Privacy Policy

Native document library on iPhone, iPad and Mac

When you choose a file, shared text, or a link to save, Terms Agent keeps a copy in its local library. Supported files include PDF, plain text, RTF and HTML. The library records the document title, source address if provided, saved date, file type and size, favorites, collection labels and the source document identifier for derived copies. PDF reading position, page bookmarks and the identifier of the last opened PDF are also saved. A shared website link saves its address; it does not automatically download the website. Opening that link visits the website in your browser.

On iOS, the main app, Share extension and Widgets extension share an app-group container. The Safari extension does not share this document container. On Mac, the default document library is kept in the app’s sandbox. Mac builds with Storage Settings can instead use a folder you choose. Terms Agent saves a local security-scoped bookmark to reopen that folder; this grants access to the chosen library, not unrelated folders. Changing location copies the library and reading progress and keeps the original copy. Deleting a document in the active library does not delete copies retained at previous locations. Completed scan recovery drafts and location preferences remain in local app storage. On iOS, scan drafts are inside the default library folder. On Mac, the scanner continues to use its default app-local scan folder even when you choose a custom library. Publication recovery copies stay with the active publication library. These native libraries are separate from each other and from the browser extension’s Saved and Cards collections. There is no automatic cross-device library sync. The app marks its default library and scan-draft directories as excluded from operating-system backups; export any copies you want to keep elsewhere. User-chosen library folders, source files and exports remain subject to their storage provider and backup settings. A cloud-backed folder may upload its contents through that provider. Terms Agent does not provide simultaneous library use across multiple Macs.

The app reads files you select or share; it does not request access to unrelated folders, your contacts or microphone, or broad access to your photo library. On iOS, saved document and draft files use file protection that restricts access while the device is locked. The Mac app uses its sandbox. These protections do not replace your device’s security or protect copies you deliberately export.

PDF search, page tools, annotations, typed text, signatures and form filling operate on your device. Saving an edited PDF to the library creates a separate copy, retaining the original. Form values, annotations and signatures can be part of that saved or exported PDF. A document password is used to unlock the PDF for the current session and is not saved by Terms Agent. A new PDF copy may not retain the original password protection; the app warns before making such a copy. Recent undo and redo states stay in memory for the open PDF; they are not stored as a separate history file. In builds with export options, you can choose an editable, flattened, smaller or searchable PDF, plain text, or text with recognition. These new exports do not add password protection; share the unchanged original file from the library to preserve its existing protection. Flattening makes visible marks and form answers part of the page; it is not redaction and does not remove underlying text. Plain-text export uses embedded page text, omits form answers and images, and does not perform OCR. The separate text-recognition exports use on-device Vision for up to 30 pages. Searchable PDF creates a flattened page-image copy with an invisible recognized-text layer; recognized wording is saved inside that exported file. Text with recognition uses embedded text where available and recognizes image-only pages. Recognition can make mistakes or miss words; review the exported copy. These exports do not alter the original, and no recognition data is sent to a service. Image optimization can reduce detail. Rewriting a digitally signed PDF can invalidate signature verification, so keep the original. PDFs with embedded attachments or attachment structures the app cannot safely verify cannot be rewritten as editable or smaller copies. Share the unchanged original from the library to retain its attached files. Flattened, searchable and text outputs exclude embedded attachments; review the format notices before exporting.

In builds with PDF editing recovery, confirmed changes to an eligible PDF are periodically kept in a separate local file. It contains the edited PDF, including its annotations and form answers, original document details and identifier, fingerprints of original and recovery bytes, a recovery token and writer generation, revision, captured time, current page and bookmarks. Recovery pauses while a native PDF text input is active or a document tool has pending input; unconfirmed fields and active composition are not represented as a safe checkpoint. Encrypted, digitally signed and permission-restricted source or working PDFs are excluded from automatic recovery, as are PDFs with embedded attachments or attachment structures the app cannot safely verify. Copies are limited to 20 MiB of PDF data each, ten records and 128 MiB total encoded recovery storage. Recovery capacity and write failures are visible. Where available, Keep recovery and close verifies a fresh local checkpoint of confirmed edits before closing and retains it for later review; it does not overwrite the original or save a portable editable document. If verification fails or input is still pending, the PDF stays open. Review shows the recovered PDF and whether its original is available or changed. Save recovered copy checks editable-form safety, saves a separate document, then clears only the reviewed recovery if it still matches. If that recovery changed or could not be cleared, it is retained and a warning is shown. Save flattened print copy instead saves fixed answers in a separate PDF and retains the original and recovery; the fixed answers are not editable form fields. Saving the working PDF as a library copy, Undo to a clean document and explicit discard clear only session-owned recovery records; obsolete queued work cannot recreate a discarded copy. Quick PDF creation uses a separate draft recovery flow. Recovery does not preserve every keystroke, override PDF permissions or guarantee background completion.

