Ecohash

Walkpilot Privacy Policy

Effective date: September 27, 2026

Walkpilot is a phone and iPad app, with an Android preview, for steering the AI coding agents that run on your own computer. It works together with the open-source Walkpilot server, which you install and run yourself. Both are made by Team Ecohash (Ecohash LLC).

The short version

The Walkpilot app collects no data. No accounts, no analytics, no advertising, no tracking. The app talks to the Walkpilot server you run, on a machine you own, and nowhere else. We don't run a relay or a cloud service between them, and neither the app nor the server sends anything to us.

  • Apple App Store privacy label: Data Not Collected.
  • Tracking: none. The app never asks to track you and uses no advertising identifier.

What the app talks to

  • Your Walkpilot server. Everything the app shows or sends (agent output, your messages and answers, voice audio during a walk, photos and files you send to an agent) goes only to the server you paired with. Connections use HTTPS; when you pair, the app pins your server's certificate and checks it on every connection. The app refuses plain http:// to anything other than the device itself.
  • A hosted speech service, only if you choose one. If you pick OpenAI, Groq, Deepgram, ElevenLabs or another hosted speech provider in Settings, the API key you enter is stored in the iOS Keychain and sent to your server for each walk. Your server then calls that provider directly with your key, and that provider's own privacy policy applies. We never see the key or the audio.
  • Apple. If you choose on-device speech, recognition runs on the phone with Apple's on-device recognizer, and voices are the system voices; the app doesn't send that audio anywhere. Optional tips are purchases handled by Apple; the app keeps only a local count of tips.

That's the complete list. The app contains no third-party analytics, crash-reporting or advertising SDKs.

Permissions the app asks for

  • Microphone: so you can talk to your agents, including on a walk with the screen locked. The microphone is only live while you are talking to Walkpilot, such as during a voice walk.
  • Speech recognition: only if you choose on-device transcription. Transcription happens on the device.
  • Camera: to scan your server's pairing QR code, and to take photos you send to an agent.
  • Local network: to reach the server you run on your network or VPN.
  • Face ID: to lock the app and renew access to your server, if you turn that on. Face ID is handled by iOS; the app never sees your face data.
  • Adding to your photo library: only when you ask to save an image an agent shared.

Walkpilot 1.0 does not use push notifications with self-hosted servers, and the app doesn't ask for notification permission unless your server supports them. The Android preview shows a notification only while a voice walk is running, as Android requires for microphone use.

What stays on your device

  • Settings, themes and drafts you haven't sent yet.
  • Your pairing: the server's address, its pinned certificate fingerprint, and a device key created on the phone (kept in the Secure Enclave or Keychain where available) that proves to your server that this phone is the one you paired.
  • API keys for hosted speech services you chose, in the Keychain.
  • Recent agent content the app has cached to draw its screens.

Deleting the app removes all of this. You can also sign out in Settings, and revoke any paired device from your server (walkpilot devices revoke).

Diagnostics

Diagnostics are off by default. If you turn them on (Settings › Account & server › Diagnostics), the app sends its own logs, such as connection events and errors, to your own server, never to us. Your server ignores them unless you have also turned on telemetry there.

The demo

"Try the demo" on the iOS app's welcome screen runs entirely on the phone with made-up sample agents. It needs no network and sends nothing anywhere.

The Walkpilot server you run

The server is open-source software you install on your own computer. We don't operate it and can't see anything on it. For your information, here is what it keeps, all on your machine:

  • The devices you've paired and their sign-in sessions.
  • Walk history, per user: transcripts of your voice walks, and recordings, which are deleted after 30 days by default (audio_retention_days in its configuration).
  • Whatever your agents and herdr already keep; Walkpilot reads that session, it doesn't copy it elsewhere.

Out of the box the server sends no telemetry, calls no AI model and sends no push notifications. It only contacts the services you configure yourself: a speech service, an OpenAI-compatible model, a sign-in (OIDC) provider, or a log server. Those are covered by the policies of whoever runs them.

The hosted demo sandbox

We plan to run a public sandbox server at walkpilot-demo.ecohash.co (not live yet) so anyone can try a real connection with scripted sample agents. If you pair with it:

  • It runs scripted agents only: no AI model, no real shell. Please don't type anything private into it.
  • Each phone gets its own sample fleet, which no other visitor can see. Everything is wiped at least every hour.
  • Voice walks are not available there.
  • We keep ordinary web access logs (IP address, time, requested path and response status) for up to 7 days to deal with abuse, then delete them. We never log what you type or send.

Children

Walkpilot is a developer tool rated for all ages. It collects no data from anyone and has no social or public sharing features.

Changes

If a future version changes any of the above, for example by adding a push-notification relay, this policy will be updated before that version ships, and the store privacy labels will be updated to match.

Contact