Station app privacy
Station runs on hardware you or your operator control. The short version: data leaves only through features that you configure, register, or use, and this page lists each of those that Station's privacy inventory records.
Last updated 11 October 2026 · Kontour AI LLC
Station is self-hosted: it runs on your own machine or on a server your operator runs, and keeps what you add to it in its own storage there. Accounts are optional, and the identifier on product-usage telemetry is a random installation value, not one derived from an account. Station uses the Kontour push gateway only for a phone you register, and the gateway forwards what it relays sealed, without the key to open it.
Everything in the next section describes a case where data does leave. Each one starts with something you or your operator chose: a model connection, an endpoint, a registered phone, a session you started. The exception is the desktop updater, which checks its release feed.
When an agent runs, Station sends your messages, supported attachments, tool results, and selected context to the model connection or engine you chose. That provider is your choice, and its own handling applies to what it receives. A local executable can still use hosted inference or external tools, and their service configuration and privacy practices apply as well.
A desktop build that includes an updater contacts its configured release feed. The inventory records that contact; it does not yet have its own entry describing what the request carries.
Every event carries a versioned event ID, the time it was produced, the privacy-inventory revision, a hashed installation identifier, and allowlisted build details: app version, platform, CPU architecture, release channel, whether the build was modified, and optionally the full Git commit with where that value came from. The events themselves are Station's startup metadata, classified session-recovery outcomes (the failure category, the recovery decision, and the result), and how each engine turn ended (the engine family, and completed, aborted, or failed).
Nothing is sent unless three things are all true: an operator has configured a telemetry endpoint, telemetry is enabled, and the in-app disclosure for the current inventory has been acknowledged. It goes to that operator-configured endpoint, and it can be disabled. The installation identifier is a random value generated once for your install and SHA-256 hashed before sending; it is never derived from an account.
Performance metrics and traces. Station starts exporting them only when an operator configures an OpenTelemetry (OTLP) endpoint, and sends them to that endpoint, which is theirs, not ours. Station attaches its random installation hash, the operating-system type, and each instrument's attributes. The OpenTelemetry SDK it pins also detects environment, process, and host attributes by default, so what is actually exported depends on those defaults and on the operator's configuration. The random installation hash alone does not make the whole payload non-identifying: review what your configuration exports before pointing it anywhere.
Until 11 August 2026 that identifier was derived from your machine's hostname and operating-system username, and this page said so. It is recorded here rather than quietly replaced, because a privacy policy that silently improves is one you cannot check.
Documents you add to Knowledge are stored through Station's configured storage. The embedding provider you select receives document chunks and your search queries; the vector store you select receives chunk text, vectors, and document metadata. Embedding choices include Amazon Bedrock, OpenAI-compatible, and Ollama endpoints. A local default does not stop a remote provider you configure from receiving that content, so review your provider settings before adding documents.
Microphone audio is captured only while you have explicitly started a voice session. The mobile app sends it over its authenticated connection to your own Station, which forwards it to the speech provider you configured. For the built-in provider, Nova Sonic, that is Amazon Bedrock. If you use a browser's own speech features instead, that browser's handling and retention are the platform's, and we cannot describe them for you. The voice adapter you select controls microphone capture and how the audio travels; nothing here certifies how every possible extension uses a device.
If you register a paired phone, Station can send it an agent-activity card: up to five sessions' titles, their project names, their status, and activity counts. A session title can contain text from your request. Before it leaves your Station, the card is encrypted with a key set up when the phone registered.
It then travels through the Kontour push gateway (push.kontourai.io, unless your operator configures another) and on to Google Firebase Cloud Messaging for Android or Apple Push Notification service for an iOS Live Activity. The gateway forwards the sealed card and does not hold the key to open it. The gateway and the push provider do not see the session titles or project names. They do see routing data: push tokens or channel IDs, the registration's identity, your Station's push-key fingerprint, the size and timing of each delivery, and transport fields such as the event and alert priority. Nothing is sent without an active registration, and your registration and notification settings decide which device receives it.
