# Privacy Policy Source: https://phonebox.dev/docs/privacy > What Phonebox collects, why, and how long we keep it. These documents take effect when Phonebox launches. They are reviewed by the owner before publication. Phonebox is operated by Steelworks Software LLC, a limited liability company registered in Delaware, United States. This policy explains what we collect when you use the Phonebox website, console and API, why we collect it, and how long we keep it. ## What we collect [#what-we-collect] * Account details: the email address you sign in with, your name and profile picture when provided, and the projects and API keys you create. We store API keys only in hashed form. * Billing records: your credit purchases, balance, usage charges and spending limit. Our payment provider collects your card details, and we never receive full card numbers. * API activity: for each request, its request ID and time, the project, phone and key involved, the kind of call and its parameters, its result and how long it took. The parameters include what your agent tapped (an element's text, description or ID, or a point on the screen), the apps it opened, file paths, a phone's name and requested country, and settings such as its location, language and time zone. In the activity records shown in the console, text your agent types or puts on the clipboard is removed, and a web address it opens keeps only its scheme and host. These activity records never include file contents, screenshots or metadata values. * Private request diagnostics: to investigate failures, we retain exact authenticated API and MCP request inputs and console and live phone-operation inputs, including typed text, clipboard text, target selectors, URLs, query parameters and malformed request bodies. Binary request inputs are also captured within the size limit. We keep up to 256,000 bytes of each body and mark incomplete captures. We also retain phone-service failure responses, up to 64,000 characters, with their status and trace identifier. For failed action batches, we also retain the results, the accessibility screen tree and compact elements used by the target resolver, and the returned observation without screenshot pixels, up to 256,000 bytes with incomplete captures marked. These records are available only to authorized operators, are not sent to product analytics, and are not exposed through customer APIs or activity views. We do not duplicate authentication headers, cookies or live-link path credentials. * Screen reads: when your agent reads a phone's screen, we keep the list of elements for 15 minutes so the agent can refer to them. * Messages you send us: what you enter in the contact form (your name, email address, company and message), and the email address you give us for the changelog by email. * Product analytics: the pages you visit, clicks, errors, performance measurements and product events, plus session recordings with every form input masked. They are sent through our own `/ingest` proxy on the Phonebox domain, and web addresses are recorded without their query strings. Anonymous visits use a random browser profile. When you sign in, that browsing history is linked to your account. Analytics never include what your agent types, file names or contents, phone screenshots, the text on a phone's screen or metadata values. ## Sign in with Google [#sign-in-with-google] If you choose to sign in with Google, our authentication provider, Clerk, receives your Google account identifier, verified email address, name and profile picture. Clerk stores this information with your account to create your account, authenticate you and display your profile. We request only basic identity scopes, not access to Gmail, Drive, Calendar or Contacts. We do not sell Google profile data, use it for advertising or use it to train AI models. The account retention and deletion choices below also apply to this information. ## The contents of your phones [#the-contents-of-your-phones] Your phones hold the apps, files and signed-in accounts your agents put on them. We process that content only to run your phones and operate Phonebox. ## Why we use it [#why-we-use-it] We use this information to run your phones and your account, bill usage correctly, keep Phonebox secure, prevent abuse, answer your messages, send the changelog you signed up for, and understand how Phonebox is used so we can improve it. We don't sell personal information, and we don't use it for advertising. ## Service providers [#service-providers] We rely on service providers for cloud hosting and storage, the Android device infrastructure, payments, sign-in, product analytics and email. They process data only as needed to provide their service to us. Our database, which holds your account, billing and API activity records, runs in the European Union. You can't currently choose another region for it. A phone's contents, meaning its apps, files and signed-in accounts, are held where the phone runs. The country you can ask for when you create a phone is where it runs, and that choice doesn't change where our database keeps your records. ## How long we keep it [#how-long-we-keep-it] * Screen reads: 15 minutes. * API activity records: 30 days. * Private request diagnostics, failed-action screen evidence and phone-service failure responses: 90 days. * Phones and their contents: a parked phone keeps its apps, files and signed-in accounts. If we ever need to limit how long parked phones are kept, we will give you notice first. * Account, billing and support records: while your account is open, and afterwards for as long as we need them to resolve disputes, keep Phonebox secure and meet legal obligations. * Contact messages and changelog sign-ups: until you ask us to remove them. Our providers' backup policies also apply, so deleted data can take some time to disappear from every backup. ## Your choices and rights [#your-choices-and-rights] To access, correct or delete your information, close your account, or ask how we process data, email [team@phonebox.dev](mailto:team@phonebox.dev). We check that a request comes from the account owner before we share or change any records. Depending on where you live, you may have additional rights under privacy law. When we handle a deletion request, we will tell you about any records we have to keep. Cookies are described in our [Cookie Policy](/cookies). Material changes to this policy will be published on this page with an updated date.