# Privacy policy

Controller: fifteenA, Inc., 251 Little Falls Drive, Wilmington, DE 19808, USA, [hello@mobilebox.dev](mailto:hello@mobilebox.dev). The website serves its own static assets and sets no analytics, advertising or tracking cookies. Sign-in uses the necessary cookies described below. The home, pricing, docs and journal pages load cookieless PostHog analytics through our own domain, described below. The sign-in, account, legal and error pages don't load it.

## What we process, and why

| Data | Why | Kept |
| --- | --- | --- |
| Project ownership; your email address and sign-in identity: your GitHub or Google account, or, with email-code sign-in, the address itself. Mobilebox has no passwords. | your account and log-in (contract) | Until you close the account; deleted within 30 days after |
| With email-code sign-in: the address you type, to send it a 6-digit sign-in code. The code works once, for ten minutes, and our server keeps only a hash of it, in memory. To stop abuse it also counts, for one hour, how many codes each address and each network asked for. We send the same email whether or not the address already has an account, except when an agent has just started a workspace for it: then the email says so, and without the code that workspace closes after seven days and its phones are deleted. | your log-in (contract); preventing abuse (legitimate interest) | Codes: ten minutes. Counts: one hour. Neither is written to disk. |
| With GitHub sign-in, your public GitHub profile as GitHub shows it to anyone: username, display name, company, location, website, account creation date, and the numbers of public repositories and followers. It is refreshed each time you sign in with GitHub. Your company, the country we read from your location, and the year your GitHub account was created also go to PostHog as properties of your pseudonymous project; your username and name don't. | knowing who uses Mobilebox and which companies and countries it reaches, to decide what to build and whom to ask for feedback (legitimate interest) | Until you close the account; deleted within 30 days after |
| Your answers to two optional questions on your first visit to the console, after sign-up: what you want from us (such as real iPhones or Android sandboxes) and where you heard about us, with the line you type for “Something else” or “Other”, or that you skipped them. They are kept with the campaign parameters, referring site and landing page your sign-in link carried. Only the options you picked go to PostHog; the text you type stays on our server. | knowing which channels, AI assistants included, bring people to Mobilebox (legitimate interest) | Until you close the account; deleted within 30 days after |
| The optional task your agent gives when it creates a phone: one line in its own words on what it is trying to do. Stored with that phone, read only by the Mobilebox team, never shown publicly or sent to PostHog. | understanding what agents use Mobilebox for, to decide what to build (legitimate interest) | Until you close the account; deleted within 30 days after |
| What your agent tells us it needed and we don't offer yet (the MCP tool request_capability): one line on what, optionally one on why, the calling tool's name (such as claude-code) and your workspace, so we can answer. Read only by the Mobilebox team, never shown publicly or sent to PostHog. | answering the request and deciding what to build (legitimate interest) | Until you close the account; deleted within 30 days after |
| Counts of MCP tools, tool arguments and API addresses that were called but don't exist (for example a tool named record_video), per hour and per calling tool's name (such as claude-code or curl). No workspace, address, values or request content: only the names and how often. | learning what agents expect Mobilebox to do, to decide what to build (legitimate interest) | Kept as anonymous counts |
| Dashboard-issued API-key hashes, names, display hints and creation times. Team-issued beta credentials are held in owner-only server configuration. | authenticating API and MCP calls (contract) | Active until revoked; backup copies roll off within 14 days |
| Apps you connect over MCP sign-in (such as Claude or ChatGPT): the name and return addresses the app registered itself with, the workspace you allowed, when you connected it and when it last called, and hashes of its access and refresh tokens. The tokens themselves are never stored or logged. | authenticating MCP calls from apps you allowed (contract) | Access tokens expire after an hour, refresh tokens after 30 days unused; revoking an app in the dashboard deletes them at once. Apps that never finish connecting are deleted after a day. Backup copies roll off within 14 days. |
| Balance, sessions, billed seconds | billing and your usage overview (contract, tax law) | As long as tax law requires, up to 10 years |
| Sandbox storage: installed apps, saved app data and logins | running the phone you asked for (contract) | until you delete the phone; parked phones keep their data |
| Screen observations and screenshots returned to API/MCP callers | reading and controlling the phone (contract) | Generated for the response, not automatically stored by the service. Saved recordings and caller-created artifacts have separate retention. |
| Operational diagnostics: startup, recovery and error summaries. Authentication handlers do not log credentials. | security and fixing faults (legitimate interest) | 30 days |
| Website analytics on the home, pricing, docs and journal pages: page views and page leaves, and five kinds of click: which button you used (cta_clicked), which code example you copied (code_copied), which question you opened (faq_opened), which device or plan button you clicked (fake_door_clicked), which phone you looked at in the home page preview (device_tab_viewed) and whether you played the recorded run (replay_played). Each event carries the page address with its campaign parameters (such as utm_source, or via, which names the document of ours the link was in, such as llms.txt or the README), the referring site, which AI assistant sent the visit if one did (ChatGPT, Claude, Perplexity, Gemini or Copilot, read from those two), and your browser, operating system, device type and screen size. It is cookieless: no cookies and no local or session storage. Unless a visit looks automated, it also records the page as you see it (session replay: scrolling, clicks and what is shown, with every input field masked and no console or network data), one recording per page view, kept for 30 days. The requests go through our server to PostHog, which tells visits apart by a hash of your IP address and user agent with a salt that changes daily, so one day's visit can't be linked to the next, and discards the address without storing it. Our server also looks the address up in an offline table of network owners (such as an internet provider, a cloud, a university or a company) and attaches only that owner's name, kind and registered country to the page's events, together with whether the visit looks automated (for example, it comes from a data center); the lookup itself neither stores nor logs the address. Ad blockers may block it. owner: confirm session replay under legitimate interest | counting visits, the sites and campaigns that refer them, and which pages lead to sign-ups, to decide what to write and fix (legitimate interest) | Up to one year in PostHog, then deleted. owner: confirm the project's retention setting |
| Web server access log for every request to mobilebox.dev: time, address with its last part removed (for example 203.0.113.0), page, status, and the request headers your browser or tool sends, such as its user agent, referring site, accepted formats and browser hints (Sec-Ch-Ua, Sec-Fetch-*). We use them to tell people’s browsers from AI agents and tools. Sign-in codes, cookies and API keys are not logged. | keeping the service secure and seeing which search engines, AI crawlers and other bots read the site (legitimate interest) | 30 days, then deleted |
| Product usage events for accounts, sent from our server to PostHog: sign-up (signup_completed, with the sign-in provider and, if the sign-in link carried them, the campaign parameters, referring site and landing page), your answers to the two questions after sign-up (the options you picked, or that you skipped; never text you typed), beta-key sign-in, API key created or revoked, an app connected or revoked over MCP sign-in (with the name the app gives itself), phone created (with transport, country and locale), ready (boot time), failed to boot, parked, resumed and deleted, app installed (upload or link), each phone action (phone_action: observe, act, screenshot, install and so on, over REST or MCP, flagged the first time), MCP client name and version and whether it signed in or used a key, billed sessions (seconds and amount) and API errors (error code and route). They are keyed by your pseudonymous project ID and contain no email address, API key, IP address, app package name or screen content. | seeing how accounts get started and where they get stuck, to fix onboarding and errors (legitimate interest) | Up to one year in PostHog, then deleted |
| Necessary sign-in cookies and server-side session hashes | keeping you logged in (strictly necessary) | Session access expires after seven days; logout revokes it. Temporary provider sign-in flows and email codes expire after ten minutes. Expired records are deleted within 30 days; backup copies roll off within 14 days. |

