Privacy Policy
Effective date: November 7, 2026
This is an English translation of the Korean Privacy Policy. In case of any discrepancy between the two versions, the Korean version prevails.
TWENTYOZ ((주)트웬티온스, hereinafter "the Company") handles the personal information it processes in operating the Agent Switchboard website and related services in accordance with this policy.
1. Scope
This policy applies to the following services operated by the Company.
- The website
https://switchboard.twentyoz.kr(introduction, downloads, guides, changelog) - Installer downloads and the app update server (
https://switchboard.twentyoz.kr/releases) - The phone web app
https://app.switchboard.twentyoz.kr - The official relay server and the Google account PC list and usage sync service (hereinafter "the account server")
- Delivery of phone app push notifications
- Email inquiries (hello@twentyoz.kr)
If a user configures a relay server or phone app address that they operate themselves, this policy does not apply to information processed on that server.
2. Information not sent to the Company's servers
The Agent Switchboard desktop app runs on the user's PC. The following information is not sent to the Company's servers.
- API keys and gateway keys: Stored encrypted only in the PC's operating system secure storage (Windows DPAPI, macOS Keychain, Linux Secret Service).
- OAuth tokens of each coding agent: Managed by each tool in its own storage; the app does not read or copy them either.
- Chat content, terminal input and output, project files, session logs, and usage aggregates: Processed only on the PC.
Requests to AI services chosen by the user (for example, OpenAI, Anthropic, or a gateway) are sent directly from the PC to that service and do not pass through the Company's servers. If the voice chat feature is turned on, audio is sent directly to OpenAI with the user's OpenAI API key. The privacy policy of the respective service applies to such transmissions.
3. Personal information processed and purposes
Website visits
| Item | Purpose | Collection method |
|---|---|---|
| Connecting IP address, access time, requested address, response status, transfer size, browser information (User-Agent) | Providing the service, responding to failures, preventing misuse | Generated automatically in web server access logs |
| Usage statistics such as pages visited, referral source, and device and browser information | Analyzing and improving website use | Collected through Google Analytics only if the user consents to the use of cookies |
| Language choice, cookie consent status | Remembering the chosen language and consent status | Cookies |
Downloads and app updates
When an installer is downloaded or the app checks for a new version, web server access logs (connecting IP address, time, requested address, response status, transfer size, User-Agent) are generated. Update check requests do not include any account or authentication information.
Phone app
- The device signing key, list of connected PCs, sign-in session, and usage statistics key are stored in the phone's browser storage (IndexedDB). The Android app uses Android secure storage.
- Only information needed for connection, such as the device public key and device name, is passed to the relay server and account server described below.
- When the phone web app (
app.switchboard.twentyoz.kr) is opened, the same front-end web server as the website also keeps access logs (connecting IP address, time, requested address, response status, transfer size, User-Agent). The retention period is the same as for website access logs.
Phone connection (relay server)
Phone connection operates only if the user turns it on in the PC settings.
- The relay server only forwards end-to-end encrypted data between the PC and the phone. The Company cannot know terminal content, chat content, pairing secrets, or session keys.
- The relay server does not store or accumulate messages and does not log the content it forwards.
- While handling a connection, the connecting IP address, PC room identifier (a value derived from the PC public key), and transfer volume are handled in memory. They are used for rate limiting and temporary blocking to prevent abuse, and are discarded when the server restarts.
- The relay server program's logs record only the registration, replacement, and termination of PC room identifiers. However, as with other requests, the front-end web server's access logs record the connecting IP address, time, requested address (including the PC room identifier), and User-Agent.
Google account PC list
Processed only if the PC and the phone are signed in with a Google account.
| Item | Purpose |
|---|---|
Google account unique identifier (sub) |
Grouping PCs and phones of the same account |
| PC public key, PC name, relay server address in use, last connection time, supported feature flags | Showing the PC list to phones and other PCs |
| Phone device ID, device public key, device name, platform (web, Android, iOS), last connection time | Managing devices signed in to the account |
| Hash of the sign-in session token and its expiration time | Keeping the user signed in |
| Markers for removed PCs and signed-out devices | Propagating removal and sign-out to other devices |
| PC organization information on the phone home screen (folder names, notes, colors, icons, pinning, order) | Showing the same organization on phones of the same account |
| One-time device registration tickets (valid for about 5 minutes) | Registering devices without an additional sign-in |
- The email address contained in the Google sign-in proof is received when verifying sign-in but is not stored.