Wording comparison reads the current PDF and another PDF you choose. It compares selectable page text on this device, including case, numbers and punctuation, while ignoring spacing and page breaks. Images, layout, annotations and form answers are outside the comparison. Coverage notices identify pages without selectable text. Results remain in the comparison view and are not automatically saved, uploaded or used to change either file. Page-finishing tools can crop the visible page area and add editable page numbers or a gray text watermark. Cropping retains hidden content and is not redaction; watermarks are visible labels, not access controls. Save a separate copy to keep these changes.

In builds with Quick PDF draft recovery, confirmed title, text, header, footer, template and formatting choices are periodically kept in the active library. A record contains their exact encoded bytes and fingerprint, draft and writer identifiers, a token, generation and captured time. It does not contain generated PDF or preview bytes. Recovery pauses during native text entry; unfinished composition is not treated as safely stored writing. Incomplete titles or template/body combinations can be recovered even when they cannot yet generate a PDF. Records are limited to ten drafts, 2 MiB each and 8 MiB total, with 160,000 combined UTF-16 text units and 4,000 each for title, header and footer. PDF generation retains its lower 80,000-unit limit. Review a kept draft before restoring it; confirmed current work is kept separately before restoration. Where available, Keep recovery and close verifies a current checkpoint of confirmed writing and formatting before closing the composer. It does not save a finished PDF. If input is unfinished, storage fails or the draft changes during that check, the composer stays open. Save and explicit discard clear only the matching recovery, and storage errors are shown. Interruption may leave an older checkpoint and recovery cannot guarantee every keystroke or OS background time. Draft recovery stays local and moves with the active library; no service receives it. Preview creates a fixed-layout PDF with selectable text; Save to library stores that PDF and Share or Print passes a prepared copy to the system. New PDFs use the title you enter and Terms Agent as the creator. The native PDF writer may add standard producer and date fields. Terms Agent does not add your account name, device user name, source file paths or hidden draft settings to the PDF metadata. Titles, headers, footers and document text that you enter are part of the resulting document as applicable. This is not a metadata-cleaning feature for imported PDFs. Formatting controls change placed text boxes; they do not rewrite embedded text in an imported page.

In builds with Publications, manuscripts are saved as editable local projects with chapter text and order, included-chapter choices, publication details and design settings. A project may retain up to ten previous saved versions within its storage limit; older versions are removed as needed to keep the complete project file bounded. Reading preferences, the current chapter, chapter bookmarks and optional paragraph-level positions are saved separately in the same active library. A reading position contains a paragraph number and a fingerprint of the chapter wording. It is used only while that wording still matches; it does not promise exact line or pixel placement. Changed, excluded or removed chapters do not use stale positions. In builds with publication Recently Deleted, deleting a publication hides it from the active shelf while retaining its source, saved versions, reading preferences, images and associated recovery copy. Restore returns the retained publication. Only a separately confirmed permanent deletion removes those retained files; prepared editions already saved, shared or exported remain separate. Deleted publications still count toward storage limits. Library-folder moves on Mac copy publication sources and reading preferences along with saved documents, retaining the previous library copy. Author, publisher, rights and other publication details are supplied by you and may appear in the visible publication or exported metadata. PDF, EPUB and HTML editions use included chapters; editable source exports also contain excluded chapters and draft details. Source exports do not include the saved-version history or reading preferences. Importing a source package creates a separate project. Preparing a publication also keeps a temporary output filename, preparation time and file details for review. The filename is separate from the manuscript title and exported metadata. Preflight shows actual PDF page dimensions, size and common metadata, or the captured fields supplied to other export formats; it does not remove metadata, certify printing or send a file until you choose a handoff. The Publications workspace has no built-in GPT account sign-in, hosted agent connection or automated website or mailing-list publishing. Mac builds may offer the explicit local MCP connection described below.

