Privacy policy

Email/password, Sign in with Apple, and Google sign-in use Firebase Authentication. Authentication processes your email address, account and provider identifiers, and credentials or sign-in tokens. A sign-in provider may also supply profile information, such as your name and profile image URL. Passwords entered for email sign-in are sent to Firebase, not to the Bridge.

The account profile in Firestore stores your Firebase user ID, email address, creation time and, after a Mac is registered, its server-issued tenant ID and registration time. Each Mac relay has one server-recorded Firebase account owner and cannot be shared across different accounts. An account can register more than one Mac relay. A profile pointer or a locally calculated hash is not accepted as ownership proof.

The Mac relay sends task IDs, short titles, provider names, states and timestamps to the Bridge. These fields are readable by the service. It also sends available provider usage totals, usage windows, limits, reset times and reset-credit metadata. The service stores the latest state, your recent/pinned source selection and completion-read acknowledgements to synchronize your devices.

The status payload is not a repository or full conversation upload. However, titles can contain information from your conversations, including confidential material. Formatted final responses are handled separately below. Do not put secrets in titles or assume that truncation removes sensitive information.

Agent Maxer for Windows can read status from coding tools you enable on your computer. Depending on the provider, it reads local status files, invokes a separately installed client or receives local task events. Provider clients, accounts and subscriptions remain separate from Agent Maxer.

When you connect your Agent Maxer account, this computer can share limited task and usage information with your signed-in devices. This includes task identifiers, short titles, provider names, task states, observation times and available usage amounts, limits and reset times. Titles and project names may contain confidential information. The status payload does not upload repositories, complete conversations, raw provider records or local provider credentials.

Windows stores supported local provider and device credentials using Windows data protection for the signed-in Windows user. Sign-in and supported cloud access use Firebase Authentication and App Check. Windows App Check uses Google's managed reCAPTCHA Enterprise in an embedded browser component. Google's Privacy Policy and Terms of Service apply to its processing.

Your account's selected computer, tracked-chat source and completion-read state can synchronize across your devices. The Windows owner client listens directly to account-scoped Firestore documents. Disconnecting the computer stops sharing from that installation; account and device revocation remain separate controls.

Agent Maxer for Android displays information published by computers connected to your Agent Maxer account. Firebase Authentication processes account and sign-in information. The app reads account-authorized status and usage projections from Google Cloud Firestore and uses authenticated Bridge routes for account, device and supported response operations. Task titles, provider names, status, usage, reset information, device registrations and selected preferences are processed to provide these features. Provider credentials remain on the connected computer and are not included in its status payload.

Android notifications use Firebase Cloud Messaging. Registration and delivery process installation and device-session identifiers, notification tokens and routing information. Notifications, widgets and media controls may display task information, including on the Lock Screen, subject to Android settings. Delivery may be delayed, and previously displayed content can remain until Android refreshes it. Revocation cannot retract notifications already submitted.

For supported spoken responses, the connected computer encrypts response text before an authorized device retrieves it. Android keeps device speech keys in protected local storage and decrypts response text for playback without caching that plaintext to disk. Playback requires an installed offline English text-to-speech voice and starts only when you request it. Agent Maxer does not record the microphone. Playback uses an Android media-playback foreground service and notification; this service does not keep sync running.

The Android app disables Firebase Analytics collection and does not include the Android Analytics, Crashlytics or AppsFlyer app SDKs. Google/Firebase, RevenueCat and hosting services can still process technical, network, purchase and security information for their services. Release Android uses Firebase App Check with Google Play Integrity alongside sign-in and account authorization. This does not make account-linked data anonymous or provide end-to-end encryption for task status.

When you connect Agent Maxer in ChatGPT, you sign in to Agent Maxer, choose one computer owned by your account, and explicitly allow read access. The connection can return that computer's published task titles, provider names, attention states, observation freshness, provider allowances and reset times, and estimated usage pacing to ChatGPT. It covers at most 16 published tasks; it is not a complete session or worktree inventory. Task actions, approvals, conversation responses and provider credentials are not available through this connection. OpenAI processes information returned to ChatGPT under its own terms and privacy policy.