Treat a phone like any computer you rent: don't put data on it that you aren't allowed to process there. We don't look into phones except to fix a fault you report or when the law requires it.

## Where it runs, and who helps

- **Hetzner Online GmbH**: the existing server hosts the website, API, phones and local SQLite account, key, session and billing records. Servers in Nuremberg, Germany. owner: conclude Hetzner data processing agreement

- **GitHub or Google, when enabled**: handles provider sign-in and returns verified identity information. Mobilebox does not receive your provider password, and does not store provider access tokens.

- **Resend (Plus Five Five, Inc.), when email sign-in is enabled**: sends the sign-in code email, as our processor. It receives your email address and the message with the code, and keeps delivery logs under its own retention. Its servers are in the USA; transfers rely on the standard contractual clauses in its data processing agreement. owner: accept Resend's data processing agreement

- **PostHog Inc.**: processes the website analytics and product usage events described above, as our processor. Our project is hosted in PostHog Cloud EU, in Frankfurt, Germany. PostHog's data processing agreement is part of its terms; any access from outside the EU relies on the standard contractual clauses in that agreement.

- **Let's Encrypt**: issues the site's TLS certificate.

Phones reach the internet from our server, or through the proxy you set. The apps you install talk to their own servers under their own privacy policies.

## Your rights

You can ask for a copy of your data, its correction or deletion, restriction, portability, and object to processing based on legitimate interest: email [hello@mobilebox.dev](mailto:hello@mobilebox.dev). You may also complain to a data protection authority, in the country where you live or work.

Last updated: 6 November 2026