No telemetry. No cloud. No account.
Not a policy — a property of the code, and the only claim on this site you can check instead of believing.
This website
- No cookies are set. There is no login and nothing to remember about you.
- There is no analytics script of any kind. Not Google Analytics, not a privacy-friendly one either. The page makes no third-party requests at all.
- No web fonts are loaded from anywhere. Type comes from your own machine.
- There is no form on this site. There is nothing here you can submit and nothing that collects an address.
The claim
Most software that says privacy-first is asking you to trust a promise about what happens to data after it is uploaded. Nothing is uploaded here, because there is nowhere to upload it to. There is no AgentCron backend. There is no account to create. If your Mac is offline, everything except your own agent CLI still works.
That is worth more than a marketing line, because it is the one thing a hosted competitor structurally cannot say — and the one thing a sceptic can disprove in two minutes if it is false.
Everything that talks to the network, exhaustively
This is the complete list. Every entry is a service you configured, reached with your own credentials, and every one is optional — turn the feature off and the connection does not exist.
| Destination | When | Whose account | What it is |
|---|---|---|---|
| Destinations reached by your agent CLI and its configured tools | Whenever an agent runs | Your subscription | AgentCron launches the CLI as a subprocess. The CLI and any web tools, scripts or project credentials you gave it follow their own network and data policies. |
| Your IMAP / SMTP server | Only if you connect a mail account | Your mailbox | Password in the macOS Keychain, not in a config file. |
| Google's OAuth endpoints | Only if you connect a Gmail account | Your Google account | Standard token exchange, directly with Google. There is no server of ours in the loop. |
| Telegram's API | Only if you set up the phone bridge | A bot you created, in a chat you own | Long-poll — the app reaches out. Nothing listens for an inbound connection and no port is opened. |
| MCP servers listed in your own config | Only the ones you added | Yours, or a vendor's you chose | AgentCron bundles none, ships no default and endorses none. It is a client, the way a browser is. |
| A tunnel provider you configure | Only while you explicitly start a phone or local-service tunnel | Your provider account, or the provider's temporary-tunnel service | AgentCron launches the local tunnel command you selected. The provider receives the traffic and applies its own terms. |
| Destinations reached by an installed plugin | Whenever that plugin chooses to connect | The plugin author's or your account | Plugins run as your macOS user and are not network-sandboxed. Their manifest declares intended hosts, but AgentCron cannot enforce that declaration. |
| The update manifest on GitHub | Only if you switch it on — the app asks once and the default is off. Then 90 seconds after launch and once every 24 hours | Nobody's — an unauthenticated fetch of a static file | The only destination here that is not a service you configured — so it is the one that has to be named. It is still opt-in: a fresh install makes this request never, AgentCron asks you once whether it should check daily, and until you answer yes it makes no request at all. When it is on it asks whether a newer version exists; it sends no identifier, no machine detail and no usage, and it never downloads or installs anything on its own. One switch in Settings turns it back off and it is never contacted again. It is named here rather than left in a config file, because a page like this is worthless if it turns out to have an exception nobody mentioned. |
And nothing else
Specifically not:
- No analytics, product analytics, session recording or heatmaps.
- No crash reporting or error uploading.
- No licence phone-home and no install beacon. Licence validation is designed to be verifiable offline — a key you can check on a plane.
- No calls to a language model of our own. AgentCron never sends your code anywhere; your CLI does whatever your CLI already does, on terms you already agreed to.
- The user interface makes zero network requests of any kind. Everything it needs comes from the Rust process over a local channel — a Unix socket, not a TCP port.
The one exception, stated rather than buried: the update check in the table above. It is off until you switch it on — AgentCron asks once, on first run, and a fresh install that never answers makes the request never. It is a static file fetch that asks is there a newer version and carries nothing about you, but it is the only destination in the table that is not a service you set up yourself, so it does not belong in a list of things that never happen. The switch is in Settings → Updates and takes effect immediately, in both directions.
Check it yourself in about two minutes
The source is not published, and this page does not pretend otherwise. AgentCron is a commercial product; what you buy is the app, not the repository. So the verification offered here is the kind that does not need source — and it is the check anyone sensible runs on someone else's software anyway:
Watch it. Point Little Snitch or LuLu at the app and use it for a day. Every destination in the table above is a service you connected yourself, plus one named exception: a static update check you can switch off in Settings. If anything else appears, the table is wrong — tell us, because that is a bug.
