JunoFleet Privacy Policy

Effective date: November 1, 2026

The short version

• JunoFleet lets you control coding agents on your own computer from your phone or desktop through our relay server.
• The content of your sessions (prompts, replies, commands, approvals, files and agent-to-agent messages) is encrypted on your own devices with keys we never have before it reaches our relay. We cannot decrypt it. The relay does see and keep some information about your sessions, such as identifiers, timing and agent names; section 2 lists it.
• What we do hold is account and device information: your Google or Apple account identifier and email address, your devices' public keys, your passkey's credential identifier and public key, push tokens, the names you give your agents, and delivery records for notifications and agent messages.
• Our servers are in Amazon Web Services' Seoul region (Korea). On the website, payments in Korea are handled by Toss Payments (토스페이먼츠) for us, and payments elsewhere by Polar, which resells JunoFleet as the seller; in the app, by Apple or Google. Push notifications are delivered by Apple and Google.
• We do not sell personal data, we do not run advertising, and the apps contain no analytics or tracking SDK.
• You can delete your account in the app and on the website. Some records remain for the limited purposes and periods in section 3.

The rest of this policy gives the details that the Korean Personal Information Protection Act (개인정보 보호법) and the app stores require.

1. Who is responsible

JunoFleet (주노플릿) (SEONGMIN KIM), 2F 125, 75 Neungdong-ro 13-gil, Gwangjin-gu, Seoul, 05015, Republic of Korea, business registration 155-12-03275, is the controller of the personal data described here ("we").

Privacy officer (개인정보 보호책임자): SEONGMIN KIM (representative). Contact: contact@junofleet.com, +82 10-3049-1189.

This policy covers the JunoFleet relay service, the JunoFleet apps (iPhone, iPad, Android, macOS, Windows), the host software that runs on your computer, and the junofleet.com website. It does not cover the AI providers (Anthropic, OpenAI and others) whose agents you run; their own terms and privacy policies apply to what you send them.

2. What we collect, why, and on what basis

Korean law lets us process data that is needed to provide the service you signed up for without asking for a separate consent (개인정보 보호법 Art. 15(1)4). We ask for consent only where the law requires it, and we mark those items.

2.1 Account

We have no password for you: JunoFleet never asks for, stores or resets a password, and you recover access through Google or Apple. From Google we receive only your email and whether Google has verified it; we do not receive your Google name, profile photo or contacts. We use Google Sign-In data only as described here, in line with the Google API Services User Data Policy, including its Limited Use requirements. From Apple (Sign in with Apple) we receive an account identifier and the email address you choose to share, which can be an Apple relay address that forwards to you; we do not request your name.

2.2 Devices and hosts

These are public-key material and signatures, not biometric data. We do not store device names, hostnames, your passkey's private key, biometric data, or anything about how your phone unlocked. Your phone's screen lock (fingerprint, face or PIN) is checked by your phone, not by us.

2.3 Sessions, messages and notifications

Prompts, agent replies, commands, file paths, tool approvals and their answers, attachments and the text of agent-to-agent messages are encrypted end to end under keys that exist only on your devices and your host. The relay forwards them and cannot open them. Attachments pass through the relay to your host and are not stored by us. Tool-approval decisions are recorded, encrypted, on your own computer; we hold no copy.

2.4 Push notifications

Push notifications are delivered through Apple (APNs) or Google (FCM). The detailed title, text, agent name and similar contents of an ordinary session notification are encrypted so that only your app can open them; Apple and Google cannot read that encrypted body. The broad category (ordinary notification, security alert or transfer notice) and delivery information are visible to the relevant push provider. Ordinary notifications include notification, computer and session identifiers, the encryption-key version, a server-assigned sequence number and a follow-up flag. Transfer notices include their kind, allowance-pool category, threshold (80 % or 100 %), included allowance and next reset time in plain form. The provider also processes the receiving device's push token, app-identifying information, delivery priority and an identifier used to group repeated notifications. Apple additionally receives a fixed display title ("JunoFleet" or "Security alert"), interruption level, sound and display-processing settings. Google receives notification data and delivery priority; the app builds the displayed notification.