- Google ID tokens, refresh tokens, pairing secrets, device private keys, and terminal content are not stored.
- The account server stores only the PC list. Whether a phone may connect to a PC is decided by the PC, which verifies the Google signature itself.
Usage sync across PCs
Processed only if the user has consented to "여러 PC 사용량 합쳐 보기" (Combine usage across PCs) in the PC settings.
- The PC uploads token counts by date, tool, model, and project, encrypted with a key known only to the devices on the account. Chat content is not included.
- The Company does not know this key and cannot read the content. The server can know only the PC room identifier, the month concerned, the data size, and the update time.
- Storage folders are distinguished by a hash of the Google account identifier.
Push notifications
- The phone app's push token and notification key are stored in the secure storage of the user's PC. They are not stored on the Company's servers.
- When sending a notification, the PC encrypts the content, and the relay server passes the push token and ciphertext to Apple Push Notification service (APNs) or Firebase Cloud Messaging (FCM). The relay server does not log the token or content.
- APNs and FCM receive the push token, the ciphertext, and a fixed message ("There is something to check").
Email inquiries
The email address and inquiry content you send are used to respond to and handle your inquiry.
4. Retention periods
| Information | Retention period |
|---|---|
| Web server access logs (website, phone web app, downloads and updates, relay and account server requests) | 90 days |
| Google Analytics usage statistics | 14 months |
| Sign-in sessions (hashes) | Up to 30 days after issuance. Deleted immediately upon sign-out |
| Signed-out device markers | 30 days |
| One-time device registration tickets | About 5 minutes |
| PC list information | Until the PC signs out or the PC is removed from a phone |
| Phone home screen PC organization information | 1 year from the last use, then deleted automatically |
| Removed PC markers | 90 days from removal. Deleted immediately if that PC signs in again before then |
| Encrypted usage bundles | Until the user deletes them. They remain even if the PC is removed from the account |
| Email inquiries | 3 years |
Usage records can be deleted on the PC under 환경 설정 › 휴대폰 (Settings › Phone) with 서버에서 이 PC 기록 지우기 (Delete this PC's records from the server) or 계정 사용량 기록 모두 지우기 (Delete all account usage records). To delete all other account information, send a request to the contact below.
5. Cookies
The website switchboard.twentyoz.kr uses the following cookies. Google Analytics is not loaded on the phone web app app.switchboard.twentyoz.kr.
| Name | Purpose | Retention | When set |
|---|---|---|---|
sb_lang |
Remembering a language you chose | 1 year | When you choose a language yourself |
sb_consent |
Remembering whether you allowed or declined cookies | 6 months | When you make a choice in the consent banner |
_ga |
Distinguishing visitors for Google Analytics | 2 years | Only if you consent |
_ga_* |
Maintaining Google Analytics sessions | 2 years | Only if you consent |
- Google Analytics is off on your first visit. It is loaded only after you choose "Allow" in the consent banner.
- You can withdraw consent at any time through Cookie settings at the bottom of the page. When you withdraw, the
_gaand_ga_*cookies are deleted. - You can also block cookies in your browser settings. In that case, your language choice may not be remembered.
6. External services
The following external services are used to provide the service.
| Service | Provider | Information processed | Condition of use |
|---|---|---|---|
| Google Analytics | Google LLC | Website usage statistics, cookie identifiers | When you consent to website cookies |
| Google Sign-In | Google LLC | Sign-in verification (account identifier, email) | When the user signs in with a Google account |
| Firebase Cloud Messaging | Google LLC | Push tokens, encrypted notifications | When Android app notifications are used |
| Apple Push Notification service | Apple Inc. | Push tokens, encrypted notifications | When iPhone app notifications are used |
Overseas transfer of personal information
When the above services are used, personal information is transferred overseas as follows.
