Coral Courier Privacy Policy

Draft revised October 28, 2026. Publication is pending legal/provider review and verification against the deployed service. This draft does not certify compliance or release readiness.

This policy explains what Coral Courier collects, why, who else receives it, how long we keep it, and how you can manage or delete it.

"Coral Courier", "we" and "us" mean Dominic Rand, who sells and operates Coral Courier. Coral Courier includes the iPhone, iPad and Mac apps and the Cloud service. A self-hosted Hermes Instance has its own operator; its storage and provider choices are separate from the Cloud service described here. Your Agent is the AI assistant the service creates for your account.

Contact for anything in this policy: support@coralcourier.com.

What we collect

Account. When you sign in with Apple we receive a user identifier from Apple, and the name and email address you choose to share (Apple may give us a private relay address instead of your real one). A passkey account uses a passkey identifier and need not have an email address. Apple and passkey accounts are separate identities; they are not automatically merged. The Mac can join an Apple account through approval from a signed-in Apple app, or use a separate passkey account. We also keep the name and voice you pick for your Agent, your time zone, and the settings you change.

Your conversations. Everything you send your Agent and everything it sends back: typed messages, files and photos you attach, Drafts it writes for you, Scheduled Jobs it runs, and what it remembers about you so it can help you later.

Per-User Conversations are private. Before joining a shared Agent, understand that its shared memory, skills and Scheduled Jobs may incorporate material derived from private Conversations. Use a personal Agent for material you do not want contributing to those shared resources.

Voice. Voice Messages you record, and audio from Calls with your Agent. Audio is turned into text so the Agent can answer, and Calls keep a transcript in your conversation. We delete recorded audio from our servers once it has been turned into text; the text stays in your conversation.

Device actions. When you let your Agent use your iPhone, it can ask the device to look something up or do something, such as reading your calendar or adding a reminder. The request and the result (for example, the calendar entries it read) go to the service and become part of your conversation. Setup lets you review selected areas and opt out. Access in the app, OS permissions, action Approval and identity Verification are separate controls. Device Actions must use the requesting User's authorized devices and the areas allowed in Settings › Access and by the OS. A record of each action is kept so you can see what your Agent did, in Settings › Account › Activity.

Connected accounts. If you connect another account to your Agent, such as Google, we store the access token the other service gives us and the data the Agent reads from it to do what you asked.

Secrets. API keys, passwords or numbers you give your Agent through the secure sheet are encrypted and stored under a name. They are never shown in your conversation.

Usage and billing. Your plan, your dollar balance, top-ups, and a ledger of what each turn, Call and job cost. Apple handles all payments; we receive a record of each purchase from Apple (product, date, price, renewal state), never your card details.

Diagnostics. Opt-in sanitized crash and performance reports, and technical operational logs used to fix problems. Ordinary logs must exclude credentials and routine Conversation content. An Agent-prepared support report requires the reporting User to review and approve the minimal redacted report before submission, excludes other Users' private content, and requires owner approval for account-sensitive diagnostics. Support does not get general access to raw Conversations. Approval-gated Agent reporting remains a delivery requirement, not a new support access grant.

Reports. If you report one of your Agent's responses or contact support about abuse, we keep the report and the messages it is about.

We do not sell or share your data for advertising, show ads, or track you across other companies' apps or websites.

Why we use it

• To run your Agent and do what you ask: answer messages, take Calls, run jobs, use the devices and accounts you have allowed.
• To bill you correctly and enforce your spend limits.
• To keep the service secure, prevent abuse, and fix problems.
• To contact you about your account, billing or important changes.

We do not use your conversations to train AI models. Current provider terms, retention and exceptions for each selected service still require review before this draft is published.

Who else receives it

We share data only with the companies that help run the service, and only what they need. The exact provider list, purposes, retention and exceptions must match the selected service and current provider agreements before publication.

When the Agent browses the web or searches for you, the websites it visits see requests from our hosting provider, not from you.

We may also disclose data if the law requires it, to protect people from harm, or as part of selling or transferring the business, in which case this policy continues to apply.

Coral Courier is offered in the United States. Your data is stored and processed in the United States and in other countries where Cloudflare and OpenAI operate.

How long we keep it

These are the selected limits. Deployed enforcement and provider exceptions still require acceptance before publication.

• Account and Conversations: until you delete them. Delete Account covers every cloud Agent owned by that account, including media, workspaces, stored Secrets, diagnostics and abuse-report content. A specifically approved legal hold is an exception; no general one-year abuse retention applies.
• Ordinary operational logs and opt-in sanitized diagnostic bundles: at most 30 days. This does not turn routine Conversation content into an operational log.
• Backups: remove account-owned copies where possible. Residual offsite copies must expire within 35 days, and deletion tombstones must prevent restoring deleted identities or their data. A stopped offsite runner or an unavailable provider is not proof that expiry happened.
• Billing records: kept after you delete your account. That is your balance ledger (top-ups, plan allowance and what each turn, Call and job cost), your App Store purchase and transaction records, and Apple's notifications about them. We have not set a period for these records, and this policy does not claim a legal retention period.
• Starting-credit prevention: the existing one-way Apple identifier hash is retained for up to one year from the original grant to prevent repeat starting grants. This is a product safeguard, not a claimed legal retention requirement.
• Providers and support destinations: their actual retention, deletion and any required exceptions need current review. We do not promise that deleting the account instantly removes copies held by outside providers or a support destination.

Your choices and rights

• Get a copy of your data. There is no general export, in the app or by email. Where the law gives you a right to a copy of your data, ask support@coralcourier.com and we will provide what it requires. We first confirm the request comes from the account's owner; an email address alone does not prove that, and passkey accounts may have no email. The same address handles your other privacy rights.
• Recovery. Apple account recovery goes through Apple. Passkey sign-in uses the passkey you registered; it does not merge with an Apple account. Support does not bypass account authorization or offer a new recovery-email/code system.
• Offline devices. Deleting an account cannot remotely wipe an unreachable device. It may still hold cached data.
• Correct. Change your name, Agent settings and memory in the app, or ask the Agent to forget something.
• Limit device access. Turn areas off in Settings › Access, or revoke a device, at any time. Settings › Account › Emergency Stop revokes every other device and stops your Agent's work at once. You can also withdraw iOS permissions in the iPhone's Settings.
• Withdraw AI consent. You can withdraw your consent to sending data to the AI provider in Settings › Account › Withdraw AI Consent. The Agent cannot work without it, so withdrawing stops the service until you consent again.
• Delete. Delete a conversation, or delete your account in the app at Settings › Account › Delete Account. See Deleting your account for what that removes and when.
• Your state's privacy rights. Depending on where you live, you may have the right to know what we hold about you, to get a copy, to correct it, to delete it, and to opt out of its sale or use for targeted advertising (we do neither). Email us to use any of these rights. Applicable response deadlines and any exceptions must be verified before publication. We will not treat you differently for using applicable rights. If we turn down a request, you can appeal by replying to our answer, and if you are still not satisfied you can contact your state's attorney general.

Children

Coral Courier is only for adults 18 and over. We do not knowingly collect data from anyone under 18. If you believe someone under 18 has created an account, contact us and we will delete it.

Security

Your data is encrypted in transit and in backups. Each customer's Agent runs separately from every other customer's. Your devices hold their own tokens, which you can revoke. No system is perfectly secure; if a breach affects your data we will tell you as the law requires.

Changes

If we change this policy in a way that matters, we will tell you in the app before the change takes effect. The date at the top shows the current version.