Privacy policy

Last updated: 3 October 2026

Agentrific is provided by Devular Ltd. This policy covers our website, mobile app and hosted subscription and notification services. For privacy questions or requests, email jon@devular.com.

Devular Ltd is the data controller for personal information we process to operate these services. Your self-hosted server and independently selected providers have their own responsibilities for the information they handle.

The short version

Your Agentrific server runs on a machine you control. Project files, task conversations and agent execution are handled there, and your selected model providers receive the information needed to run your agents. Devular does not operate that server for you.

That does not mean every part of Agentrific is local. The mobile app sends diagnostics to Sentry. Optional paid background notifications use our Cloudflare-hosted relay, RevenueCat, Expo and your device platform’s push service. Visiting the website also exposes normal connection information to its hosting providers.

Your server, projects and model providers

The app connects to your paired server to display projects, tasks, messages and attachments and to send your instructions. Your server stores its own configuration, device authorizations, conversations and working files. Credentials for your selected model providers are held on your server, not in our hosted push relay.

Running an agent can send prompts, code, attachments and other context to the model provider you select. GitHub and any tunnel or network providers you use may also handle information under their own terms. You control those accounts and the permissions you give your server. A tunnel provider can handle connection metadata and, depending on its configuration, terminate HTTPS traffic.

If someone else operates your server, they control its data and access policies. Ask that operator about retention and deletion. This policy does not replace your model provider’s or server operator’s privacy notice.

Mobile diagnostics and feedback

The mobile app uses Sentry for error reporting, diagnostic logs, session replay and feedback. Reports can include device and operating-system information, app version, IP address, error details, navigation and interaction information, and diagnostic context. Feedback you submit can include the information you choose to provide.

The current app configuration enables default personally identifying diagnostic context and samples session replay, with additional replay capture when errors occur. Replay can include representations of app screens and interactions; SDK masking is not a guarantee that all sensitive material is excluded. Diagnostic reports may therefore contain personal information or information visible while you use the app. These reports are separate from the minimal data used by the push relay.

We use diagnostics to investigate failures and improve reliability. Do not submit passwords, API keys or other secrets in feedback. Contact us if you believe a report contains information that should be removed.

Optional subscriptions and background notifications

When you set up paid background notifications, our hosted service creates a random installation identifier and an authentication credential. The mobile app stores its credential in the device’s secure storage. RevenueCat uses the installation identifier to associate store purchases and subscription status; an email account with Agentrific is not required for this flow.

The hosted relay processes:

• The installation identifier and a hash of its authentication credential.
• Your Expo push token and notification preferences.
• Paired server identifiers and public signing keys, enrollment grants and binding records.
• Event and session identifiers, event category, timestamps, delivery attempts and push delivery receipts.
• Subscription eligibility and billing events needed to verify access, including relevant purchase identifiers and transfer aliases supplied by RevenueCat.

The relay does not need your repository contents, task prompts, conversation text, attachments or model-provider credentials. Notification text is generic; notification data identifies the relevant server, session and event. This still reveals activity metadata, such as when a task finishes or needs input.

Cloudflare hosts the relay and its stored records. RevenueCat processes purchase and subscription information and checks store entitlements. Apple or Google handles your store account and payment; we do not receive your full payment-card details. Expo, and Apple Push Notification service or Firebase Cloud Messaging, process notification tokens, notification content and delivery metadata. Push delivery uses these providers and is not end-to-end encrypted between your server and your phone.

Subscription and notification features are available only where offered and configured. Notification permission is controlled by your device. Disabling notifications or revoking a server binding is separate from cancelling a store subscription; see our subscription terms.

Website storage and connection data

The marketing website is hosted through GitHub Pages, with DNS managed through Cloudflare. Hosting and network providers can process IP addresses, requested URLs, timestamps and browser information for delivery and security.

The website saves your selected light or dark theme in browser local storage. The current marketing site does not include advertising trackers or a third-party analytics script. External links take you to services with their own privacy practices. The mobile diagnostics described above are not website analytics.

Why we process information

We process subscription and delivery information to provide the optional service you request and fulfill our contract with you. We process support and necessary security information for our legitimate interests in supporting users, preventing abuse and keeping services reliable. Legal obligations may require us to retain certain records. Where consent is required for a particular activity, that activity must be covered by the applicable consent requirements; this notice itself is not consent.

We do not sell your personal information or use your project content for advertising. We share information with the providers described above to operate these features, and may disclose information where legally required or necessary to investigate abuse or protect legal rights.

Retention and deletion

You manage retention of files and conversations on your own server. Removing the app does not delete those server records, cancel your subscription or necessarily remove hosted installation and purchase records.

The notification relay expires short-lived grants and event-deduplication records and removes completed or expired delivery jobs. Disabling remote notifications clears the registered destination and bindings, but does not erase every installation or billing record. There is currently no automatic full-installation deletion control in the app. Contact us to request deletion of hosted data; do not send your installation credential or other secrets by email.

We retain hosted, support and diagnostic information for service operation, troubleshooting, security and applicable legal obligations. Provider retention and backups may affect when copies are removed. We do not promise a fixed deletion period that the service does not implement. Store transaction records remain subject to the relevant store’s policies.

International processing and your rights

Our providers may process information outside the UK, including in the United States. Their contractual arrangements and applicable data-protection requirements govern those transfers. Contact us for information about the arrangements applicable to your data.

Depending on your location and the applicable law, you may request access, correction, erasure, restriction or portability of your personal information, object to processing based on legitimate interests, or withdraw consent where processing relies on it. Some rights have exceptions. We may need proportionate information to verify a request and identify the relevant installation, without asking for its authentication secret.

Email jon@devular.com to exercise these rights. You can also complain to the UK Information Commissioner’s Office or your local data-protection authority.

Children and changes

Agentrific is intended for adults and is not directed at children. Contact us if you believe a child has provided personal information to our hosted services.

We may update this policy as the product or its providers change. We will update the date above and provide additional notice of material changes where required.