Data needed to operate device access
ADC processes account and session records, authorizations, disclosed device names and capabilities, selected root metadata, task requests, states, requested results and receipts. The control plane does not automatically crawl or mirror the connected filesystem. However, a file.read request can return file content, and shell output can contain paths or other sensitive information.
Tools execute on the selected device. Their arguments and returned data pass through the chosen service and can be stored as operational task records. TLS protects network transport; it is not end-to-end encryption that hides tool data from the service operator. The agent or model provider receiving the result has its own data handling rules.
Device private keys and locally configured MCP provider credentials remain on the device in the normal integration path. Unrequested file contents are not uploaded automatically. These boundaries cannot prevent an authorized command or provider from deliberately returning a secret; choose tools and review outputs accordingly.
Optional website analytics
A hosted deployment may configure Plausible for page visits and named onboarding events such as pairing-code creation or Agent access creation. The built-in integration uses known route names rather than arbitrary device-detail URLs. Product events do not attach invocation arguments, execution results, account names or device labels.
Public page views can include allowlisted campaign parameters such as utm_source and ref. Those are supplied by the visiting URL, so do not put private data in campaign links. The configured provider also receives browser requests and applies its own processing rules. This explanation describes ADC's integration, not a guarantee about every possible operator configuration.
Who operates the service matters
A source build or self-hosted instance has no project analytics destination configured by default. The operator controls the service database, logs, backups and optional analytics provider. Running an agent, Connector or integration against the official service still sends the requests needed for that service, even when website analytics is disabled.
Revoking a grant or unpairing a device stops the corresponding future access; it does not automatically erase previous task records or backups. This page does not promise a uniform retention period, automatic deletion job or deletion deadline. For a self-hosted service, verify its operator's retention and backup procedures before sending data.
Controls available to users and operators
Users can select folders and tools, require approval, revoke Agent access and remove device exposure. These controls limit requested operations and data; they do not retroactively remove completed effects. Use a small known file for initial verification and expand permissions for an actual task.
Operators can disable analytics by removing both ADC_ANALYTICS_SCRIPT_URL and ADC_ANALYTICS_DOMAIN. The built-in browser integration checks Global Privacy Control and Do Not Track before loading the configured script or emitting events. Authentication cookies and required service requests serve a separate purpose and are not disabled by this analytics choice.