Temps Fleet Privacy Policy

• Fleet has no account and no sign-in. We don't know who you are.
• Your agents, projects, code, prompts and conversations live on the computer that runs Fleet. We never receive them.
• The iPhone app talks to your computer through an end-to-end encrypted tunnel. Our relay forwards ciphertext it cannot read.
• If you turn on push notifications, a conversation title and short preview pass through our relay to Apple so iOS can display them.
• The desktop and iPhone apps send no product analytics. They do send privacy-filtered crash reports so we can fix bugs.
• No advertising, no tracking across apps or websites, and we never sell data.

On the computer running Fleet (your Mac, PC, or a server you control): agent conversations and their history, your project files, prompts, attachments you upload, sandbox profiles, notification preferences, paired-device records and the list of Temps servers you manage. Fleet keeps these in a local database and files under ~/.temps-fleet/. We have no access to them.

On your iPhone or iPad: the pairing credential for each Fleet you connect to, stored in the iOS Keychain; your notification preferences; and a small cache of recently viewed conversations (up to 50 recent messages for at most 20 conversations, expiring after seven days) so chats open instantly. Removing a pairing clears its cached conversations.

The iPhone app does not access your contacts, location, photo library, microphone or camera. It may ask for local network access, which it uses only to reach your own Fleet or Temps servers directly when they are on the same network. Files and images you choose to attach are sent to your own Fleet through the encrypted tunnel. Pairing by QR code uses the iOS Camera app, not Fleet.

Fleet runs the agent command-line tools you install on your computer: Claude Code, Codex and OpenCode. Those tools send your prompts and relevant code to their providers (for example Anthropic or OpenAI) under your own account and your agreement with that provider. Fleet does not proxy that traffic, and the iPhone app never talks to an AI provider directly. Check each provider's privacy policy for how they handle your data.

If you use Fleet to manage self-hosted Temps servers, Fleet connects to them directly with API keys you provide. That data stays between Fleet and your servers.

Your phone and your computer are rarely on the same network, so by default they connect through a relay operated by Temps. Both sides open an outbound connection to it, and everything between them travels inside an end-to-end encrypted Noise protocol session whose keys exist only on your devices.

The relay can see routing identifiers, when devices connect, the size and timing of encrypted messages, and the network (IP) addresses they connect from, as any internet service does. It cannot see your prompts, code, messages, files, request paths or API tokens, and it does not store the traffic it forwards. When your phone can reach your computer directly over a local network or tailnet, Fleet uses that direct path instead and the relay is not involved. You can also run your own relay and point Fleet at it.

Pairing uses one-time invitations that expire after five minutes and require your approval on the computer. Each paired device gets its own credential, which you can revoke at any time.

Push notifications are off until you enable them in the iPhone app. When you do, your device's Apple Push Notification service (APNs) token is registered with the Fleet on your computer, which stores it encrypted in its local database.

When an agent finishes, fails, or needs your input, your computer sends the notification through our relay to Apple. It contains the conversation title (up to 100 characters), a short preview of the reply, question, or permission request (up to 240 characters), opaque device, conversation and route identifiers, the sound you chose, and your APNs token. This notification content is not end-to-end encrypted: the relay passes it straight to Apple without storing it, and Apple delivers it to your device. Previews may contain text from your conversations and can appear on your lock screen; you can hide previews in iOS notification settings or disable Fleet push entirely.

Undelivered notifications expire from your computer's outbox after one hour. Disabling push removes the phone's subscription and its queued notifications; revoking the device stops all delivery to it. Apple handles push delivery under its own privacy policy.

When the Fleet app crashes or hits an unexpected error, including on iPhone, it sends an error report to an error-tracking service that we run ourselves on Temps. Before a report leaves your device, Fleet removes error messages, request URLs and bodies, headers, cookies, hostnames, user identity, project context, local variables, file paths, agent names and message text. What remains is the kind of error, the app version, and the location in Fleet's own code where it happened, so we can group and fix it. Session replay and performance tracing are not used.

These reports are not linked to you or your device, and are used only to fix bugs in Fleet. The app currently has no in-app switch for them; if you'd rather not send them, tell us and we'll help.

The desktop and mobile apps, including the App Store and TestFlight builds, have product telemetry turned off. They do not create an installation identifier or send usage events.

The standalone temps-fleet command-line service (for example on a Linux server) may send a small set of pseudonymous product events, such as “server started” or a stable error code, tied to a random installation ID, the Fleet version, operating system and architecture. They never contain prompts, code, paths, hostnames, names, email addresses or logs. Our receiver hashes the installation ID, derives only a country code from the connecting IP address and discards the address, and deletes raw events after 90 days. Turn it off with temps-fleet start --no-telemetry or by setting TEMPS_FLEET_NO_TELEMETRY=1.

The optional activity-score leaderboard is separate and off by default. If you opt in, Fleet publishes only a weekly score, day count and streak, plus a handle if you choose one. Turning sharing off withdraws what you published.

• Data on your computer and phone stays until you delete it. Uninstalling Fleet or deleting ~/.temps-fleet/ removes it from the computer.
• Revoke a phone or tablet from Manage paired devices or Settings › Fleet connections on the computer. It loses access immediately and receives no further notifications.
• The relay keeps no copy of your traffic or notification content.
• Crash reports are kept only as long as needed to diagnose and fix the problem. Because they carry no identity, we can't look up “your” reports, but we'll delete reports on request if you can tell us roughly when and where the crash happened.

We don't sell or rent data, and we don't share it for advertising. The only third party involved in the iPhone app's data flows is Apple, which delivers push notifications and distributes the app. AI providers are involved only through the tools you install and sign in to yourself. We may disclose information if required by law, but for the reasons above we hold very little.

Temps Fleet is a developer tool and is not directed at children. We don't knowingly collect personal information from children under 13 (or the minimum age in your country). If you believe a child has sent us personal information, contact us and we'll delete it.

You can ask us what we hold about you, or ask us to correct or delete it. Email david@temps.sh or use the contact form. A person reads every message. For help using the app, see Temps Fleet support.

If Fleet's data handling changes, we'll update this page and its effective date before the change ships in a release.