In builds with publication recovery, the app periodically keeps the confirmed open manuscript in a separate local recovery file. This includes its text, publication details, formatting, layout, locks, retained images and excluded content. The recovery record also contains an identifier, writer generation, captured time and, for an existing publication, its saved revision and a fingerprint of that source. It is not a new saved version or prepared edition. Unapplied inspector fields and active native marked text are not stored as committed recovery text. The workspace shows the last successful recovery time or a persistence error. Recover opens a separately persisted draft for review; explicit Save or Discard clears only the matching recovery. Up to 20 recovery copies and 128 MiB total are retained within individual project limits; at capacity, new recovery can fail without removing older copies. Interruption may leave an older successful copy, and no recovery of every keystroke is promised. This recovery feature applies to publication manuscripts; eligible PDF editing has its separate recovery copies. Quick PDF creation has its separate options-only draft recovery; an explicit Save creates its library PDF.

User-requested library backups contain active and deleted saved documents, active and deleted publication sources and retained versions, publication recovery drafts, retained images, PDF editing recovery copies, Quick PDF creation recovery drafts and reading choices. A validated ScanDrafts folder is included when it is inside that library, retaining any completed scan PDF and its actual session status. A Mac custom library may omit the scanner’s current app-local draft; save a completed scan to the library before backing up. Transient editor fields, document passwords and PDF undo/redo history are not included. Recovery in the backup represents each last successful confirmed checkpoint, not all current input or generated Quick PDF previews. Backups are ordinary local folders without an added backup password. Choose a private destination; its provider may synchronize or back it up. Restore validates the selected folder and creates a separate copy without replacing an existing destination or modifying the selected backup. On Mac, a successful restore opens a newly created library and keeps the previous library. Restored scan files are preserved in the folder but are not automatically attached to the Mac scanner; a completed scan.pdf can be imported as a document. On iPhone and iPad, Restore a copy to Files exports a separate restored folder; it does not replace or merge the active app library. The app does not automatically schedule backups, synchronize libraries or recall copies after deletion.

In builds with Edits, you can copy an editing brief for the chapter you choose, then paste or import a proposed response. The brief includes that chapter, its figure captions and alternative text, names and dimensions of its images, the publication title and summary, design settings and relevant edit locks; it does not include image pixels, other chapter text or your author, publisher or rights details. You can explicitly enable inclusion of the whole image library’s names, identifiers, dimensions and fingerprints as replacement options; that setting does not include image pixels or other chapters’ captions. Copying uses the system clipboard, which is controlled by you and the operating system. Terms Agent does not automatically send the brief or connect to an agent account. Imported source labels are supplied text, not verified provider identities. Proposal responses, review choices and edit queues remain in the open session. You choose whether to apply selected changes or start a visible, pausable queue; queued edits change only the open draft until you save it. Passages, chapter text or titles, publication details and design settings can be protected from proposed edits. These locks are saved with the manuscript, retained versions and editable source copies; they do not prevent your own direct edits or protect exported files from changes in other apps. In builds with images, a figure lock protects one placement’s image choice, caption, alternative text, width, alignment, position and inclusion. An image-asset lock protects all its uses, including replacements or hiding. Surrounding text can still reflow. Changing protection requires a fresh proposal. No queue sends, publishes or distributes a document.

In builds with publication images, you choose local JPEG, PNG or HEIC files or, on iOS, select images with the system Photos picker. The Photos picker provides only the items you select; it does not grant Terms Agent broad Photo Library access. A storage or Photos provider may download a selected cloud-backed item under its own settings. Terms Agent reads and normalizes each selected image on the device, applies orientation, bounds its dimensions and re-encodes its pixels without the original image metadata. The original file remains unchanged. The image’s display name initially comes from the chosen filename, or a generic name for a Photos selection. Normalized image bytes, reusable asset identities, figure placement, captions, alternative text and protection are part of the saved manuscript and may remain in retained versions after removal from the current draft. Editable source exports contain the entire image library, including unused images and excluded figures. Reader editions contain images used by included figures in included chapters; EPUB and HTML carry entered alternative text. Images are not uploaded, analyzed by a remote agent or used for training by this feature. Thumbnails are cached in memory for display.

In builds with writing and table import, the app reads the clipboard only when you choose Paste, or reads a text, Markdown, CSV or TSV file you select. Preview and conversion happen on the device; adding the resulting chapter or table makes it part of the current manuscript and its normal save, recovery and export flows. Markdown links retain their supplied destination as text without visiting it. Imported tables contain literal cell text; formulas are not executed. These imports do not authorize AI access, and a manual content change requires a new document review before AI access.

