What it sends home.

The short version

• Release builds send usage stats by default. A notice on first launch says so, and nothing is sent until you answer it.
• Settings → Privacy has one switch that turns it off. Off means nothing more is sent, and whatever was waiting to be sent is thrown away.
• Delete my data erases what the server holds for your phone, then turns sharing off.
• Development builds send nothing.
• Nothing is sold or shared, and none of it goes into the public code repository.

What the app sends

• Your phone, roughly: maker and model, Android version, processor type, memory in whole gigabytes, language setting, and which app installed PhoneCanDo (a browser, a file manager, its own updater).
• The app: version and build (full, lite or play).
• Usage: named events such as "update offered", "terminal opened", "setup step 2 done", "phone control unlocked", and which phone-control features were used and how often. Update events add the version and the step they reached. Never what you typed or what came back.
• Health: how long the engine took to start, how often it started, failed to start or stopped unexpectedly, and the exit code of such a stop. Its log is never sent automatically, because it can contain text from your chats; it goes only into a report you choose to send. Also low-memory warnings, and whether battery optimisation, the background service and the accessibility service are on.
• Errors and crashes: the error type, a short message and the top few lines of the stack trace, with folder paths on your phone blanked out.
• Where, coarsely: the server notes the country and the network operator from the connection. It does not store your IP address. To stop abuse, Cloudflare's rate limiter counts requests per IP address for one minute; that count is never logged or stored with your data.

So we can count the same phone over time, each send carries IDs. None of them is your name, number or account, and the hardware ones are scrambled (hashed) on the phone before they leave it:

• Install ID: random, made on first launch. New after a reinstall, after Reset anonymous ID, or after Delete my data.
• Device ID: a hash of Android's ID for this app on this phone. It stays the same across reinstalls and changes after a factory reset.
• Device key: a second, different hash of the same ID, which only your phone can compute. The server uses it to make sure only your phone can add to or delete your phone's data.
• Hardware hash: a hash of the phone's model and system build details. It groups phones of the same model and build; identical phones on the same build share it, and it changes with a system update.
• An ID from the phone's DRM system is in the code but switched off, so it is never sent.

What it never sends

Prompts, chats and model replies. Files, folder paths and anything in the terminal. Environment variables and API keys. Screenshots or anything on the screen. Which apps the agent opened or used. Contacts, messages and notifications. Your IP address, precise location, advertising ID, name, email or phone number. Android's raw device ID.

Your controls

All in the app, under Settings → Privacy:

• The switch: off stops all sending at once. Turn it back on any time.
• Delete my data: deletes every row the server holds for your phone (device, every install, app runs, events, errors, reports), even from before a reinstall or an ID reset, then turns sharing off and makes a new install ID. If nothing was stored, the app says so. Only the 7-day database backups still hold the deleted rows until they expire; there is no other copy.
• Reset anonymous ID: starts over with a new install ID and throws away anything not yet sent. Past data from this phone stays linked to it; use Delete my data to remove it.
• Send report: only when you tap it. Sends your note, the last 50 usage events and the last 2 KB of the engine's log from its last crash, with folder paths, passwords and keys blanked out.

This website

No cookies, no third-party scripts, nothing stored in your browser. Each page load sends one count to our own server: the page's path, the site you came from (its name only), your country and the kind of browser (phone, computer or bot). It is skipped when your browser asks not to be tracked (Do Not Track or Global Privacy Control).

Page views and downloads are also added up per day, page (or download channel) and country, and those totals are kept for good. They say how many, never who.

The download buttons and the QR code pass through our server, which counts the download (channel, version, country, Android version) and sends you on to the file on GitHub. GitHub counts it too. The computer commands download from GitHub directly.

Where it is kept, and for how long

On Cloudflare, which runs this website and its server and stores the data on our behalf (a database and an analytics store). There is no archive: once its time below is up, data is deleted.

Usage events

90 days, then deleted

Errors and crashes

180 days, then deleted

Reports you send

90 days, then deleted

Device, install and app-run rows

until you tap Delete my data

Site page views and downloads in detail

about 3 months

Daily site totals

kept for good: counts per page or download channel and country, nothing about you

Database backups

7 days, so deleted rows are fully gone after that

The server's own request logs

3 days, for debugging

Everything else the app connects to

• GitHub, to check for updates when the app starts (full and lite), and to download an update when you tap install.
• opencode's model catalog (models.opencode.ai), which the engine downloads when it starts and every 5 minutes while it runs, so it knows which models exist.
• The model providers you set up, straight from your phone with your key. Our server is never in between.
• Whatever you or the agent start: a web search, a download in the terminal.

Every field, and questions

The full list of fields, limits and network calls is the published schema, next to the code that sends it. Questions or a problem: open an issue on GitHub.