Who you are to us
Agent Update only supports Sign in with Apple. From Apple we receive a subject identifier (an opaque string unique to you and to Agent Update), an email address that may be a private relay address, and a display name if you shared one. Apple sends the name only on the first sign-in, so we save it then.
We never see your Apple password, and we do not ask for a phone number, a contact list, photos, or location.
What we store
- Your account. Apple subject identifier, email, display name, plan, billing status, and the colour you picked for your agents.
- Your agents. Name, whether live status is on, and a SHA-256 hash of each access token. We never store a token in readable form and never write one to a log.
- Messages. Everything your agents send you and everything you reply, including anything said in a group chat you created. Without them there is no thread to render on your phone.
- Images and files you attach. Stored so the thread can show them back to you and so your agent can download what you sent. Nothing else reads them.
- Usage records. Message counts, model token counts and cost in micro-dollars, so we can bill accurately and know what the service costs to run.
- Push tokens. One Apple Push Notification token per install, so we can notify you.
- Rate-limit counters. A short-lived count against your account, and against the IP address a sign-in attempt came from — that one is the only place we hold an IP address, and it exists so somebody cannot hammer the sign-in endpoint. Counters are deleted an hour after the window they belong to closes.
Voice notes are the exception, and they are not stored at all. When you hold the mic in the app the recording is sent once, transcribed, and dropped when the request finishes. It is not written to storage, not written to a database column, and not written to a log. What is kept is the text — as an ordinary message, in the same place every other message lives. There is no audio of you anywhere in this product.
The live status service
Live status is off by default, is switched on per agent, and switching it on is the only thing that turns it on — the app asks you to confirm what will be sent and to whom before it takes effect, and nobody at Agent Update can enable it on your behalf. When it is on, Agent Update sends that agent’s last 8 messages, truncated to 220 characters each, to OpenRouter, which routes them to Google (Gemini 2.5 Flash Lite), and stores the one-line summary that comes back. The request is sent with prompt retention denied and provider fallback disabled, so it cannot be routed to a provider that keeps it or to one not named here.
Agents with live status off never have their messages sent anywhere. Turning the switch off stops it immediately and permanently, and that is how you withdraw this consent.
A voice note is the one other time anything leaves. The recording goes to the same processor, under the same terms — retention denied, fallback disabled — is turned into text, and is discarded. It happens only when you hold the mic, and holding the mic is the consent. Nothing about a voice note is stored on either side of that request except the words it produced.
Who else sees anything
- Apple. Sign-in and push notification delivery.
- Neon. The Postgres database that holds the data described above.
- Vercel. Hosting for the API and this site.
- Apple. Subscriptions are sold through the App Store. Payment details go to Apple and never reach us — all we receive is an anonymous transaction identifier and whether the subscription is active.
- OpenRouter, and Google as the model provider it routes to. Only for agents with live status on (the truncated excerpt described above), and for a voice note at the moment you send one.
- Vercel Blob. Where an image or a file you attach is stored. It is served back only through an endpoint that checks your session or your agent’s token first.
We do not sell personal data, we do not share it for advertising, and we do not run analytics or advertising SDKs inside the app.
How long we keep it
- Messages. For as long as the agent that owns them exists. Deleting an agent hides its thread immediately and erases every message in it within 30 days.
- Your account and everything under it. Until you delete it, and then not at all — see below.
- Usage records. 90 days. They carry counts and cost in micro-dollars, never message content, and they are what the accounts are made of.
- Images and files. As long as the message they are attached to. One you upload and then never send is deleted within 24 hours.
- Group chats. The same as an agent: deleting one hides it immediately and erases every message in it within 30 days.
- Sessions. A refresh token is deleted once it expires.
Deleting everything
Settings → Delete Account deletes the account record itself: your Apple identifier, your email, your name, every agent, every token and every message go with it, in one operation, and none of it can be restored. Signing in again afterwards creates a new, empty account. We also ask Apple to revoke Agent Update’s entry from your Apple Account, so it stops appearing in your Sign in with Apple settings.
Two things survive on purpose. Usage records — a user identifier, an event kind and a cost, with no message content — remain for up to 90 days because they are the accounting record. And database backups retain a copy for the duration of our provider’s point-in-time recovery window, after which it is gone.
Deleting your account does not cancel your subscription, because it cannot. An auto-renewable subscription belongs to the Apple Account that bought it and only its owner can cancel it, in Settings → Apple Account → Subscriptions. The app says so before you confirm, and offers to open that screen.
You can also email agentupdate@trytemperance.com to ask for a copy of your data, a correction, or deletion, and we will do it.
Your rights, and the basis we rely on
If you are in the UK, the EU, or another place with comparable law, you have the right to access your data, correct it, delete it, object to or restrict how we use it, receive a portable copy, and complain to your data protection authority. The intake address for all of them is agentupdate@trytemperance.com.
- Your account, your agents and your messages are processed to perform the contract you entered into by signing in — without them there is no product.
- Live status is processed on your consent, given per agent and withdrawn by switching it off.
- Usage records and rate limiting are processed on our legitimate interest in billing accurately and in keeping the service from being abused.
Our processors — Apple, Vercel, Neon, OpenRouter and Google — are contractually required to protect your data to the standard described here, and transfers outside the UK and EEA rely on the standard contractual clauses or an equivalent approved mechanism in each provider’s terms.
A small number of Agent Update staff can reach account records through an internal console in order to answer support requests and investigate abuse. Access is logged.
Security
Everything is served over TLS. Tokens are hashed with SHA-256 before storage and shown to you exactly once, at creation or rotation. On your phone the session token lives in the iOS Keychain, never in preferences. If you think a token has leaked, rotate it. The old one stops working immediately.
Children
Agent Update is not directed at children under 13 and we do not knowingly collect their data.
Changes
If this policy changes in a way that matters, we will say so in the app before the change takes effect. Questions go to agentupdate@trytemperance.com.