Manual publication tools run on the device. Find and replace reads chapter bodies in the current chapter or whole manuscript, including draft-only chapters, and changes only the wording you choose after preview. Search terms, navigation requests and outline views stay on the device; titles, table cells, captions and references use their own editors. Recent tool Undo and Redo states stay in memory for the open manuscript and cannot overwrite a newer source state. Chapter and figure duplication keep their image references and remap their protection. Image adjustments render a new local image for the selected placement; the original asset stays in the project library, retained versions and editable-source exports unless explicitly removed where permitted. Cropping does not remove that original from the project. Adjustment previews and uncommitted recipes are session-only; saving persists the resulting image bytes and placement. No account, model call or remote image service is used by these manual tools.

Rich publication formatting is stored with the editable manuscript: selected-text styles, headings and list styles, paragraph alignment and page breaks, table captions/cells/header settings, and page layout including entered running header/footer text. These tools operate locally. Source exports include this formatting, all tables including excluded ones, and other retained project content; reader editions use included content. Native editor composition and unapplied table/page settings stay in the open session until applied. Save draft persists accepted changes. Older source versions are rejected if they claim to contain unsupported newer formatting, rather than silently removing it. Formatted chapters and tables use manual editing; the existing editing-brief exchange does not support them.

Reusable paragraph styles store their names and formatting in the local publication. Applying a style copies that formatting; later changes to the saved style do not rewrite earlier paragraphs. Publication templates are separate local manuscript copies in the active library. Saving a template includes the current text, publication details, styles, layout, protection, excluded content and unused images; using it starts another independent draft. Templates share the publication storage and retention limits and move with the Mac library. Image/table layout preferences are retained in saved drafts, versions and editable-source exports. These features do not contact a provider or publish content online.

Cover design and references are part of the local publication. Cover settings can refer to an image already in the project and retain entered descriptions, credits and eyebrow text. Source records retain the title, author, year, publisher and URL you enter; adding or viewing a source record does not fetch or verify its contents. Paragraph notes retain their text, source reference, locator and inclusion choice. Reader editions use included notes and their cited sources; editable source and templates also contain excluded notes and unused source records. PDF page previews are prepared locally from the current applied draft, with temporary thumbnail caches; they do not upload the manuscript. Saved versions can retain earlier cover, note and source details.

Web, audio and video sources remain external links. Choosing Open source passes the selected URL to your browser. Choosing a direct-media preview lets the native player retrieve the selected media URL; playback starts only when you press Play. The source host and any service it redirects to may receive your IP address and ordinary request information under their own policies. Terms Agent does not attach manuscript, note or library content to these requests. Playback pauses when the app becomes inactive and does not resume automatically. Closing the preview stops its player. Exports contain source links, not embedded audio or video files; opening those links in a receiving app can contact the source service. No remote preview is loaded merely by adding a source or opening a publication.

Section names, chapter-boundary settings, header/footer templates, numbering choices and contents labels are stored with the local manuscript. Fields such as title, chapter, section and page are expanded locally when preparing a PDF; they do not fetch data. Excluding a chapter hides its body from reader editions but can leave its section name and settings active for following included chapters. Editable source, templates and retained saved versions preserve these settings and excluded boundaries. Removing a contents entry changes navigation presentation, not whether the chapter is exported.

Column counts and gaps, image-wrap side and spacing, paragraph keep and break choices, binding gutters and mirrored margins are local publication design settings. They are retained in drafts, templates, saved versions and editable-source exports. A prepared PDF captures the applied settings at preparation time; changing the draft requires preparing another edition. Interface colors do not rewrite document colors. These controls do not upload content or access a printer until you choose an export or print action.

Live publication page editing prepares page images and source-position geometry locally from the open draft. These maps, bounded thumbnail caches, active selections and provisional typing or marked-text displays stay in the open session; they are not new saved project fields. Draft-only display labels or temporarily visible excluded chapters do not change the saved manuscript or the included edition. Save draft persists accepted changes; sharing or printing still requires preparing an edition. The live page editor does not send writing or images to a service or add new file, camera or network permissions.

Publication Page Setup stores chosen paper presets or custom dimensions, orientation, margins, spacing, columns and binding choices with the local manuscript. Drafts, retained versions, templates and editable-source exports can contain these settings. Display units belong to the open setup sheet; saved measurements use PDF points. Cancel discards unapplied setup changes. Applying changes updates the open draft and local page layout; Save draft persists them. This does not configure a printer, contact a service or publish the manuscript.

