Privacy policy

Mortimer for Android. Last updated 19 October 2026.

Mortimer is a home-screen widget that connects your phone to an AI agent you run yourself, for example a Claude Code session on your own computer. This policy explains what the app and our relay service handle, and what they don't. Mortimer is made by Canonbury Labs, London ("we").

What we don't collect

• No account, name, email address or phone number. You don't sign up with us.
• No advertising, analytics or tracking SDKs, and we don't sell or share data for advertising.
• No contacts, location, photos or files from your phone.

What passes through the relay

The phone and your agent talk through our relay, a small web service hosted on Vercel. It holds:

• Pairing. When you pair, the app creates a random key pair on your phone. The relay keeps the public key and a device name, so it can check that requests come from your phone. One-time pairing codes are stored only as a keyed hash and expire after 10 minutes.
• Your commands. What you tap, type or say on the widget goes to the relay as text. It waits there until your agent picks it up, then the relay deletes it.
• Your agent's replies. The latest answer card, the list of tiles and the live status your agent sends. Each one is replaced by the next.

Everything the relay stores is encrypted at rest (AES-256-GCM, with a separate key per account). Our hosting provider keeps standard request logs, such as IP address and time, for a short period to run and secure the service. To stop abuse, the relay counts requests per IP address, and it keeps only a keyed hash of each address.

The website waitlist

If you join the waitlist on heymortimer.com, we keep your email address so we can send your invite and launch news, and for nothing else. It's stored in our database (Supabase). To be removed, email us and we'll delete it.

Your agent

Your agent runs on your own computer, under your own AI provider account. What it reads and does, for example with your calendar or email, is governed by your own setup and your provider's terms, not by us. The app shows what your agent sends it and passes your commands back. Nothing else.

Voice and QR scanning

If you use the microphone, Android's speech recognition service on your phone (usually Google's) turns your voice into text. Only the text reaches the relay. The QR scanner is provided by Google Play services and runs on your phone. The app itself has no camera permission and never sees the image.

Keeping and deleting data

• Uninstalling the app deletes its data on the phone, including its key.
• Your agent can unpair a phone at any time. That removes the phone's key from the relay.
• To delete your whole relay account (devices, latest card, status and queue), email us at the address below. We'll do it within 30 days and confirm.

Children

Mortimer is not directed at children under 16.

Changes

If we change this policy we'll update this page and the date above.

Contact

Canonbury Labs, London. Email ed@canonbury-labs.com.