Privacy Policy — Recto Agentic
Last updated: 2026-10-30
Recto Agentic is a public open-source application (Apache 2.0) that serves as an operator-phone-as-root-of-trust authenticator. This policy describes how data is handled by the Recto Agentic app.
What data Recto Agentic collects
Recto Agentic collects no personally identifying information. Specifically:
- No name, email, or phone number is required to use the app.
- No analytics or telemetry is sent to any server controlled by the Recto developers or any third party.
- No advertising identifiers are accessed.
- No third-party software development kits that collect user data are integrated into the app.
What data Recto Agentic stores on your device
Recto Agentic stores the following data locally on your device only:
- Your keys and your recovery phrase, protected by your device’s secure hardware. The app shows the recovery phrase only after a biometric check, so that you can write it down. Your keys and your recovery phrase are never transmitted to any server, including the Recto developers.
- The URLs of bootloaders you have paired with.
- Per-pairing metadata required for signing operations (paired service identifier, public-facing branding the service supplied during pairing, the agent identities authorized to send you requests through that pairing).
- A local history of signing requests you have approved or denied (for your reference; never transmitted off-device).
You may delete any pairing at any time from within the app.
What data Recto Agentic transmits
When you approve a signing request, Recto Agentic transmits the following to the bootloader you paired with:
- A cryptographic signature over the request payload, made with your keys.
- The pairing identifier (so the bootloader knows which paired device sent the response).
Recto Agentic transmits nothing else. No analytics. No usage statistics. No location. No device-fingerprinting beacons.
The bootloader you paired with is operated by the service you chose to pair with, not by the Recto developers. The bootloader operator’s privacy policy governs what they do with the signed response after they receive it.
Biometric authentication
To approve a signing request, Recto Agentic prompts you for biometric authentication (Face ID / Touch ID / fingerprint). This biometric verification is performed locally on your device by the operating system. Your biometric data never leaves your device. Recto Agentic does not access, store, or transmit any biometric information.
Push notifications
Recto Agentic can receive remote push notifications (Apple Push Notification service for iOS, Firebase Cloud Messaging for Android) to wake the app when a paired service sends you a new signing request. The notification payload contains only a wake-up signal — no signing request details are included in the push payload itself.
For Apple Push Notification service: an APNs device token is generated by iOS and shared with the paired bootloader, so the bootloader can address future requests to your device.
For Firebase Cloud Messaging (Android): an FCM token serves the same function as the APNs device token on iOS. Firebase Cloud Messaging is a Google service; Google’s privacy policy applies to the token-issuance step. The token itself contains no personally identifying information.
Open source
Recto Agentic is open source under the Apache 2.0 license. The exact code running in the version you have installed is published at github.com/Recto-LLC/Recto. You are welcome to audit any aspect of the data handling described in this policy.
Children’s privacy
Recto Agentic is not directed at children under 13. The app collects no personally identifying information from anyone, so no special COPPA-related collection occurs.
Changes to this policy
If this policy is updated, the “Last updated” date at the top will be revised. Material changes will be announced on this page.
Contact
Privacy questions: open an issue at github.com/Recto-LLC/Recto/issues.