Publication page actions use the current local page layout to identify complete manuscript paragraphs on the pages you select. Physical page selections, target excerpts, captured source/layout previews and the single/facing-page display mode remain in the open editing session. Applying an action changes existing paragraph-formatting fields in the open draft, with guarded session Undo; Save draft persists those accepted changes and retained versions may keep earlier formatting. Page selection can affect a whole paragraph that continues onto an unselected page. These actions do not upload, remotely process or distribute the manuscript.

In builds with Recently Deleted, deleting a saved document moves its library record and reading state into Recently Deleted and removes it from the active library and widget summary. Its bytes, title, source details, favorites and collection remain on the device until you explicitly confirm permanent deletion; there is no timed automatic purge. Restore returns that saved copy and its reading state. Permanent deletion removes that copy and its retained reading state, but does not remove the original imported file, separately saved edited copies, browser Saved or Cards data, prior library locations, backups, or exports already handed to another app. Publication Recently Deleted is managed separately from saved documents and retains an associated publication recovery copy until the publication is restored or permanently deleted. PDF recovery copies are separately reviewed and discarded; deleting their original saved document does not remove that independent recovery. Do not rely on uninstalling a Mac app to erase its support data; review retained copies and recovery drafts in the app first.

Local agent connections on Mac

New and existing publications are blocked from AI access until you review the complete document and explicitly allow AI. Marking a publication Sensitive keeps its text, titles, metadata, images, editing briefs and proposal tools unavailable to the Terms Agent AI connection. This is a document-wide restriction, including excluded chapters and retained assets; it is separate from edit locks. The app stores the classification and a review generation locally alongside the publication. Approval is tied to the exact reviewed content. Changed content needs another review; returning to the exact previously reviewed content can retain approval only while the same review remains unrevoked. A verified proposal result can continue only within the same unrevoked review. Marking Sensitive or blocking AI ends the active connection and Auto session, clears pending review state and removes the connection’s shared context and queued exchange content when the app can safely access it. Older connection formats are refused by the updated helper. Imported sources and restored copies cannot grant AI approval, and a Sensitive classification is retained. Saved document files are not exposed by this connection; their Sensitive labels are retained in edited copies and library backups.

Sensitive mode controls Terms Agent’s AI connection and proposal features. It does not identify all sensitive information automatically, encrypt exported files, prevent your own manual sharing, or restrict another app with independent file or screen access. It cannot recall content an agent or storage provider already copied. Review the entire document, including images and excluded material, before allowing AI; if you are unsure, leave AI blocked.

In Mac builds with Connect an agent, you can share a snapshot of the selected publication chapter with a desktop app that supports local Model Context Protocol (MCP) servers. This is off until you choose a connection folder and share the chapter. The snapshot can include unsaved wording, the chapter title, figure captions and alternative text, relevant chapter and image-asset protections, publication and chapter identifiers, the saved revision and a source fingerprint. It does not include other chapters, image pixels, author or rights fields, saved versions, reading history, or the document library path. Protected wording in the shared chapter is still readable; edit locks restrict proposed changes, not disclosure.

Terms Agent creates a dedicated local exchange folder inside the folder you choose. It contains the shared snapshot, connection and snapshot identifiers, permissions, expiry and heartbeat times, and any submitted proposals, review status, request identifiers and retry fingerprints. Session status also records whether the shared context is available and continuous Auto is enabled. A proposal can contain original wording, replacement wording, explanations and an unverified source label supplied by the agent. The app creates private files, but does not encrypt this exchange folder. A cloud-backed or backed-up destination may copy its contents under that provider’s settings. Choose a local private folder if you do not want that behavior.

You copy an MCP configuration and add it to your chosen desktop agent. That client starts the bundled local helper with an installed Node.js 24 or later runtime and the exchange-folder path. The helper communicates through local process input and output; it does not open a network listener or contact a Terms Agent service. Your chosen agent may transmit shared content to its own provider under that app’s settings and policies. Terms Agent does not sign in to that provider, install a runtime, change the client’s settings or control the agent’s retained copies. This connection does not provide remote iPhone, iPad or web-agent access.