2.5 Billing

We do not receive your card number from Apple or Google, and we never see your full card number. From Toss Payments we receive payment and order identifiers, payment status and time, amounts and tax breakdowns, the card-company code, a partially masked card number and receipt information. In our payment records we keep only the masked suffix after removing its leading digits. For purchases through Polar, Polar is the seller; to apply the subscription to your account we receive and keep the subscription status, the end of the current period, whether it is set to cancel at period end, and the account link identifier.

2.6 Website and support

2.7 Technical records on the relay

Security records. They contain no session content, prompts, commands or file paths.

Sign-in and connection log: for each attempt to sign a device or computer in to the relay, and for each relay connection it opens and closes, we record the outcome (accepted, or refused with the reason code), the device identifier, the client address as the relay saw it, the client software version, and the time. A refused attempt whose signature could not be checked is marked as unverified, because its account and device identifiers are then only what the request claimed. The log never contains the signed request, a credential, a token or any content.

2.8 Optional items that need your consent

2.9 Features you may enable that send data to a third party yourself

If you turn on the optional risk-scoring guard for agent messages and enter your own TypeSafe AI (Jev) API key, your host sends the text of incoming agent messages to TypeSafe AI for scoring. That transfer happens from your computer under your own account with that provider, not through us. The app tells you this before you enable it.

Likewise, what your agents send to Anthropic, OpenAI or another AI provider is governed by your contract with that provider. We never see or relay your provider credentials.

2.10 What we never collect

Resident registration numbers, phone-number identity verification, precise or approximate location, contacts, photos (other than attachments you send through the encrypted channel), advertising identifiers, biometric data, analytics or usage tracking.

3. How long we keep data

If an account has not been used and has had no paid or free period for 12 months, counted from the later of the last use and the end of the last paid or free period, we email you when those 12 months have passed and delete it, as if you had deleted it yourself, 30 days after that email unless you sign in before then. An account inside a paid period is never deleted this way.

Data kept under a legal duty after you leave is stored separately from active account data and used only for that duty.

How we destroy data

When a retention period ends or the purpose is achieved, we destroy the data without delay. Electronic files are deleted so that they cannot be recovered, and automated database backups expire on a 7-day cycle; a final snapshot of the production database, if kept, follows the period in the table above.

4. Who else receives your data

The companies below receive personal data so that we can run the service. Where a company acts only on our instructions, we entrust the work to it under a contract that requires security measures (개인정보 보호법 Art. 26). Some may act partly on their own account (for example Google for its own sign-in, or a payment processor for its own legal duties); their role for each flow is a processor acting for us as listed in the table above, except that Google and Apple sign-in and the payment processors' own legal duties are their own responsibility. None of them receives your session content from us in a form it can read.

We will update this table before adding or changing a processor.

5. Transfers outside Korea

Our relay and database are in Korea. The companies above that are outside Korea receive the following, as needed to perform your contract with us (개인정보 보호법 Art. 28-8(1)3, disclosed here instead of separate consent):

We never send these companies your session content in a form they can read. Your session content does go, readable, to the AI provider your agent uses, and to any optional service you switch on (section 2.9); those flows run from your computer under your own contracts with them.

For users in the European Economic Area or the United Kingdom: JunoFleet is not offered in the European Economic Area or the United Kingdom.

