Privacy, data flow & open-source licenses

ESP32 Agent lets you choose the model endpoint that operates your phone. This page summarizes the current project’s data flow and distinguishes the app from this documentation website.

Screenshots go to your selected model

The app sends screenshots and task text to the endpoint you configure. A cloud provider’s privacy and retention terms apply to those requests. A self-hosted server uses the policies and network controls you put in place.

The project’s privacy policy says its developer runs no application servers for this flow and receives no app data. This does not mean that screenshots remain on the phone when a remote model is used.

Data stored on your iPhone

Runs, model replies, screenshots, screen history, debug logs, and iOS crash reports are stored in the app’s storage. API keys are kept in the iOS Keychain and, according to the project policy, are not written to logs or exports.

You can delete runs in the app. Deleting the app removes its local app data. See Apple’s guidance on Keychain data for the platform’s credential-storage behavior; do not treat deleting an app as a guarantee that every Keychain item is erased.

Raw traces can contain screenshots, typed text, task instructions, model replies, and annotations. Processed sharing exports reduce some exposure but cannot guarantee that all personal content is removed.

Inspect the archive before sharing it. See run exports for the difference between raw traces and the separate sharing flow.

App analytics and Apple diagnostics

The upstream app policy states that the app has no accounts, analytics, advertising, tracking, or third-party SDKs. Apple may separately provide diagnostics under its own policies, for example with TestFlight or optional diagnostic sharing.

This website

This website uses Umami at track.pixmiller.com to measure visits on the production domain. It collects page paths, referrers, and device and browser information without analytics cookies. URL query parameters and fragments are excluded, and the browser’s Do Not Track setting is respected. There are no advertising scripts or contact forms.

A manual language choice is saved in browser localStorage so automatic detection does not override it. The site remains usable if storage is blocked.

Fonts and project images are served with the site. YouTube and GitHub are ordinary outbound links; their services apply their own policies when you visit them. The hosting service may process ordinary access logs under its own policy.

Open-source licenses

Most project code is distributed under MIT. The AirPlay code derived from UxPlay in hardware/hid_bridge/src/airplay/ is GPL-3.0, and the firmware binary linking it is distributed under GPL-3.0. Refer to the actual license files before redistributing code or firmware.

Project images on this site come from the upstream repository and are attributed in this website’s asset notice. The ESP32 iPhone Agent project is independent of Apple and Espressif.

Source and questions

Consult the upstream privacy policy, MIT license, and AirPlay license. Follow the repository’s security policy for private security reports.