Privacy policy

Concors by Rolling Inc. · Updated November 7, 2026

Concors connects your devices to coding workspaces on computers and servers you choose. Rolling Inc. provides Concors. Contact us at [email protected] with privacy questions, access or correction requests, or concerns about a processor.

Account and service information

We store your name, email address, account identifiers, organization memberships and connected-machine records to provide and secure the service. Privy handles authentication and the sign-in methods you select. You may use Apple's private email relay when Sign in with Apple is available. Concors issues its own session credentials. Session records include IP addresses and device/browser information. Credentials on iPhone use the device's secure storage. Privy also uses a browser identifier, device/browser information and sign-in interaction events for authentication diagnostics and service analytics. See Privy's privacy policy for its handling of this information.

Your workspace and AI providers

Messages, code, files, tool requests and terminal output travel between your device and the connected machine. Workspace history and provider sign-in credentials can be stored on that machine. Agent requests may send prompts, attachments, selected code and tool context to the AI provider and tools configured for the agent. Codex normally uses OpenAI; Claude Code normally uses Anthropic. Other agents and custom configurations can use other model providers, proxies and tool servers.

The iPhone app asks permission before agent actions can share data with a configured AI service. Check the named provider and configuration before agreeing. Do not send secrets, customer data or other people's personal information without authority. Provider retention, training and account settings depend on the provider and plan you use; review those terms before sharing. Withdrawing permission on iPhone stops new applicable requests from that device. It does not recall information already sent or stop work you started on another device.

Photos, files and microphone

You choose which photos and files to attach. Attachments can be stored with the conversation on the connected machine and sent to its AI provider. Microphone permission is requested when you choose dictation. Dictation audio is sent to the connected machine for transcription. We do not use these permissions to collect your library or record in the background.

Optional push notifications

When push notifications are available and you enable them, we store an app installation identifier, push token and platform linked to your account and sign-in session. Expo's push service and Apple's Push Notification service deliver iPhone alerts. Notification payloads contain a generic agent status, the machine name, and account, machine, project, chat and event identifiers used to open the correct chat. They do not include conversation messages, code, file paths or tool output. The machine name and status may appear on your lock screen; control previews in your device's notification settings.

You can turn push off in Concors settings or deny notification permission on your device. We remove the registration when you turn it off in Concors, its sign-in session is revoked, your account is deleted, or an invalid registration is detected. If you revoke device permission, Concors removes the registration when it next opens and checks that permission. To avoid sending the same event twice, the server keeps its event and machine identifiers for about one day, with an hourly cleanup sweep. See Expo's privacy policy and Apple's privacy policy for their processing.

Support and reports

Information you choose to send in a support message or content report is used to investigate and respond. An in-app report includes the text and workspace identifiers shown in its form; it does not automatically attach your conversation or code. Avoid including passwords, API keys or unnecessary personal information. Account-linked in-app reports are removed with the account.

Infrastructure and payments

The service uses hosting, networking, authentication and machine infrastructure providers to operate. Privy processes sign-in information; Railway hosts the account API and its database; OVHcloud supplies Concors-provisioned cloud machines; Cloudflare can provide machine hostnames and TLS validation; Stripe handles desktop machine billing where applicable. The iPhone app is free at launch and has no machine purchase or subscription checkout. Separate machine or AI-provider services may have their own charges and privacy terms. Data can be processed outside your country by the services you use.

Retention and deletion

Account and connection records are kept while needed to operate your account. You can initiate permanent deletion in the app's account settings or on the account deletion page. The confirmation explains which organizations and machines are affected. Sessions are revoked when the request is accepted. Cleanup removes the account, linked identities, personal service records and sole-member organizations; owned cloud disks are erased and renewals stopped. Shared teams remain available to their other members, with any ownership transfer shown before confirmation.

Your own external computer and its files are not wiped. Remove the Concors daemon, provider credentials and management access from that computer yourself if you no longer want them. Information already sent to an AI or other independent provider is subject to that provider's deletion process. Completed deletion receipts retain only a random reference and processing timestamps. Resolved in-app support reports are removed after 30 days unless you delete your account sooner. Our current Railway plan provides a 30-day operational log history window; this is an access window, not a guarantee that the hosting provider physically erases all logs on day 30. No Railway volume backup schedules or retained snapshots were configured for the production databases at this update. This does not describe copies on independently managed machines or records held by authentication, financial or other providers. We retain financial records and records subject to a security investigation or legal obligation as required for those purposes. Contact us about the records that apply to your request. Cleanup retries after provider outages, and your private receipt shows when it is complete or delayed.

Minimum age

Concors is for people aged 16 and older. If the law where you live requires a higher age or parental permission to use the service, those requirements also apply. Concors is not directed to children under 16. Contact us if you believe a child under 16 has provided personal information so we can investigate and remove it.

Account sign-in uses Privy, whose current policy restricts its service to people aged 16 and older. You must meet that requirement to create or access a Concors account. See Privy's privacy policy.

Your choices

You can decline AI sharing, withdraw permissions in settings, revoke microphone/photo access in device settings, turn off push notifications, sign out, request correction, and delete your account. Concors does not use the iPhone app for advertising tracking or sell your personal information. Contact [email protected] for privacy questions or assistance exercising rights available where you live.