Privacy Policy

Introduction

MVPLean, Inc. ("MVPLean", "we", "our", or "us") publishes ZeroAgent, a free desktop application for macOS and Linux; the ZeroAgent companion app for iPhone; the relay that connects them, a Premium feature; and this website at zeroagenthq.com. This Privacy Policy explains what information each of these collects, how it is used, and what stays on your own computer.

The App Is Local, and Does Not Require an Account

ZeroAgent does not require an account to download or use. Your memory store, settings, transcripts, worktrees, and everything else the app creates are written to your own disk and stay there, unless you turn on the relay described below. MVPLean does not receive, store, or have access to any of it while the relay is off.

ZeroAgent does not send usage data to MVPLean today.

The Relay (a Premium Feature, Off by Default)

ZeroAgent also offers a relay: a hosted service that lets you watch and message your workers from somewhere else, including from the ZeroAgent companion app for iPhone. The relay is a Premium feature and stays off until you sign in and connect your account to it. While it is off, no worker state or transcripts are sent to our relay. Agents still send prompts and code to your model providers as described below. While it is on, the information described below leaves your Mac and reaches the relay for as long as it stays connected.

What the Relay Carries

While the relay is on, it carries:

• Worker events and transcripts published from your Mac: tool calls, tool output, assistant text, reports, repository names, branch names, and file paths.
• Messages you type to a worker from the phone.
• Your account id and GitHub login, carried on the token your Mac and phone use to connect.
• The phone's device name, sent once when you pair it.
• The phone's push token, so it can be notified.

Transcripts can contain anything your repositories contain. ZeroAgent redacts obvious secret-shaped values, tool input that looks like a token, password, API key, or similar credential, before publishing it, but this is a floor, not a guarantee: anything an agent prints into its own transcript can still contain something sensitive. The relay keeps events for a bounded window so a client that reconnects does not lose state: today, 24 hours or 3,000 events, whichever comes first, after which they are gone. It never receives your model provider key, and it never receives a copy of your repository, only the names, paths, and text described above.

Where the Relay Runs

The relay runs on Cloudflare Workers, with one Durable Object holding the connected events for your account, separate from every other account's. Push notifications to the phone go through Apple's APNs; the payload carries the title of the worker or task the notification is about, so it can say what happened.

No Analytics, Advertising, or Tracking on the Phone or the Relay

The ZeroAgent app for iPhone and the relay it connects to carry no analytics, advertising, or tracking of any kind. Unlike this website (see "This Website" below), neither collects nor shares any data about how you use them.

Turning the Relay Off

Sign out of your account in ZeroAgent on the Mac to turn the relay off; a signed-out or lapsed account disconnects right away. To remove a single phone without disconnecting the relay entirely, open the account panel in ZeroAgent on the Mac and revoke that device.

Model Provider Traffic

ZeroAgent drives coding agent command-line tools already installed on your computer, using your own model provider accounts and API keys. When an agent runs, your prompts, code, and related data are sent directly from your machine to the model provider you configured (for example, Anthropic, OpenAI or Google), under that provider's own privacy policy and terms. This traffic does not pass through MVPLean, and we do not see or store it.

Checking for Updates

ZeroAgent checks a release feed hosted by MVPLean on Amazon CloudFront (releases.zeroagenthq.com, or releases.zeroagent.mvplean.com for older versions of the app) to see whether a new version is available. Like any request to a content delivery network, this exposes your IP address and the app version you are running to that CDN. MVPLean does not use this to identify you individually; it is standard web server access logging, the same as visiting any website or downloading any file.

This Website

This website uses Google Analytics, currently sharing a measurement stream with mvplean.com, to understand overall site traffic, such as which pages are visited and in what volume. Google Analytics may collect your IP address and browser information in the course of doing so, under Google's own privacy policy. We do not use this to identify individual visitors.

Future Telemetry and Crash Reporting

MVPLean is considering opt-in, anonymous usage telemetry and crash reporting for a future version of ZeroAgent, to understand adoption and catch bugs. These features do not exist in the app today. If and when they ship, they will be off by default, require you to turn them on, and will be described here in specific detail, including exactly what is collected, before they are enabled for anyone.

Data Sharing and Disclosure

We do not sell, trade, or rent your personal information. Outside the relay described above, ZeroAgent does not collect personal information from you: the only things that leave your machine on their own are the release feed check (to Amazon CloudFront) and, if you visit this website, standard analytics (to Google). If you turn the relay on, the information in "What the Relay Carries" above leaves your machine too, only while the relay is connected, and only to the relay itself: MVPLean does not sell, trade, rent, or share it with anyone else.

Data Retention

Because ZeroAgent's data lives on your own disk, you control how long it is retained there; uninstalling the app or deleting its data folder removes it, and MVPLean does not hold a copy. The relay is the exception: while it is on, it holds recent events for the bounded replay window described above (today, 24 hours or 3,000 events, whichever comes first) so a client that reconnects does not lose state, and then they age out.

Children's Privacy

The Service is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13.

Changes to This Policy

We may update this Privacy Policy from time to time, including as we build the paid features and any account, telemetry, or crash reporting described above. We will post the new Privacy Policy on this page and update the effective date at the top.

Contact Us

If you have questions about this Privacy Policy, please contact us at:

Email: hello@zeroagenthq.com
Website: mvplean.com