Privacy
Your choices control agent access.
Managed release policy, 17 October 2026
Accounts and hosted data
AgentCall supports Apple, Google and passwordless email sign-in. Hosted agents retain their configuration, persona, conversation text, useful tool results, authorized semantic context, correctable memory, tasks, goals, progress and approval outcomes for continuity. Each resource is scoped to its account and agent. Reusing a persona does not share another agent’s memory or authority.
Direct calls and providers
Direct agents and local BYOK remain available without a hosting subscription. Text, audio and explicitly authorized context go to the agent or provider you choose, under its terms. Native realtime audio travels directly between your iPhone and provider. Managed conversations retain useful grounding; raw continuous microphone and camera streams are not kept in the conversation journal.
Phone permissions and camera
Calendar, Reminders, selected Contacts fields, Health, location, mobility, Focus, camera, NFC and other supported phone context require explicit per-agent grants and applicable iOS authorization. Authorized camera observations may be sent to a compatible native vision provider or managed vision helper. Local-light permission does not grant image-upload permission. People Memory templates and photos stay encrypted on your iPhone; confirmed labels can be shared with the selected allowed agent.
Credentials and approvals
Phone credentials stay in iOS Keychain. Uploading a saved phone key to hosting requires separate consent. Hosted keys are encrypted server-side and excluded from persona, configuration exports and diagnostics. Access to information never grants authority to contact someone, purchase, delete or otherwise act. Protected actions require review of the exact action and a one-use biometric approval.
Billing and service records
We retain account/session identifiers, sign-in identity information, StoreKit transaction ownership, hosting entitlements, immutable credit and rate records, and usage needed to operate and reconcile the service. Usage estimates are identified as estimates and are not provider invoices. Sign-in uses Google’s supported identity SDK and Apple platform services.
Your controls
You can revoke sessions and credentials, correct per-agent memory, pause or cancel background work, export account data and delete your hosted account in AgentCall Account. Subscription lapse pauses hosted execution while preserving read/export access, data and unused credits. Signing out never erases your unrelated direct agents. Private configuration synchronization uses your private iCloud account; managed server configuration remains authoritative for hosted agents.
Google identity sign-in
The App Store target uses GoogleSignIn only to prove your chosen Google identity to your AgentCall account. This does not grant Gmail or other Google Workspace access. The SDK can retain its identity sign-in state; AgentCall rotating session tokens stay in the iOS Keychain. Linking requires a fresh proof of the second identity.
Private Labs Google Workspace connection
Native Gmail tools remain in the private Labs build under their separate canary and public verification gate. They are distinct from managed Google identity sign-in. The public customer permissions above still use explicit per-agent grants.
Your connected account
You choose the account and requested scopes. The local OAuth route keeps its refresh token in iOS Keychain. A separately configured hub-stored connection holds its credential at the authenticated hub instead of copying it to the phone.
Requested Gmail features
Google user data can include your account identifier, email address and the mailbox content required by the feature you invoke. The pilot requests read-only Gmail access and Gmail compose access for thread search, thread read and creating requested drafts. Expanded private canary operations use their separately reviewed scopes, tools and approval policy; a data connection alone never authorizes sending or another external action.
Provider and request gateway
For the local OAuth pilot route, your selected realtime provider receives a short-lived Google access token and relevant tool results. That pilot request gateway processes the supplied token but stores no Google credential. This statement does not describe the phone Keychain, GoogleSignIn SDK state, AgentCall account sessions, or a separately configured hub-stored connection. Provider retention and account controls apply to results it receives.
Google use and control
Google user data is used to provide the feature you invoke. It is not sold, used for advertising or creditworthiness, or used to train a general machine-learning model. AgentCall’s use of information received from Google Workspace APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
In the private Labs agent’s Tools screen, disconnect the account to remove its connection and local credential state. The local OAuth route attempts Google token revocation, then removes local state even if network revocation fails. A hub-stored connection uses the authenticated hub’s explicit disconnect/revocation flow. You can also revoke access in your Google Account and delete provider-held conversations through that provider’s controls.
Contact
AgentCall includes no advertising or cross-app tracking. For support or data questions, contact agentcall@smartycode.com. Provider and tool services apply their own policies to the data you authorize them to receive.