Station can also push the notifications its delivery policy selects to a registered paired phone, through the same gateway and push providers. The notification's title and body, kept to a bounded length, and its routing identities are encrypted with the same registration key. On Android the sealed payload can also carry a reference to the session and a retraction. On iOS an alert needs a separately registered alert token, and the gateway sends fixed, generic alert text chosen by the kind of notification; the real text travels only inside the sealed payload, so unless an extension on the phone opens it, iOS shows the generic text.
If you hide notification content, the title and body are removed or replaced before encryption. The gateway and the push provider still see routing data, the urgency or alert kind, and the size and timing of each message. A message the gateway sent is not proof that the phone displayed it. Removing a phone's registration stops it being chosen for future pushes; it does not recall a message already sent or shown.
Browser push is separate from phone push, and it is off in Station's standard hosted setup. Where it is on and you allow it, registering the browser as a paired device stores that browser's push subscription endpoint and encryption keys with the device. Selected notifications are encrypted for the browser's push service; hiding content replaces the title and body but keeps routing and link fields, and the push service still sees the destination, transport metadata, timing, and size. To stop it, use Station's Unsubscribe action: it removes the browser's local subscription and tries to clear the registration on your Station, which can remain until a later cleanup if that attempt fails. Turning the feature setting off only hides the controls; it does not unsubscribe a browser that is already registered.
When an operator enables local accounts, Station stores account and session information for sign-in and recovery, which can include the IP address and user-agent of the request. If the operator also configures an external (OIDC) sign-in provider, Station contacts that provider at startup for discovery and exchanges login and identity data with it when you sign in. The account, token, and session records it returns are kept in the operator's authentication store.
Used for one thing: scanning a pairing code to connect a device to your Station. Camera frames are read only while the scanner is open, they are decoded locally in the app's web view, and the decoded value is used to pair. This scanner does not send camera imagery to a Station-operated third party.
None declared. Every entry in Station's privacy inventory is declared as not used for tracking, and the iOS privacy manifest generated from it declares no tracking and lists no tracking domains. Every declared purpose is app functionality or analytics; no entry declares an advertising purpose.
Station keeps a single privacy inventory in its source. Its iOS privacy manifest, its draft Play Data Safety answers, and its generated privacy policy are all rendered from that inventory. Station's tests fail if a committed copy of any of them drifts from what the inventory renders, or if a telemetry event starts collecting a property the inventory has not reviewed.
This page is written by hand from that generated policy, and no test ties it to the inventory. What ties it is this: it was written from the policy whose fingerprint is 098fe4522c631fbe, the first 16 hex characters of the SHA-256 of Station's docs/privacy-policy.md. Hash the current file yourself: if you get a different value, the inventory has changed since this page was written.
The inventory's own caveats apply here too. Its tracking, linkage and purpose columns are declarations that people make, not conclusions the generator reaches. Its review read the source and pinned dependencies with synthetic tests; it has not exercised a real identity-provider sign-in, OpenTelemetry resource export, delivery to a real phone or browser, or a store submission. The store classifications, whether the inventory is complete, and each provider's own practices need separate review. A matching fingerprint shows this page matches that inventory, not that the inventory is a complete account of what Station collects.
One honest limitation: the site policy at /privacy/ links each statement to the source that implements it. This page does not. The generated policy linked above names the source files behind each entry, and Station's source is public under Apache-2.0, so you can follow them there.
Station's data is in its own storage on your machine or your operator's server, so deleting it is yours or your operator's to do. If you configured an endpoint that received telemetry or diagnostics, or an embedding or vector provider, that store is yours or your operator's to clear. To stop pushes to a phone, remove its registration.
Anything else — questions, a deletion request for something we hold, or a correction to this page: hello@kontourai.io.