Watch the interface separately. Open the app's web inspector and look at the network panel. It stays empty. The interface talks to the local Rust process over a Unix socket and makes no HTTP request of any kind.
A claim you can falsify with a firewall in an afternoon is worth more than a promise about a repository.
Where credentials live
Nothing sensitive is written into your repo, and nothing lands in a file a screen-share would expose.
| What | Where |
|---|---|
| Mail passwords | The macOS Keychain. |
| MCP server tokens | A separate file per server, outside the app's data directory, owner-only at mode 0600. The app's own config records only whether a token exists — never the token. |
| Phone-bridge bot token | The app's data directory, written atomically at mode 0600, owner-only, never in the repo. |
| Your GitHub credentials | Wherever they already are. AgentCron points the gh CLI at a per-project config directory and token variable; it stores neither. |
| Run history, prompts, command output | A local SQLite database and files in the app's data directory, mode 0600. Retention is configurable, and cleanup previews what it would delete before it deletes anything. |
The one thing that is recorded, disclosed rather than discovered
The app keeps a local usage journal — an append-only file per day in its own data directory — so that the health check can tell you what you actually use and where your disk went. It never leaves the machine, it is kept for 30 days and then deleted, values shaped like credentials are redacted before they are written, and there is a switch that turns it off entirely and takes effect immediately.
This is called out rather than left to be found, because a page like this is worthless if it turns out to have an exception nobody mentioned. The module that reads it carries a rule written at the top of the file: there is no network code in it, and none may be added.
What AgentCron is allowed to do on your machine
This is a serious amount of trust to ask for, and pretending otherwise would undercut everything above. Here is the honest surface, so you can decide on the real facts.
It runs agent CLIs with their permission prompts disabled
That is the point — an unattended run cannot answer a prompt. It is also why the approval gate exists and why the command log is not optional. If you are not comfortable with that trade, this is the wrong tool, and it is better to find that out here than after paying.
It puts a small command-line tool on each agent's PATH
That is how an agent reports progress, asks a question and requests approval. It is a script in the app's own data directory, and it currently needs Node.js to run.
Agents run real shell commands in your repos
With your environment, credentials and network access. Review-gate jobs normally run inside a targeted macOS owner boundary that protects repository history, common credential stores and AgentCron control files. It is not a general-purpose sandbox: other local files and credentials deliberately placed in the project can still be reachable, and the run says when the boundary was unavailable or switched off.
The phone bridge can start agents
Which is genuinely useful and genuinely a bearer credential sitting on a phone. Only chat ids you list are honoured, and each connection has a permission level — read a digest, answer questions, or full control — so a bot you use for notifications cannot be talked into launching anything.
Tools published to agents start at a read-only ceiling
When AgentCron exposes its own tools to an agent, the default without explicit configuration is the read-and-report tier, not the owner tier, and an unrecognised policy value is rejected rather than treated as maximum. The failure direction is less capability, never more.
Why this will not quietly change
There is no revenue model here that wants your data. AgentCron is a one-time licence for software that runs on your Mac, and there are no servers to fund, so there is never a quarter where adding telemetry looks like the cheap option.
And the check on that does not depend on us being honest: the network monitor works today, on the build you have already installed. Watch the app for a day and the table above either matches what you see or it does not — and if it does not, that is a bug to report, not a nuance.
If you work somewhere with a security team
Two things they will ask, answered in advance.
Credentials on a laptop. AgentCron does not create this problem, but it does make it more visible: an agent that runs your test suite needs whatever your test suite needs. If your policy says production credentials never touch a laptop, that policy is still right, and it rules out some of the things you might want to schedule. Per-project environment variables at least keep each project's credentials scoped to that project rather than to your shell.
Data leaving the building. The only thing that leaves is whatever your agent CLI sends to its own vendor — the same traffic you already generate running that CLI by hand. AgentCron adds no destination. It does add volume, because a scheduled agent runs whether or not you are watching, and the instructions appended to every prompt are billed to your own subscription. That is a real cost, and it belongs here rather than in a surprise.