The connection service uses Firebase Authentication, App Check and Google Cloud Firestore. It stores account- and computer-scoped authorization grants, one-time request and code records, token hashes, and expiry and revocation metadata. Raw connection access and refresh tokens are not saved in Firestore. Access tokens expire after 15 minutes; a connection lasts at most 30 days and refresh tokens rotate when used. You can revoke access at the ChatGPT connections page. Revocation stops new reads but cannot retract information already returned to ChatGPT. Account deletion fences access and removes connection grants with your account profile; expired code, request and token-index records follow asynchronous cleanup. Expiry does not promise physical deletion from provider logs or backups at that exact time. The connection adds no product Analytics events or provider credentials to measurement.

Once the Mac relay is configured, completed responses are shared automatically with your signed-in devices. Current production limits response availability to 24 hours. The 30-day availability update described below is prepared but not yet live. New completions are read aloud automatically on eligible iPhones. Formatting removes fenced code blocks, but is not a sensitive-data filter.

Response text is encrypted on the Mac using AES-GCM before upload and decrypted on an authorized signed-in iPhone for system speech playback. Thread and response IDs, the speech context ID and expiry times remain readable. The Mac creates an independent random content key that is not derived from a device credential. When an eligible signed-in iPhone uses spoken responses, it publishes a device-specific public key. The Mac sends the Bridge a separately wrapped copy of the speech content key for each eligible iPhone; only the matching private key stored in that iPhone's Keychain can unwrap it. The unencrypted content key is never sent to the Bridge. Agent Maxer does not record your microphone or upload a voice recording for this feature.

A signed-in Mac asks the Bridge to create a server-generated tenant ID bound to the authenticated Firebase account. Each signed-in installation creates a random access credential, keeps the raw credential in Keychain, and sends only its hash during registration. The Bridge issues a device session bound to the account, selected Mac, device type and environment. An Apple Watch receives a separately scoped member credential through its signed-in iPhone. Speech private keys and the unencrypted speech content key remain in Keychain on their respective devices.

Live Activity and widget features register push tokens and, where applicable, an app-generated device ID, activity ID, push environment and widget kind/family. Stored push tokens are encrypted at rest; the service can decrypt them to send updates through Apple Push Notification service. Task status sent in notifications is processed by Apple and may be visible on your Lock Screen, watch or desktop. Signed-in devices can review and revoke registered installations.

Agent Maxer uses Google Analytics for Firebase on its website, iPhone, iPad and Mac apps to measure visits, App Store link clicks, account creation and sign-in, setup and connection outcomes, first useful app data, paywall views, checkout outcomes, and restore success. These events have no task titles, prompts, response text, email addresses, pairing keys, or provider usage details. Google may process app and device details, browser information, IP addresses and interaction data to provide these reports. Agent Maxer does not use this measurement for cross-app advertising tracking or personalized ads.

Product analytics run automatically on the website and in the iPhone, iPad and Mac apps. The custom product events are limited to those described above.

Firebase App Check uses browser risk assessment on the website and Apple app attestation on supported iPhone and iPad devices, and DeviceCheck on supported Macs, to help reject forged requests. It supplements account sign-in and server authorization. The Apple Watch app and widgets do not run the Analytics SDK.

Versions that include AppsFlyer ask for permission through Apple's tracking prompt before starting advertising measurement. If you allow it, AppsFlyer receives installation and session information, device identifiers and technical/network information to measure which ads lead to installs. It can also receive fixed events for useful app data becoming available, viewing the subscription paywall, and starting checkout. RevenueCat links subscription events, including purchases, trials, renewals and cancellations, to the installation for advertising measurement. These events can include your RevenueCat customer identifier, transaction details, product, currency and revenue. Connected advertising partners, including X, may receive conversion information to measure and optimize Agent Maxer ads.

If you decline or tracking is restricted, the app does not start AppsFlyer or provide an AppsFlyer installation identifier to RevenueCat. You can change permission in Apple's Settings. On the next app activation, Agent Maxer applies that choice and queues any RevenueCat attribution changes for synchronization. Network availability can delay the server update. Revocation does not delete previously collected records. Purchasing and using Agent Maxer do not require tracking permission. Task titles, prompts, responses, provider usage and account credentials are not sent to AppsFlyer. The Mac, Watch and widgets do not include the AppsFlyer SDK. RevenueCat shares a subscription account across your devices, so subscription events for that account may include purchases made on another device. Attribution choices are synchronized on that shared RevenueCat account; another consenting iPhone or iPad can update its attribution information.

iPhone and iPad versions that include diagnostics use Firebase Crashlytics to investigate crashes and errors, including failed subscription purchases. Reports can include stack traces, app version, operating system and device technical information, installation identifiers, and recent Analytics events. These reports help maintain and repair the app.

