What we store, and what never leaves your machine.

Dialout is a self-hosted control room. Most of what it touches — your source, your ports, your terminals, your AI transcripts — stays on machines you already own, because the agent runs there and dials out to the server rather than the other way round. There is no inbound port on your machine and nothing to forward.

This policy covers the hosted instance at www.dialout.dev, which is what the published iOS and Android apps connect to by default, and what IndiaNIC Infotech Ltd operates. If you run your own server, the section at the bottom is the one that applies to you.

The mobile apps talk to one host and nothing else. Every request goes to your instance over TLS — HTTPS for the API, WSS for terminals and dashboard events. There is no second endpoint, no telemetry beacon, and no third-party host contacted in the background. You can confirm the address the app is using at any time under Settings → Server.

Terminal keystrokes and output pass through the server in order to reach your browser or phone. They are not written to disk unless you have recording turned on. Encryption in transit is TLS end to end; it is not end-to-end encrypted in the sense that the server cannot read it, and claiming otherwise would be false — the server is the relay.

AI session transcripts are read on your machine by the agent, which tails the JSONL file the CLI already writes. Dialout does not send your prompts or code to any model provider. Whatever Claude Code, Codex or Grok sends is between you and that vendor under their own terms, exactly as it is when you use them in a local terminal.

Your session token is kept in the platform keystore — expo-secure-store, which is the iOS Keychain and Android EncryptedSharedPreferences. It is never written to unencrypted storage. Signing out removes it, and so does deleting the app.

Alongside it the app stores small preferences: which machine you last used, your open terminal tabs, and your theme. That is local state, not something we receive.

People you explicitly share a project with, and nobody else. A share is read-only by default; comments are allowed, terminal access is a separate switch you have to turn on yourself, and you can revoke a share at any time.

The hosted instance uses two kinds of processor and no others: a server host, and an SMTP provider that delivers the transactional mail described above. Neither is given data for any purpose of their own. We disclose data to a government or law enforcement only where a valid legal order compels it, and we will tell you unless the order forbids it.

This marketing site may load Google Tag Manager or Google Analytics 4 if the operator has configured a measurement ID; where neither is set, no Google script loads at all. That is a property of the website you are reading, not of the mobile apps — no analytics of any kind is compiled into the iOS or Android build.

You can see, correct and export your data from inside the app, and you can delete your account outright. Under the GDPR and the UK GDPR you have rights of access, rectification, erasure, restriction, portability and objection; under the CCPA and CPRA you have rights to know, delete, correct and to opt out of sale or sharing — an opt-out that is already permanent here, because there is no sale or sharing to opt out of. The lawful bases we rely on are performance of a contract (running the service you signed up for) and legitimate interest (keeping it secure).

Deletion does not need you to be able to sign in. Sign-in is email, PIN and an authenticator code, which is exactly what someone who has lost their phone cannot complete — so the deletion request form is open to anyone who can read the account’s email.

Request account deletion

Account data is kept while the account exists and is deleted within seven days of a deletion request. Terminal recordings are deleted on the retention period you choose in Settings, by a daily job. Push tokens are deleted when you turn alerts off. Deletion request records are kept for two years afterwards, because being able to prove a deletion happened is the point of having a process at all.

Backups roll off on their own schedule and can hold a copy for up to thirty days after deletion. They are not queryable and are never restored to serve a request for the deleted account.

Dialout is a developer tool for adults at work. It is not directed at children, we do not knowingly collect data from anyone under 13 (or under 16 in the UK and EEA), and an account found to belong to a child is deleted.

Then you are the data controller, not us. Your database, your logs, your backups, your jurisdiction. IndiaNIC Infotech Ltd receives nothing from a self-hosted instance — there is no phone-home, no licence check and no usage ping in the source, which is public and auditable.

The mobile apps work against a self-hosted instance: point them at your own URL in Settings → Server and no request reaches us at all.

Read the source

If we change something material — a new category of data, a new processor, a new purpose — we will email account holders before it takes effect, not after. The effective date at the top is the one that governs.