Straza mobile app privacy policy

This policy covers the Straza mobile app for Android (Google Play, F-Droid, and direct APK) and iOS (App Store), published by SynapTech s.r.o., Slovakia ("we", "us"). Contact: engineering@straza.ai.

Straza is a companion app to a self-hosted Straza server operated by you or your organization. The app is where a human approves or denies an AI agent's tool calls.

The short version

• We collect nothing. The app has no analytics, no trackers, no ads, no crash reporting, and no accounts with us.
• The app communicates only with the Straza server you enrolled against. We do not operate that server and cannot see that traffic. The one exception is optional push delivery: if your organization uses the Straza push relay, we forward its notifications and see delivery metadata, never request content (see "The Straza push relay" below).
• Push notifications are optional. The app asks before enabling them, you can change your choice in settings at any time, and without them the app checks the server for pending approvals itself.
• Push notifications never carry request content, only an opaque reference id.

What the app stores on your device

• Your enrollment: the server addresses, a device credential, and app settings, kept in the platform's protected storage (Android Keystore-backed storage, iOS Keychain).
• A signing key generated inside your device's secure hardware (StrongBox or TEE on Android, Secure Enclave on iOS). The private key is non-exportable by design and is excluded from backups.

Unenrolling in the app removes this data. Your administrator can also revoke the device on the server at any time, which invalidates the enrollment immediately regardless of what remains on the device.

What the app sends, and where

Everything below goes only to the Straza server you enrolled against, over TLS with certificate pinning:

• At enrollment: the device platform and model name, the public half of the device signing key, the key's hardware security level, and, where the platform provides one, a hardware attestation statement.
• A push route (a token or endpoint) so the server can notify this device. If your organization uses the Straza push relay, its server passes this route on to the relay for delivery.
• Your approve and deny decisions, signed on the device.
• Requests to display pending approvals and your activity history.

Apart from the push relay case described below, we receive none of this. Under data protection law (for example the GDPR), the organization operating the server is the controller of that data; ask them about retention and access.

You can export your activity history as a CSV file through the system share sheet. Where that file goes is your choice.

Push notifications

Notification payloads contain a version number, an opaque request reference, and a hint of which screen to open. Never the tool, the command, the requester, or any request content.

Push is opt-in: the app asks when you first start it, and you can change your choice in settings at any time. If you decline, the app polls the server for pending approvals instead.

The transport depends on the build:

• Google Play build: Google's Firebase Cloud Messaging. Depending on how your organization configured its server, delivery uses either your organization's own Firebase project or the Straza push relay (below).
• F-Droid and direct-APK build: a UnifiedPush distributor you choose (for example ntfy, including a self-hosted one), or no push at all, in which case the app polls the server.
• iOS: the Apple Push Notification service. Apple lets only the app's publisher send these, so a self-hosted server can reach iOS devices only through the Straza push relay (below).

The transport provider can see that a notification reached your device, never what the request was.

The Straza push relay

The relay is a delivery service we (SynapTech) operate so that self-hosted Straza servers can send push notifications to phones without holding their own push credentials. It is offered as the default for new deployments; organizations can instead configure their own Firebase project (Android), a UnifiedPush distributor, or no push at all.

Your phone never connects to the relay. When your organization's server uses it, the server sends the relay a delivery request and the relay forwards it to Apple or Google. For each notification the relay processes: the deployment's relay credential, the sending server's IP address, your device's push token, the opaque reference envelope described above, and an expiry time. It never receives the tool, the command, the requester, your decision, or any request content.

The relay keeps short-lived operational logs for reliability and abuse prevention only. No third-party analytics, no advertising, and none of it is sold or shared.

Permissions

• Camera: used only while scanning the enrollment QR code; images are processed on the device and never stored or sent.
• Notifications: to alert you to pending approvals.
• Biometrics or device unlock: gates the approve action. Biometric data is handled by the operating system and never leaves your device.

Accounts

The app does not create accounts. Your approver identity is created and managed by your organization's Straza administrator on its own server. Removing a device is immediate: unenroll in the app, or have your administrator revoke it.

Deleting your data

To delete everything the Straza app holds and sends:

• Unenroll in the app (each deployment's settings screen). This removes all data on the device, including the hardware-backed signing key, which is destroyed and cannot be recovered.
• Optionally, ask your server administrator to revoke the device. Revocation invalidates the enrollment immediately, even if the phone is lost or offline.

Decision history lives on the server your organization operates; that organization is the controller, so direct deletion requests for those records to them. We (SynapTech) retain nothing about you to delete, with one exception: if your organization uses the hosted push relay, its short-lived operational logs (never message content, as described above) expire automatically within days.

Children

Straza is a business tool and is not directed at children.

Changes

When our practices change we will update this page and the effective date above. Questions: engineering@straza.ai.