Reading is the default permission. You can separately allow edit proposals for review. The helper may read the shared context, submit a bounded proposal and check its status; it cannot directly apply changes, grant continuous Auto permission, save, export, publish, change locks or read arbitrary files. Terms Agent validates the chapter scope, source revision and protections before review and each draft change. Manual review is the default: you choose when to start a visible, pausable queue. You can separately choose Start continuous Auto for the current shared chapter. That authorizes the native app to admit one incoming proposal at a time, run its visible ordered queue, and share the verified resulting snapshot of that same chapter after the whole proposal completes, including its unsaved wording. This grant does not share other chapters or add image pixels. Rich chapter wording can be read, but body replacements are limited to plain-text chapters so formatting, tables and references are not silently removed. All applied changes remain in the open draft until you save it.

A connection expires after 30 minutes. Neither an explicit refresh nor a verified continuous-Auto refresh extends that lifetime. A manual content change invalidates AI review and ends the connection. Review the changed document before connecting again. During a verified proposal, shared-context reads and new submissions remain paused until the current proposal completes; status and receipts stay readable only while the reviewed permission and fresh heartbeat remain valid. Stop, manual intervention, leaving the review, changing chapters or backgrounding ends continuous Auto; it does not resume automatically. The ordinary connection can remain open with its existing permissions, and stale context may still require an explicit refresh. Terms Agent does not wake GPT or start an external model turn, and Auto does not save, publish, send or run edits in the background. Closing the publication, quitting normally or choosing Disconnect ends the connection. The helper also refuses access after its app heartbeat is more than 15 seconds old, so interruption or suspension can make the connection unavailable. Disconnect or expiry removes the shared context when the app can safely do so and leaves an inactive session record. Consumed proposal files are removed; bounded response records and unprocessed proposals may remain in the chosen exchange folder, especially after an interruption. After disconnecting, you can remove that dedicated exchange folder. Disconnect cannot recall content already read or copied by an agent or storage provider.

Camera scans and draft recovery

Camera access is requested when you start scanning on a supported iPhone or iPad. Apple’s document scanner provides capture, page-corner adjustment and appearance controls. After you finish capture, Terms Agent prepares the PDF on your device and keeps a recovery draft until you save it to the library or explicitly discard it. That draft contains the scanned PDF plus a session identifier, status, timestamps and known page count. The app remembers your scan-quality preference locally. App appearance and PDF paper appearance preferences are also stored on this device. Dark paper changes displayed colors only; it does not change saved, shared or printed document colors.

An unfinished iOS camera session is not a saved scan. If the app is closed before the system scanner returns its pages, those unfinished pages cannot be recovered. A completed recovery draft can be reopened when available. The app does not continue camera capture in the background or promise uninterrupted processing after you leave it.

On Mac, choosing Scan uses Apple’s Continuity Camera to receive a scan or photo from a compatible nearby iPhone or iPad. Apple’s device pairing and transfer requirements apply. Terms Agent keeps the received capture and recovery draft locally on the Mac; it does not upload the capture through a Terms Agent server or synchronize the phone’s Terms Agent library. The app does not change your device accounts, Wi-Fi or Bluetooth settings.

Local document explanations

When you ask for explanations, Terms Agent extracts PDF text and may recognize image text with Apple’s on-device Vision framework. It then uses bundled phrase-matching rules, including the reader’s local analysis code, to identify passages. Document text, recognized text and explanations are not uploaded or synced, sent to an AI service, or used by Terms Agent to train AI models. Analysis results are kept in memory for the open workspace rather than saved as a separate analysis history.

Recognition and explanations can miss wording or context. Analysis is bounded to the first 100 pages, up to 50 image-text recognition attempts and 80,000 characters; a selected-text explanation is limited to 6,000 characters. The app identifies limits and recognized-text sources. This does not add a searchable OCR text layer to the original PDF. Check the original document before relying on a result.

Widgets, Live Activities and shortcuts

The iOS library widget uses saved-document, PDF and favorite counts plus a document identifier for its Continue reading link. The snapshot contains no document names, page text, annotations or form values. Counts may be visible where you place the widget, subject to your device’s privacy settings.

Scan Live Activities show operational status, timestamps, a session identifier and a known page count when available. They do not include document names, images or recognized wording. Live Activities can appear on the Lock Screen or Dynamic Island according to your system settings; they do not keep the camera running in the background. Quick actions, widgets, Shortcuts and Action button shortcuts open the relevant app workflow. They do not silently scan or share documents. Remove widgets or manage Live Activities in your device settings if you do not want these surfaces displayed.

