fix(privacy): scope "cannot see contents in any mode" to tunnel traffic; disclose brokered app calls#139
Merged
TeoSlayer merged 1 commit intoJul 22, 2026
Conversation
…p calls The policy claimed 'we cannot see, log, or access its contents in any mode'. That is true for overlay tunnel traffic (direct or beacon-relayed opaque packets) but false for managed App Store apps routed through the Pilot-operated broker, which by design processes request contents to authenticate the caller, inject the upstream provider credential, meter spend, and forward to the provider API (e.g. AgentPhone's listing: 'the broker authenticates you as your Pilot identity, injects the master key, meters your spend, and forwards to api.agentphone.ai'). Scope the claim to tunnel traffic and add the brokered-call exception. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01D2boz7GoTW34JmzymSjCpf
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Exact issue
Privacy Policy §1 states:
"In any mode" is false for managed App Store apps. The app-store plugin's own architecture (supervisor + broker) and the AgentPhone listing describe the flow explicitly: "the broker authenticates you as your Pilot identity, injects the master key, meters your spend, and forwards to https://api.agentphone.ai." A broker that injects provider credentials, meters spend, and forwards requests to an upstream HTTP API necessarily processes the request contents — phone numbers, SMS bodies, KYC payloads, enrichment queries — in a form it can read. The same applies to other Pilot-brokered provider apps.
This matters beyond marketing accuracy: it is a privacy-policy completeness issue (GDPR/CCPA disclosures should cover this processing), and brokered calls can carry personal data about third parties who never saw this policy.
Change
Wording is intentionally factual/architectural — no new retention or processing commitments are invented; maintainers should extend it with actual retention practice if desired.
🤖 Generated with Claude Code
https://claude.ai/code/session_01D2boz7GoTW34JmzymSjCpf