Privacy policy

Applies to Agent Sentry and Agent Sentry Guard. Last updated 23 October 2026.

In short: Agent Sentry collects no personal data. It has no account, no analytics and no advertising, and it doesn't track you. To do its job it looks at the AI agents on your Mac, what they start and where they connect, and all of that stays on your Mac. The developer receives data from you only in a problem report you choose to send.

Who is responsible

The data controller is Piotr Panasewicz, reachable at piotr@codice.pl. Write to that address about anything in this policy, including the rights listed below.

What Agent Sentry looks at, on your Mac

• Processes. To recognize agents and everything they start, Agent Sentry reads running processes' programs, command lines, signatures and working folders, and only those environment variables agents use to mark what they run. It reads them on your Mac and doesn't store them, apart from what the panel shows of agents running now.
• Connections. Agent Sentry's network filter sees the connections that agents' processes make, and reads which host each is for from its first bytes: the server name a secure connection announces, or the host a plain web request names. It never reads what a connection carries. It keeps the last 500 hosts agents reached or were kept from, with the rule that decided, in its own folder, for the panel to show.
• Exposed secrets. When you add a folder to check, Agent Sentry reads the files in it on your Mac and shows where it found a secret and what kind, never the secret itself. It remembers which folders you added, with read-only access to them; what it found is kept only while it runs.
• Your rules and settings, and Agent Sentry's own log, which is kept for 7 days.

None of it is sent anywhere unless you send a report, described below.

Agent Sentry Guard

The Guard runs as a system extension so it can see which files agents open, create, rename or delete, and which programs they run. It checks only processes in an agent's session against your rules; your own processes are let go at once. It keeps a week of what its rules decided, including the paths involved, in its own folder, for Agent Sentry to show, and logs each refusal to macOS's log with the path kept private. It answers only apps signed by the same developer and never goes online.

Problem reports (only when you send one)

Settings › Support can send a report to the developer. Nothing is sent until you click Send Report, and you can preview the exact text first. A report contains:

• what you write in the report, including an email address if you add one;
• your Mac's model, chip and macOS version, and your language and region settings;
• whether network and file protection are working, and Agent Sentry's settings, with your rules only counted;
• the agents running, only by kind and whether each is confirmed;
• connections, only counted by whether they were allowed or blocked and by which rule;
• Agent Sentry's log from the last 3 days, and, if you include them, crash and hang reports from Agent Sentry.

Reports leave out host names, addresses, project folders, command lines and file paths of your agents' work. Your home folder and account name are removed from the log. Reports go over HTTPS to codice.pl, are read only to fix the problem you reported, are never shared or sold, and are deleted automatically after 90 days.

With each report the server also notes when it arrived, its size, and the app version, macOS version, Mac model and language Agent Sentry sends with it. It doesn't keep your IP address. The address is used only while the report arrives, to limit how many reports one sender can upload in an hour. For that hour, the count is filed under a keyed hash of the address, which can't be turned back into it, and then deleted.

After sending, Agent Sentry shows the report's reference. Quote it if you want the report deleted sooner, or want a copy of it.

Crash reports through Apple

If you chose to share analytics with app developers in macOS, Apple may pass Agent Sentry's crash reports to the developer. They don't identify you. You can change this in System Settings › Privacy & Security › Analytics & Improvements.

Notifications

Alerts and questions about connections are created and shown on your Mac. No notification service outside Apple's is involved.

Legal basis

A problem report is processed because you choose to send it: that is your consent (Article 6(1)(a) GDPR). You can withdraw it at any time by asking for the report to be deleted; this doesn't affect anything done with it before. The short-lived rate-limit count relies on the legitimate interest in keeping the upload service from being abused (Article 6(1)(f) GDPR).

Reports are stored on a server in Poland. They aren't passed to any processor or other recipient, and aren't transferred outside the European Economic Area. No decision about you is made automatically, and nothing is used for profiling.

Your rights

For a report you sent, you can ask for access to it and a copy (Articles 15 and 20 GDPR), its correction (Article 16), its deletion (Article 17), or the restriction of its processing (Article 18). You can also object to the rate-limit processing (Article 21). Write to piotr@codice.pl with the report's reference. You'll get an answer within one month. You also have the right to complain to the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, uodo.gov.pl), or to the data protection authority where you live or work.

Children

Agent Sentry collects no data from anyone, children included. A problem report holds only what is described above.

Changes and contact

If this policy changes, the new version will be published here with a new date. Questions: piotr@codice.pl.