Sharing, exporting and printing documents

The native apps offer system share, export and print controls for the item you choose. A temporary copy may be created to hand the document to the system; the app attempts to remove that copy when the share flow finishes or is cancelled. Temporary files left after an interrupted process remain subject to operating-system cleanup. Selecting a destination such as Mail, Files, AirDrop or a printer can pass your document, including its form entries or annotations, to that destination under its own settings and policies. Terms Agent does not choose a recipient or automatically send mail. Review the destination and document before completing the system action.

Files you export to a cloud-backed folder may be uploaded by that storage service. Removing a library item or recovery draft does not recall copies already shared, printed or exported. Keep sensitive documents only on destinations you intend to use.

Safari reading on iPhone and iPad

On iPhone and iPad, opening the Safari extension reads the current website’s text, title, address and selected wording to produce topic explanations on your device. Page wording and results stay in the open popup’s memory and are discarded when it closes; they are not saved, uploaded or synced. This extension does not retrieve linked policies or provide the desktop Saved and Cards collections. The cookie-notice preference is stored locally in Safari, and Safari manages website permissions.

Browser reading features

The following sections describe the desktop browser reader where those features are available. Browser extension data is separate from the native document library.

Reading a page

When you open Terms Agent on a page, it reads the page text, address, headings, and policy links to find documents and explain matching passages. The site card shows the website and document being read. Analysis uses phrase matching on your device. Policy text and explanations are not uploaded or synced, sent to an AI service, or used by Terms Agent to train AI models. This version does not save decisions or create receipts.

When you open the reader, it also requests up to three directly linked HTML policies from the same origin, without cookies or referrers. These requests have page-size and time limits and do not follow redirects or crawl further links. The website receives ordinary network information, including your IP address. Linked policy text and results stay in the open reader’s memory, are reused during that reader session, and are discarded when it closes, unless you explicitly save a passage as described below. Unread documents remain available as links.

Passages you choose to save

Ordinary reading and Explain selected text do not save policy wording. When you choose Save passage, Save selected text or Save displayed text, Terms Agent keeps that wording with its source page title, address and saved date in extension storage in your browser profile. Saving displayed text keeps the text shown in the source reading panel; the panel identifies when it shows a shortened source. The local Saved page opens only when you choose it. Saved passages remain available after the reader, tab or browser session closes, until you remove them. The Saved collection can also keep a readable page snapshot when you choose Save page. It may retain available author, site name and publication date, your access date, and a browser-session identifier and label for grouping saved items. It keeps readable text, not an original page file or linked documents. At most 50 saved pages or passages of up to 250,000 characters each can be kept, within a 1,000,000-character total. Terms Agent does not upload or sync saved passages.

On the Saved page, Remove deletes an individual passage. Clear all deletes the saved collection after an inline confirmation. These actions delete saved passages from this browser profile only; they preserve settings, temporary reading context, older extension data and browser history.

Cards in the desktop browser reader

Where Cards is available and enabled, you can preview an agreement from a chosen PDF, HTML or text file, pasted wording, a Saved item or a Terms Agent JSON backup. Files are read locally. HTML is treated as text and PDFs use the bundled PDF.js reader; imported scripts and linked page resources are not loaded. The Cards collection saves extracted text rather than the original PDF or HTML file, its images or layout.

Choosing Save or Import retains the document text, title, source address if supplied, filename where available, format, source date and language when available, saved date, warnings and capture or retrieval details. Your card names group those documents. No card numbers, credentials or transaction history are requested. Do not include private account details you do not want retained. Limits are 25 cards, eight documents per card, 250,000 characters per document and 1,000,000 characters total. Imported files are limited to 10 MiB and PDFs to 100 pages.

A deliberate Review in Cards action can stage readable page wording and source details in temporary extension session storage for a preview. At most four captures are retained. A preview is valid for 30 minutes; expired captures are deleted on their next access or when another capture is staged, and older captures are removed as new ones arrive. Saving or discarding a preview removes that staged capture. Clearing the browser or extension session storage removes remaining captures. They do not enter the saved Cards collection until you save them.

Choosing Review link requests browser permission for the selected HTTPS site before retrieving that public HTML, text or PDF document directly. The site receives the request, your IP address and ordinary browser network information. Requests omit sign-in cookies and referrers, do not follow redirects and are limited to 10 MiB and 45 seconds. Merely prefilling a link does not retrieve it. Website permission can remain until removed in your browser settings. Terms Agent does not proxy the file through its servers.

