ships in a release.