Privacy

Last updated: 12 October 2026

Who we are

VisorBot is an Android app for automating repetitive taps, swipes and typing in the apps on your own phone. This policy covers the app, this website and the VisorBot servers. Questions go to [email protected].

How VisorBot uses the Accessibility service

VisorBot uses Android's Accessibility service for one purpose: to carry out the steps of recipes you built or approved. Through it the app performs taps, swipes and typing, and reads the text and layout of the screen so a step can find its target. The app shows you this explanation and asks for your agreement before it sends you to the Accessibility setting.

Screen content read through the service is processed on your phone. It leaves the phone only in the two cases described below (AI features and cloud sync of a failed run). It is never used for advertising and never sold.

What we collect

Your account

An account is required. We store your email address, a hashed password or your Google account ID if you sign in with Google, whether your email is verified, and your plan.

Your device

When you sign in, the app sends a device identifier (the Android ID, which is unique to VisorBot on your phone), the phone model and the app version. We use them to keep your sign-in sessions apart, to count usage limits, and to stop one phone from collecting the free AI credits many times through extra accounts. They are not used for advertising.

Usage

To apply the limits of your plan we record counts: runs, builds and AI credits used per day. After a recipe runs, the app reports a short summary: a fingerprint of the recipe (not its name or content), whether it finished, how many steps ran, how long it took and the error text if it failed.

Cloud sync (Plus and Pro)

On paid plans your recipes and their target images are backed up to your account so they follow you to a new phone. Run history is synced too. When a run fails, the synced record includes the text that was on the screen at that moment and a small, low-resolution thumbnail of it, so you or the AI can see why the step failed. These stay in your account until you delete them or the account. Free accounts do not sync, and their failure screenshots stay on the phone.

When you use AI features

When you ask the AI to build or repair a recipe, the app sends the text on the screen of the app being automated to our servers, and a screenshot when vision is enabled for your account. This only happens after you agree: the app asks once, before your first AI session, and until you accept nothing is sent. That includes the mid-run AI rescue, which stays off until you have agreed. AI sessions run only when you start one.

The screen text and screenshots of a session live only in server memory. They are dropped when the session finishes, after 20 minutes of inactivity, or after 2 hours at the very most.

What we do keep from an AI session is a record of the work: the request you typed, the recipe steps that were built (including any text you asked a step to type), the name of the app, the AI model used, and token and cost counts. We also keep short text notes about what the AI learned about that app's screens (menus, popups, timings) and reusable step sequences, so your next session starts smarter. Never images. When many users meet the same patterns, those notes can be merged into a shared app profile that is not linked to any account.

We also keep the names of the buttons, tabs and other controls the app showed during the session (for example "Add alarm" or "Start"), so the shared app profiles can be checked against what the app really shows. For your account these are kept only in a scrambled form (a one-way hash) that does not store the words themselves. The words of a control are kept only once two or more different people's phones showed the same one; accounts signed in on the same phone count as one person. Those words are not linked to any account. Text you type, password fields and long text such as messages or notes are never included. Both the scrambled names and the shared words are encrypted at rest, like the rest of our database.

Each message you send in the AI chat also carries the last few lines of that chat, so the AI can follow the conversation. They are used for that reply only and are not stored. If you rate an AI answer with a thumb up or down, we keep that rating with the record of the session, so we can see which answers helped.

Voice requests

You can hold the bubble and speak a request instead of typing it. The app asks for microphone permission the first time. Your voice is turned into text by your phone's own speech recognition service (on most phones this is Google's). VisorBot receives only the text, never the audio, and uses it exactly like a typed request.

So the AI can tell which app you mean, a spoken request also sends the names of the apps that have an icon in your app list (names only, no other details about them), with that one request. The list is used to pick the app and is not stored.

Who else handles your data

We use a small number of service providers to run VisorBot: AI model providers that answer your AI requests (OpenAI and Anthropic), sign-in and payment providers, and providers that send our emails and host our servers. Each receives only what it needs for that job. AI providers do not use your data to train their models, and payment providers never share your card details with us.

We do not sell your data, and we do not share it for advertising.

No ads, no trackers

The app ships with no analytics SDK, no ad SDK and no crash reporting. It does not read the advertising ID.

Never used to train AI

We do not train AI models on your data. No screen content, no recipes, no prompts, no usage history.

Security

• Encrypted in transit. All traffic between the app, this website and our servers goes over HTTPS (TLS).
• Passwords are never stored. We keep only a salted bcrypt hash, which cannot be turned back into your password. If you sign in with Google, we never see a password at all.
• Sign-in tokens are short-lived and rotate. Each refresh replaces the old token, tokens are stored only as hashes, and if an old token is ever presented again, every session in that chain is signed out.
• Encrypted at rest. Your data is encrypted where it is stored, both in our database and in our file storage.
• Purchases are checked at the source. Every subscription is verified directly with the payment provider before it changes your plan. We never see or store card details.
• Screen text and screenshots from AI sessions are not stored. They are held in server memory for the session only, as described above. The only thing kept is the control names described above, scrambled per account.
• The admin tools are not on the public internet. They are reachable only from the server itself.

Keeping and deleting your data

We keep account data while your account exists. You can ask us to delete your account and everything attached to it, or only some of it, at any time: email [email protected]. The full steps, and exactly what is deleted or kept, are on the account deletion page.

Children

VisorBot is for adults. It is not directed at anyone under 18.

Changes

When this policy changes we update the date at the top, and when a change affects what leaves your phone the app asks for your agreement again.