The app's purchase-error logger sends only a fixed operation name and sanitized error categories and numeric codes. It does not send raw receipts, account IDs, email addresses, prompts, response text, credentials, or raw error messages. Agent Maxer does not assign an account ID to Crashlytics reports. Reports can still distinguish app installations. Provider retention rules apply.

Display preferences, imported wallpapers and cached status are stored on your devices. Widgets share selected state and entitlement settings with their app group. The Mac reads supported agent data from local files or helper processes you enable. Provider credentials are not included in the Bridge status payload; connections to an agent provider may use those credentials with that provider. The provider's own service and privacy terms apply to those connections.

The website uses Firebase browser storage to maintain sign-in. Its hosting service and account providers process network information such as IP addresses, user agents and request timing to deliver and protect their services. The website does not include an advertising pixel. This does not exclude service-provider logging or the analytics described above.

Google/Firebase provides authentication, data storage, Android messaging and Play Integrity app verification; Google Cloud hosts the Bridge and Google processes Google Play purchases. Apple provides sign-in, App Store purchases, device synchronization and Apple push delivery. RevenueCat provides subscription processing and analytics. AppsFlyer provides the consent-based advertising measurement described above. Website hosting processes requests and serves site assets. These services receive data needed for their roles, including operational and security information.

Google Sign-In's SDK also declares account/profile information (including phone number where available), approximate location, device identifiers and usage/technical data for functionality or analytics. Those SDK disclosures are broader than the fields saved in Agent Maxer's account profile. Provider retention and service terms also apply to data processed by those providers.

Provider information: Firebase privacy and security, Google privacy policy, RevenueCat privacy policy, AppsFlyer privacy policy, and Apple privacy policy.

Latest relay state is replaced by subsequent updates. Other records, including profiles, registrations and acknowledgements, can remain until removed. The current production service limits speech response availability to 24 hours. Expiry is not a guarantee of physical deletion at that time; asynchronous provider cleanup, logs and backups can retain copies longer.

30-day availability update — not yet live. After the updated service and apps are released, new speech envelopes will be available for up to 30 days. A newer response in the same session will replace the previous one. Storage will be limited to 32 sessions per Mac relay by default (configurable up to 64). New uploads will remove expired responses first, then evict the least recently published responses when needed. Listening will not delete a response. Expired responses will be refused and removed when read; uploads will also clean up expired responses in bounded batches. This update will not extend existing encrypted expiry times or guarantee physical deletion within 30 days.

Account deletion first asks the Bridge to fence and remove relays owned by the signed-in account, their stored content and device registrations, and the account profile. Firebase Authentication is deleted last. If ownership is ambiguous or cleanup is incomplete, deletion stops and keeps sign-in available for a safe retry. Minimal retirement and operation records remain to prevent old credentials from being reused. Provider records, service logs, backups and Apple subscription records follow their providers' retention rules and may not be removed by this flow. Google Play and RevenueCat records also follow their providers' retention and deletion processes. Account deletion does not cancel an Apple or Google Play subscription.

In Agent Maxer for Android, open Settings, then Account, then Delete account and confirm the request. You can also sign in on the account page to request account deletion without installing the app. For help or if you cannot sign in, email admin@numbus.app with the subject “Agent Maxer account deletion.” We will verify ownership; do not send a password or payment-card information.

Deletion removes the account profile, owned connected-computer records, stored task and response content, and device registrations through the account-deletion flow described above. Minimal security/retirement records, provider logs, backups and purchase records can be retained under the applicable provider rules. A support request can include a request for associated RevenueCat data; Google Play transaction records remain subject to Google's requirements. This does not promise immediate erasure from every provider. Cancel a Google Play subscription separately in Google Play subscriptions.

You can stop the Mac relay to stop new relay uploads, choose which supported agents to connect, manage playback and display settings, and control visible notifications and widgets through your operating system's settings. Account controls are available in the apps and on the account page. Signing out immediately suspends the affected local device. Server detachment prevents new reads, registrations and push admissions for that device and its connected Apple Watch while preserving other devices. If the device is offline, remote cleanup remains pending and is retried. Already submitted notifications may still arrive, and previously rendered offline content can remain until the system refreshes it. Existing stored data is subject to the limitations above.

Agent Maxer is provided by Numbus LLC. For privacy questions or account-deletion help, email admin@numbus.app. The same Agent Maxer privacy and account-deletion disclosure is also available at legal.numbus.app.