Agent Center — Privacy Policy

Source of truth for the public privacy policy. The published page is rendered from this file;

edit here, then republish. Facts below are grounded in the ADR-072 off-mesh threat review

(ai-workspace/architecture domains/security/audits/ADR-072-off-mesh-apns-threat-review-2026-09-01.md).

Last updated: 2026-09-02 · Published at https://agent-center.x-apps.t3k.dev/

Agent Center is an operator tool for reviewing and deciding approval requests raised by automated agents. It is distributed only through TestFlight to invited testers. It is not a consumer product.

What the app does not do

• It does not collect analytics, usage metrics, advertising identifiers, or crash telemetry of its own.
• It contains no third-party analytics or advertising SDKs.
• It does not track you across apps or websites.
• It never sends the content of an approval request, your name, or your email through Apple's push service. A push notification carries only a fixed title ("Approval requested"), an opaque reference, and a link back to the authenticated review page.

What the app processes, and why

Sign-in identity. You sign in through the operator's identity provider (Zitadel) inside the app. The app keeps that authenticated web session on your device so you do not have to sign in for every approval. The identity provider's immutable subject identifier, and the display identity it shows, are used only to decide which approvals you are allowed to see and to record who made a decision.

Push notification device token. When you enable notifications, Apple issues the app a device token. The app sends that token, bound to your signed-in identity, to the operator's hub so that approval summons can reach your device. The app itself keeps only a short fingerprint of the token for diagnostics, never the token. On the hub the token is stored with your identity, used only to address notifications to you, and never returned to any client. When you revoke notifications or sign out on a device, the registration is revoked and the record is deleted 30 days after revocation.

Approval content. Approval requests and your decisions are stored by the operator's hub, which you reach only after signing in. Decisions are attributed to your identity for audit purposes.

Where data goes

• The operator's hub (hub.platform-1.t3k.dev), over HTTPS only, behind the identity provider.
• Apple, only what is needed to deliver a push notification (device token and the minimal notification payload described above), and the TestFlight beta program data Apple collects under its own terms (install, session, and crash reports you choose to send through TestFlight).

No other party receives data from the app.

Retention and deletion

• Revoked push registrations are deleted 30 days after revocation.
• Approval records are retained by the operator as audit evidence of decisions.
• To remove your device registration, disable notifications for Agent Center or sign out on that device. To ask about your identity record, contact the operator (below).

Security

Approval content is never exposed outside an authenticated session. The push payload is validated against a closed schema before it is sent, so nothing beyond the fixed title, the opaque reference, and the link can transit Apple. Server-side network policy restricts which services may read registrations.

Contact

Operator contact for privacy questions: othomas@t3k.dev

Changes

Material changes to this policy are recorded in the revision history of this file.