Remove document or Remove card asks for confirmation and deletes the selected local data. Removing the last document removes its empty card. Export can download full text and attribution in a Markdown report, a CSV comparison or a JSON backup according to your chosen scope. JSON import merges valid entries without replacing the existing collection. These actions do not automatically email or share the files. Disabling Cards hides the workspace and clears its temporary preview but preserves saved agreements. Deleting Cards data preserves Saved pages and passages, preferences, and copies exported elsewhere.

Output you choose

Copy selected writes the passages you select, with their source attribution, to your clipboard. If clipboard access is unavailable, the Saved page offers text you can copy manually. Email selected passes the selected output to your configured email application through a mailto link. It does not set a recipient or send an email. Output that is too large for an email link can be copied instead.

Your operating system, clipboard tools and email application handle exported copies under their own settings and policies. Removing passages or clearing the saved collection in Terms Agent does not remove copies already exported elsewhere. Opening a saved source link is ordinary browser navigation to that website.

Preferences on your device

“Topics to show first” in Welcome and Settings lets you pin topics so matching explanations appear first. Payments and renewals, Who gets your data, and AI training start selected when no topic preferences have been saved. You can unpin any or all of them. Existing saved selections are preserved.

Pins only change the order of explanations. Selecting a topic, including AI training, does not give a website consent or change how it uses your data. Topic changes are saved on this device and are not shared with websites or synced between devices.

Your optional cookie-notice preference stays in your browser. Safari follows your system appearance; Chrome also stores appearance preferences locally. Completing Welcome saves the completion time and extension version locally. The selected citation format and whether Cards is enabled are also local browser preferences. These settings remain until changed or the extension’s local data is removed.

Temporary reading context

Policy addresses, document titles, related links, reading status, language, and known policy dates are kept temporarily in browser session storage to support navigation. These policy lists contain no policy text, expire from use after 24 hours, and are removed when their tab or browser session ends. To support a source-page handoff, Terms Agent also temporarily keeps the source address, requested destination, verified destination when available, navigation status and timestamps. Navigation requests and this handoff context expire from use after five minutes and are removed when their tab or browser session ends. Unrelated navigation clears the handoff context.

To return you to the same place after viewing a source, Terms Agent temporarily keeps the document address, expanded topics, source indexes, open sections, scroll position and a limited keyboard-focus identifier in browser session storage. These reading positions contain no policy or selected text and are not uploaded or synced. Positions are scoped to each tab and document, limited to eight documents per tab, ignored after 30 minutes, and removed when their tab or browser session ends. This temporary metadata is separate from passages you explicitly save.

Optional cookie-notice hiding

You can enable “Hide cookie notices” in Welcome or Settings. This feature is off by default. Your browser asks for access to HTTP and HTTPS websites so Terms Agent can detect and hide common notices locally while you browse. It does not transmit banner content or browsing history, accept or reject cookies, or block advertisements or tracking.

Turning the feature off stops notice hiding and restores notices it hid on open pages. Website permission remains granted until you remove it in your browser’s extension settings. Revoking that permission also stops notice hiding.

Connections and information use

The native apps and current browser reader do not contact a Terms Agent server for analysis or library storage. They have no account sign-in or built-in analytics or telemetry. If you use a TestFlight beta, Apple can collect beta feedback, usage information and crash reports under its TestFlight terms and privacy practices; that is separate from app document analysis. Opening a policy, the Privacy Policy, or a support link navigates your browser to that website, which receives ordinary network information, including your IP address, under its own practices. Information you choose to send through support is handled through that support service.

We use information to provide the features described here. We do not sell it or use it for advertising or unrelated profiling. Our use of Chrome API data follows the Chrome Web Store User Data Policy, including Limited Use requirements.

Your control

You can change pinned topics in Welcome or Settings and change notice hiding in Settings. Chrome also provides appearance controls; Safari follows the system appearance. Data saved by older versions, including decisions, source excerpts, and remembered website choices, stays in your browser but is no longer used by the reader. If present, you can delete old decisions and remembered choices together under “Data from older versions” in Settings. Your current topic, appearance, and cookie-notice preferences are kept. Removing the extension clears its local data according to your browser’s behaviour.

Questions or older accounts?

Contact termsagent@gmail.com for support or privacy questions. If you used an earlier account-enabled version, deleting local data does not erase previously synced server data; contact support to request deletion.

We’ll update this policy when our data practices change.

Previous account-enabled policy

Archived policy for versions 0.12.2 and 0.12.3

Archived policy for the earlier 0.12.4 browser reader