Privacy at Infser

Project scope

Infser is an independent software project. This document describes how it processes data today and how to contact us.

Account and authentication data

Infser processes account identifiers, email, password-security state, verification state, two-factor metadata and connected authentication identities when applicable so users can authenticate and secure access.

Workspace and membership data

Workspace names, memberships, roles, invitations and permission relationships are processed to isolate tenants and decide which users may access devices and actions.

Device and runtime metadata

Device identity, public-key or fingerprint metadata, platform, agent version, reported capabilities, lifecycle state and recent presence are processed to route only authorized work to eligible devices.

Action, approval and security metadata

Infser records bounded operational metadata such as actor, target, action status, approval decisions, timestamps and security events so authorization can be enforced, revoked and audited.

Execution-content boundary

Runtime content is processed only as needed for the requested feature. Terminal sessions opened from the signed-in dashboard are designed not to become stored command transcripts. Temporary artifacts use bounded lifetimes where supported.

Desktop screenshots and live frames

A screenshot or live desktop frame is sent only after the signed-in user approves that action, and only to the assistant session that requested it. Infser does not retain the picture: frames stay in gateway memory until the next frame replaces them or the stream stops, and they are not written to disk or to the audit log. A screenshot artifact expires on the same short lifetime as before and is not kept beyond that. The user can stop the stream in the widget, revoke the approval grant, sign out, or disconnect the device. Streams also end when the grant or OAuth token is revoked, the device goes offline, or the 10 minute limit (15 minute maximum) expires. Recipients are the connected assistant host (for example ChatGPT) and the Infser gateway that relays the frames. Mouse and keyboard are not part of the picture feed. In the public tool profile, desktop.state includes a window title only for the focused window and truncates it, because titles can name documents or invoices. Other titles are omitted unless include_window_titles is set. The live picture is JPEG over HTTPS. It is available on Linux with X11 and in testing on Windows, macOS and Android. On a Mac, Screen Recording and Accessibility are granted by the signed-in user to Infser Desktop Worker. Infser does not change those system switches itself. The grant is requested once; later upgrades keep it while that Mac still has the same local code-signing identity. Run sudo /usr/local/libexec/infser/infser-agent permissions to open the prompts again.

What an assistant receives

The assistant connection can list devices and, inside the allow-list, list, read, stat and search files. It can also see the list of processes and services on the device. Writing, creating folders, moving and deleting files, opening a terminal, and starting or stopping programs and services require the grant, as do mouse and keyboard actions, unless you set rules for them in your workspace. The assistant receives the result of the action you approved, not a standing export of the disk.

Home folder by default

A new device limits file tools to the signed-in user’s home folder. Full-disk access is opt-in on the installer (--full-disk on macOS and Linux, -FullDisk on Windows) and is not granted by pairing alone. The minimum data needed for a file action is the path and content that action requires. If an upgrade finds a missing, unusable, or Infser-only allow-list, it repairs that list to the home folder and keeps a backup of the previous file. A valid existing allow-list, including one you set to the whole disk, is left unchanged.

Android app

On Android, the Infser app reaches only what you allow: the folders you add through Android’s folder picker, the screen while you share it, and device control through the Infser Accessibility service while remote access is on. Android keeps other apps’ private data closed to Infser. Error reports are off by default. If you turn on Send logs, the phone sends error codes, counters and the time of the last error every 15 minutes, signed with the device key. They never contain screen content, files, folder names, typed text or passwords. Infser keeps the latest 20 reports per device, shows them on the Devices page and deletes them when the device is deleted.

Cloud browser

When the cloud browser is on, the assistant can open a session on a browser run by Infser and visit websites. Opening the browser and acting on pages need your grant, unless you set rules for it in your workspace. Files downloaded in a session are temporary artifacts with a limited lifetime.

Browser profiles and credential vault

A browser profile keeps the sign-in state for websites, such as cookies, so a later session stays signed in. You can delete it whenever you want. The credentials you save in the vault are encrypted with AES-256-GCM. The assistant cannot read them: Infser only places them into the browser session that needs them, with a permission that lasts at most 60 seconds, and does not write them to logs. You can disable, rotate or delete a credential whenever you want.

Web search and page reading

When web search is on, the text the assistant searches for is sent to the configured search provider, and requested pages are downloaded by Infser servers to extract their text. Infser records only technical data about the requests, such as the content type and size, not the page text. If you create a periodic check of a page, Infser keeps its address, its title and a fingerprint of its content to notice changes.

Security and abuse prevention

Authentication, rate limits, tenant isolation, device lifecycle checks, revocation and audit signals are used to protect accounts, workspaces and infrastructure from unauthorized access or misuse.

Service-provider categories

Depending on active production configuration, infrastructure hosting, email delivery, authentication, web search or payment providers may process the minimum data needed to provide their function. Infser does not invent a fixed provider list when a service is not configured. The public site does not load advertising or analytics trackers.

Retention principles

Account and workspace records are kept while needed to operate the relationship. Security and audit records may outlive a session where needed for traceability, while short-lived grants, tokens and temporary artifacts follow bounded expiry or cleanup rules.

Your choices and requests

Users can manage profile and security settings, revoke connected access, disable or revoke devices, and request account deletion subject to workspace-ownership and security constraints. Privacy questions or requests can be sent to [email protected].

Contact about privacy

Email [email protected] for privacy questions. [email protected] reaches the same project for general enquiries. Do not send passwords, tokens, private keys, sensitive machine data or identity documents.