Privacy policy

Effective October 17, 2026

This policy covers Korus for macOS, Windows, and Linux, its iPhone companion Korus Mobile, and this website. Korus is developed and operated by Nicolas Bonamy (nabocorp). For privacy questions or requests, contact korus@nabocorp.com.

Your conversations are not stored on Korus servers. Conversation and workspace content sent between your iPhone and computer is encrypted end to end, so the relay cannot read it.

Your computers keep your workspace and coding-runtime history. The apps also keep local settings and pairing information. Coding providers and tools you choose receive the context needed to carry out your requests; connection and push-notification metadata is handled separately, as described below. You do not need a separate Korus account.

Your workspace and coding providers

Korus stores workspace information on the computer running it: teams and agent names, repository references, settings, tasks, plans, review results, documents, diagrams, and integration credentials. Coding runtimes maintain conversation history and their own authentication data in their selected local setup. Remote teams keep their working data on the computer hosting that team.

When you use an agent, your prompts, relevant code and files, attachments, tool results, and other context may be sent to your selected coding provider, such as OpenAI, Anthropic, or Google. Connected tools, MCP servers, websites, GitHub, Linear, and other integrations receive the information needed for the actions you ask them to perform. This can include account identifiers, repository content, issues, and pull requests.

These services process information under their own terms, privacy policies, and your account settings, including their retention and model-training settings. Korus does not override those settings. Review the services and tools you enable before sharing sensitive information.

Connecting your iPhone

After you pair and approve your phone, Korus Mobile can display your workspace, conversations, images, changes, and requests, and send prompts, attachments, and decisions to your computer. Conversation and workspace content is encrypted between the paired phone and computer while passing through the relay. After pairing establishes their identities, the relay cannot read that content.

The relay processes connection metadata to introduce paired devices, route encrypted traffic, and prevent abuse. This includes IP addresses, device and computer public identifiers, pairing invitations, routing relationships, connection timing, and traffic volume. Initial pairing relies on the relay to introduce the devices; keep pairing codes private and approve only devices you recognize.

Routing, invitation, and rate-limit state is temporary and expires; the relay does not maintain a conversation archive. Hosting and network infrastructure, including Cloudflare's network services, may process connection metadata and security or error logs to operate and protect the service. That operational processing is separate from the encrypted conversation content.

Push notifications

If you enable notifications, the phone registers an Apple Push Notification service (APNs) device token with your paired computer. The computer sends the token and notification metadata through the relay to Apple. This metadata includes the agent name, whether work finished or needs your attention, a timestamp, and identifiers used to open the correct conversation.

Push payloads do not include prompt text, conversation messages, approval contents, or tool arguments. Agent names can still reveal information and may appear on your lock screen. You can change notification permissions and previews in iOS Settings. Apple handles notification delivery under its privacy policy.

Photos, files, microphone, and device access

• Photos, camera, and files: the iPhone app accesses the items you select or capture for an attachment, or scans a pairing QR code when you open the scanner. Sent attachments travel to your paired computer and may be passed to your selected coding provider.
• Dictation: iPhone dictation requires microphone and speech-recognition permission and uses on-device recognition. Dictation audio stays on the phone; recognized text enters your draft and is sent only when you send the prompt.
• App lock: optional Face ID, Touch ID, or passcode protection uses Apple's device authentication. Korus receives the authentication result, not your biometric data or passcode.
• Desktop tools: browser and optional Computer Use features can access pages, screen contents, and applications you allow an agent to use. Information an agent reads or captures can become provider context. Manage operating-system permissions and tool access to control these features.

Usage statistics and diagnostics

The desktop app records local usage statistics such as provider, model, workspace identifiers, token counts, timing, and outcomes. These statistics do not contain conversation text and are not sent to a hosted Korus analytics service. They are retained for up to one year, subject to a record limit, and can be deleted in Settings → Analytics → Clear.

The apps may keep local diagnostic logs to troubleshoot errors. iPhone connection diagnostics are limited in size and contain connection events and identifiers rather than transcript payloads. If you send us a support email, issue, or diagnostic file, we receive the information you choose to include and use it to respond and investigate. Remove secrets and private content before sharing logs or opening a public issue.

Website and downloads

The website does not use advertising trackers or a hosted visitor-analytics service. Serving pages, media, and downloads necessarily exposes network information such as your IP address and requested URL to the hosting and delivery services. Cloudflare helps deliver and protect the website and processes network information under its privacy policy. The landing page loads fonts from Google Fonts; downloads and release information use GitHub. Those services handle requests under their own privacy policies. This policy page uses system fonts.

We do not sell your personal information, use it for targeted advertising, or use your workspace content to train our own AI models. Third-party coding providers and services have their own practices, as described above.

Retention, deletion, and your choices

• Workspace and conversations: local data remains in the app's storage, your project folders, or the coding provider's local history until removed. Closing or archiving an agent does not necessarily delete its history. Uninstalling the desktop app does not necessarily remove that storage. Use the relevant app, provider, or filesystem controls to remove it, including backups you maintain.
• Mobile access: use Forget this laptop on the phone and revoke the device or disable mobile access on the desktop to end access. Pairing secrets are held in the iPhone Keychain with device-only protection. Push registrations are removed from the computer when the associated grant is revoked. Forgetting a pairing does not delete conversations on the computer or at a provider.
• Attachments: temporary copies uploaded from the phone are eligible for cleanup on the computer after one day. Copies retained in projects, provider history, or backups follow those locations' retention rules.
• Integrations and permissions: disconnect services you no longer use, revoke authorization at the provider, and change camera, microphone, speech, or notification permissions in system settings.
• Support and service records: we retain information supplied for support and operational records as needed to handle the request, protect the service, and meet legal obligations. Contact us to request deletion of information we hold. We cannot directly delete data stored only on your devices or in your third-party accounts.

Privacy requests and security

Depending on where you live, you may have rights to access, correct, delete, or obtain a copy of your personal information, object to or restrict processing, or withdraw consent. Send requests to korus@nabocorp.com. We may need to verify your request. You may also contact your local data-protection authority.

We use information to provide the features you request, with permission where required, and to maintain service security and respond to support requests. Data sent to providers or infrastructure may be processed outside your country. Encryption, pairing approval, and device protection reduce risk, but no system guarantees absolute security. Protect your devices and provider accounts, and revoke lost devices promptly.

Korus is a developer tool and is not directed to children under 13. If you believe a child has provided personal information to us, contact us so we can address it.

Changes to this policy

We publish updates at this URL and change the effective date when this policy changes. For questions about the policy or your information, write to korus@nabocorp.com.