| Recipient | Destination country | Items transferred | Time and method of transfer | Retention and use period |
|---|---|---|---|---|
| Google LLC (Google Analytics) | United States | Website usage statistics (pages visited, referral source, device and browser information), cookie identifiers | Sent over the network each time a page is viewed after consenting to the use of cookies on the website | 14 months |
| Google LLC (Google Sign-In) | United States | Sign-in verification information such as the Google account identifier and email address | Sent over the network when the user signs in with Google in the PC app or phone app | In accordance with Google's privacy policy |
| Google LLC (Firebase Cloud Messaging) | United States | Push tokens, encrypted notification content | If Android app notifications are registered, sent over the network each time a notification is sent | Until the purpose of delivering the notification is fulfilled (in accordance with Google's policy) |
| Apple Inc. (Apple Push Notification service) | United States | Push tokens, encrypted notification content | If iPhone app notifications are registered, sent over the network each time a notification is sent | Until the purpose of delivering the notification is fulfilled (in accordance with Apple's policy) |
Notification content is sent encrypted with a key created by the phone, so Google and Apple cannot read it.
How to refuse overseas transfer and the consequences of refusing are as follows.
- Google Analytics: Choose "Decline" in the consent banner, or withdraw consent through Cookie settings at the bottom of the page. Declining does not restrict your use of the website.
- Google Sign-In: You can connect your PC and phone with a QR code without signing in with a Google account. In this case, the account PC list, connecting without a QR code, and usage sync across PCs are not available.
- Push notifications: Do not register for notifications in the phone app, or turn them off. In this case, you cannot receive notifications for pending approvals, completed tasks, or errors.
Except in the cases above, the Company does not provide personal information to third parties. Requests made in accordance with law are an exception.
7. Rights of users
Users may at any time request access to, correction of, deletion of, or suspension of processing of their personal information. If you send a request to hello@twentyoz.kr, we will handle it within 10 days and inform you of the result.
You can do the following directly in the app.
- Remove a PC from the PC list: On the PC, Google 계정 로그아웃 (Sign out of Google account) under Settings › Phone
- Sign out a phone: 로그아웃 (Sign out) on the account screen of the phone app, or in the PC's list of connected phones
- Delete usage records: Delete this PC's records from the server, Delete all account usage records
- Withdraw cookie consent on the website: Cookie settings at the bottom of the page
To fully revoke the permissions your Google account has granted to this app, remove the app's access in your Google account settings. The app does not automatically revoke permissions on the Google side, in order to protect sign-ins on other PCs of the same account.
8. Destruction procedures and methods
Information whose retention period has ended or whose processing purpose has been fulfilled is destroyed without delay. Information in electronic file form is deleted using technical methods that make the records impossible to reproduce or recover. Information printed on paper is shredded or incinerated. Sign-in sessions, signed-out device markers, removed PC markers, and phone home screen PC organization information are deleted automatically by the server when their retention period expires.
9. Security measures
- Content between the phone and the PC is end-to-end encrypted, and the relay server only forwards ciphertext.
- For sign-in sessions, only hashes are stored, not the original tokens.
- Usage records are stored only in a form encrypted with a key unknown to the Company.
- Account data files and usage folders are kept under restricted permissions on the server.
- The account API accepts browser requests only from the phone web app's origin and uses only authentication tokens (Bearer), without cookies.
- The relay server applies registration proof of work and limits on the number of connections, message frequency, and transfer volume.
10. Chief Privacy Officer
| Category | Details |
|---|---|
| Chief Privacy Officer | 윤찬 (Yun Chan, Co-CEO) |
| Contact | hello@twentyoz.kr |
11. Company information
- Company name: (주)트웬티온스 TWENTYOZ
- Representatives: 윤찬 (Yun Chan), 이용석
- Business registration number: 109-87-01781
- Address: 경기도 화성시 동탄첨단산업1로 27, A909호(영천동, 금강펜테리움IX타워) (A909, Geumgang Penterium IX Tower (Yeongcheon-dong), 27 Dongtancheomdansaneop 1-ro, Hwaseong-si, Gyeonggi-do, Republic of Korea)
- Phone: 070-4353-1190
- Email: hello@twentyoz.kr
12. Changes to this policy
If this policy changes, we will announce it on this page together with the effective date.