Security

You stay in control of the phone.

Last updated October 3, 2026

1. What your assistant can and can't do

• Your approval before anything goes out. Posting, commenting, replying, publishing and sending messages need your approval first. Your assistant shows you a link; you see the app, where it goes, the exact text and a screenshot of the phone, then tap Approve or Decline. One approval covers one action with exactly that text. Nobody answering means nothing happens.
• The assistant can't approve itself. Approving needs your Fonino sign-in. No tool your assistant can call approves anything, and Fonino checks the button under every tap in apps and websites where a tap can publish (Reddit, X, Instagram, WhatsApp, Gmail, browsers and more).
• Sensitive apps are blocked. Settings, Wallet, Passwords, App Store, Mail, Phone, FaceTime, Find My and Watch aren't available to assistants. If Fonino can't tell which app is open, it refuses the action.
• Texts go through one checked path with limits that keep the number looking like a person, not a spammer: at most 20 messages an hour and 100 a day per phone, and 5 an hour to the same person. Only U.S. numbers. A recipient who replies STOP is never texted again.
• Passwords and codes stay with you. At a passcode, password or 2-factor prompt, your assistant is instructed to hand over: you get a private live view of the phone, take over, and give control back when you're done.
• Watch any time. From your account you can open a live view of the phone and see what your assistant is doing.
• Stop any time. Disconnect an assistant in your account and its access ends at once. Cancelling your plan revokes every connection and your Mac's access.

2. Where your data lives

• BYOF: the iPhone is yours and stays plugged into your Mac. Fonino for Mac runs the phone, and session recordings (screenshots, actions, messages) are kept on that Mac for 90 days, then deleted automatically.
• Hosted phone: a dedicated iPhone in our rack, used only by you. Session recordings follow the same 90-day rule. You sign it in with your own Apple Account.
• Our cloud (api.fonino.app) passes your assistant's requests to the phone and the screenshots back. It doesn't keep screenshots. It stores your account email, your plan, and one-way hashes of keys and tokens, never the keys themselves.
• Your assistant (Grok, Claude, Muse) receives the screenshots and results it asks for; what it does with them is covered by that assistant's own terms.
• We don't sell your data and don't use it to train AI models. Details: Privacy Policy.

3. How connections are protected

• Encrypted everywhere: every connection uses HTTPS or secure WebSockets.
• No passwords to steal: you sign in to Fonino with a 6-digit code sent to your email. Assistants connect with OAuth: you sign in on our page and the assistant gets a token that expires after an hour and is renewed only while you stay connected.
• Your Mac isn't exposed to the internet. It opens no ports: Fonino for Mac makes one outbound encrypted connection to our cloud, and the phone-control service listens only inside your Mac. The cloud can ask your Mac to do just four things on its own: approve, decline, show an approval screenshot, or open a live view. Everything else must come from your connected assistant with a valid token, scoped to your phones only.
• A real, unmodified iPhone. No jailbreak. Fonino controls it with Apple's own UI-testing framework, the same one app developers use, signed with your Apple ID.
• Downloads are checked. The installer verifies the Fonino package against a published SHA-256 checksum before installing, and installs into your user folder without admin rights.
• Separate admin access. Our fleet dashboard is on its own hostname, needs an admin login, and uses sessions separate from customer accounts.

4. Good to know

• Apps and websites have their own rules. Some don't allow automated use, and Apple's iCloud terms limit automated access. Fonino keeps activity at human-like pace and volume, but the final say belongs to each service. Use a phone and accounts you're comfortable with an assistant operating.
• We're a small team, and honest about it: Fonino hasn't had a third-party security audit (such as SOC 2) yet. This page describes exactly what the service does today, and we update it when that changes.
• No system is perfectly secure. If we learn of a breach affecting your data, we'll tell you as the law requires.

5. Report a security issue

Found a vulnerability? Email hello@fonino.app with "Security" in the subject. We'll reply within 2 business days and won't take action against good-faith research that avoids other people's data and doesn't disrupt the service.