6. Deleting your data

• You can request account deletion in the app or on the website. Ordinary account information is deleted within five business days after account deletion. Transaction records retained by law, and security/deletion records and backups with separate retention periods specified in section 3, are kept for those purposes and periods and then deleted.
• Remove a device: revoke it in the app. It can no longer connect or receive notifications at once. Removing a device is not the same as erasing its data: its public key stays in the signed device directory as a record that it was removed, and its push token stays stored until token deletion on removal is built.
• Local data (session history, settings, keys) lives on your own devices and computer; deleting your account does not touch it. Delete it with the app's uninstall instructions.
• Deletion is irreversible; we cannot recover an account or its device directory.
• Losing devices is different from deleting the account. Keep a second device enrolled, for example the JunoFleet app on your computer, with its own verification set up. If you lose a device, remove it from another of your devices and add a new one; removing a lost device stops its future access but cannot erase what is already stored on it. If you lose every enrolled device, JunoFleet cannot restore access in your existing setup, even if a computer with JunoFleet still runs; you would start again with a new setup, and files on that computer may still be there. Google or Apple can help you recover your sign-in, but our servers hold no secret that can stand in for your devices. You may delete your account with a deletion code as described in the next point.
• Deletion codes: when you set up two-factor verification, the app shows you eight deletion codes once. If you lose every device, signing in with the Google or Apple account that owns your account and entering one unused code asks us to delete your account. We alert your enrolled devices and your email, then wait 7 days, and any device still enrolled can cancel. We keep only a scrambled check for each code (section 2.1), which can be used only to delete your account. Without a device or a code you cannot delete your account yourself; you can still contact us about your rights, and an inactive account is handled as described in section 3. Deleting your account does not erase copies on lost computers, and it does not stop an Apple subscription (Terms 7.3).
• Before you sell, recycle or hand over a computer that ran JunoFleet, remove it from your account from another device and erase its storage, including any backups of it. Removing it stops new access; it does not erase what is already on its disk. JunoFleet cannot wipe a computer remotely.

7. Your rights

You can, at any time: see what we hold about you; correct it; delete it; ask us to pause processing; object to processing we do on the basis of our legitimate interests, where that basis applies to you; withdraw a consent you gave; and get a copy of your account data in a machine-readable form where the law gives you that right. In the app you can view your devices and delete your account. For everything else write to contact@junofleet.com; we answer within 10 days. If you are a child, your parent or legal representative can exercise these rights for you.

We make no decisions about you by automated means alone. Rate limiting by IP address and signature failures block connections automatically, but any action against an account is reviewed by a person.

If you are unhappy with our answer you can complain to the Personal Information Protection Commission (privacy.go.kr, 182 from Korea), the Korea Internet & Security Agency privacy centre (118), or, if you are in the EU or UK, to your local supervisory authority.

8. How we protect your data

• End-to-end encryption (AES-256-GCM) of session content, notification text and agent messages with keys created on your host and shared only with your own devices. The relay is designed never to hold a session key.
• Device and host keys kept in secure hardware (Secure Enclave, TPM, Android hardware keystore) where the device has one, with the app showing when a key is software-only.
• Two-factor verification with a passkey for adding devices, changing protections and starting control. Your computers check it themselves; for device-directory changes every device that applies the change checks it, and the relay checks it first.
• Each account's rows are isolated in the database by enforced row-level security; the database and backups are encrypted; operator access uses short-lived identity federation with no long-lived keys.
• If personal data is breached we notify affected users within 72 hours and report to the authorities as Korean law requires.
• A compromised computer running as the same user as your agents can change JunoFleet's own protections on that machine. Our protections are designed for threats from outside that machine; no security measure is complete.

9. Children

JunoFleet is not for children under 14. We do not knowingly process their data; if you believe a child under 14 has an account, tell us and we will delete it.

10. Requests from authorities

We disclose account or connection records only when a legally binding order under Korean law requires it (a court permission under the Protection of Communications Secrets Act or a warrant). We hold some session data only in encrypted form and never hold the keys, so we cannot provide decrypted session content; we may be required to provide the encrypted data and the metadata we hold. We tell you about a request unless the law forbids it.

11. Business (company) accounts

When your company pays for your seat, the company administrator can see administrative metadata about the company channel: who connected when, from which device, which devices are enrolled, and policy settings. The administrator cannot read your session content, enrol devices on your computer, or control your sessions; JunoFleet's design does not give administrators those powers. Your company is responsible for the data it holds about you as your employer.

12. Changes to this policy

We post changes here with a new effective date and keep earlier versions available. We notify you by email and in the app at least 7 days before a change takes effect, and at least 30 days before a change that reduces your rights or adds new uses of your data; where the law requires your agreement we ask for it.

Version history

• November 1, 2026: first version.