Draft for counsel. Not published legal advice. Deific Connector is a Scope Labs LLC product. This is not a product of anthropic.

Privacy Policy

Last updated: 4 October 2026 · Draft 1.2

DRAFT — NOT YET REVIEWED BY COUNSEL. Facts in this policy were checked only as far as ASSUMPTIONS.md records. They must be re-verified against the shipping build before publication and again whenever data handling changes. If a later build moves data differently, this policy is revised before that build is what customers use. This draft does not claim an audit, a penetration test, or a certification.

This policy describes Deific Connector, a product of Scope Labs LLC ("Scope Labs," "we"). Deific is a permission-gated bridge between Claude on your phone and Claude Code on your computer. Deific is not a product of Anthropic.

It is written for customers in the United States, including California. It is not a statement that Deific is offered only in the United States, and it is not a GDPR representation. If distribution or data handling expands in a way that needs a different notice, this policy is updated first.

The short version

Deific is not Scope Scanner. Scope Scanner's privacy policy can say the app collects none of your personal information, because that app does not. Deific cannot say that. When you grant the permissions, the Connector moves material between your phone and your computer so the bridge can work. That material can include prompts, session status, terminal text, token-usage figures, background-task status, messages, model-change requests, and Claude Code conversation content.

What this draft does say:

• Nothing is supposed to move until you grant it on the desktop and on the phone.
• Optional computer reads stay off until you turn them on. A screen read is on demand, not an always-on recorder.
• Scope Labs does not sell personal information and does not share it for cross-context behavioral advertising.
• The declared dependencies of the ws-relay project, checked 4 October 2026, do not include an analytics, crash-reporting, advertising, or attribution SDK. That is a dependency check, not a promise that no future build will add one, and not a claim that the Connector has "no telemetry of any kind."
• There is no Deific mailing list on the site this draft was written against.
• The local marketing pages, checked by reading index.html and mobile/index.html on 4 October 2026, do not load a third-party advertising, analytics, or session-replay pixel. None of Meta, Google Ads, Hotjar, or a similar tag was found in those files. That is a read of the local mock, not a certificate about a future host.
• The marketing site must not ship session replay, a heatmap, a third-party chat widget that captures what you type or what is on the page, or an advertising pixel, unless this policy is updated first and any consent the law requires is obtained before that tool runs.
• We have not verified a retention period, an end-to-end encryption design, or a statement that a relay operator cannot see bridge traffic. This policy does not invent those.
• Accessibility reports are described in Section 14. They are not used for advertising, and they are not sold.

1. Connector and website

Keep these apart. The difference matters.

The Connector is the phone-and-desktop bridge. It handles the categories in Section 2, and only after you grant the relevant permission.

The website is the marketing page for Deific. In the local pages this draft was written against (index.html and mobile/index.html) there is no account form, no email field, no mailing list, no payment form, and no third-party analytics tag. A search of those two files on 4 October 2026 found no Meta pixel, Google Ads tag, Hotjar script, session-replay script, or other third-party analytics loader. The footer still marks that site as a local mock. Visiting it, as built today, does not ask you for personal information.

Pixels and capture widgets do not ship ahead of this policy. The marketing site must not add session replay, a heatmap, a third-party chat widget that captures content (what you type, or what is on the page), an advertising pixel, or an analytics pixel (including Meta, Google Ads, Hotjar, FullStory, and tools of that kind) unless this policy is revised to name it before the tool is published, and unless any consent the law requires has been obtained before the tool runs. A local mock with no tag is not a promise that a production host will stay that way. It is the rule for how a tool would be allowed to appear.

Scope Scanner's website mailing list — double opt-in, delete-if-unconfirmed, one-click unsubscribe that deletes the address, mail sent through Porkbun — is real for Scope Scanner and not in effect for Deific. Deific does not have that list. If a Deific list is added, it will be website-only, the box will not be pre-ticked, an unconfirmed address will be deleted, unsubscribe will delete rather than merely flag, and this policy will name the mail host before the first address is taken.

2. Information the Connector can handle, and why

We handle the following only as part of the bridge you turned on. "Handle" includes holding it on your devices and, where the bridge uses a relay, transmitting it between those devices. It does not mean Scope Labs has built a profile of you.

Category	Why it is there	What has to be true first
Prompts and prioritized messages	To carry what you chose to send between phone Claude and the desktop session	You connected the Connector and sent or approved the message
Statuses, token usage, background tasks	To show you what the desktop session is doing	You granted that read
Terminal text	To show a terminal you asked to include	You enabled that read on the computer
Claude Code conversation content	To let the phone side see the sessions you connected	You granted that view
Model changes	To carry a model change you authorized	You authorized the change
Screen content	To answer a request for a picture, words, or a region	You asked. It is not left on
Optional desktop context (git state, recent files, logs, the end of a transcript, editor file names)	Only if you want that context available	Off until you enable it on that computer
Permission state and brakes	To honor a grant, an expiry, a refusal, or "end everything"	The Connector is installed

You bring your own tokens. Billing for those tokens is between you and the model provider. This policy does not describe a Scope Labs copy of your API key, because no such store was verified. Do not email us a key.

The Connector does not ask for your contacts, photos, health data, or precise location as product features of this draft. Do not assume a future build stays that way. Section 10 is the rule if it changes.

Biometrics. This draft does not collect a voiceprint, a face geometry, a fingerprint, or any other biometric identifier for Scope Labs. Deific does not, in this draft, collect the kind of biometric identifier Illinois's Biometric Information Privacy Act regulates. Voice you speak to Claude stays with the phone's Claude app and the phone's operating system unless you later enable a Deific feature that handles voice. No such feature is in this draft. If one is ever built, this policy is updated, with whatever notice that feature requires, before it ships. This paragraph is not a statement that your model provider does not process audio. A transcript of words is not, in this policy, called a voiceprint.

Workplace and other people's data. Content you choose to put on the bridge may include an employer's data, a client's data, or another person's messages, because you chose to bridge a session that contained them. You are responsible for that choice and for having the authority to move the material. Deific does not turn the choice into Scope Labs' consent, and it does not make Scope Labs the monitor of someone else's session. The Terms say the same thing as a use rule.

A screen or a terminal can contain whatever was on that computer, including information that privacy laws treat as sensitive. We do not ask you to put government identifiers, financial account numbers, or credentials into the bridge. If they are visible in a read you enabled, they can move with that read. Turn the read off if you do not want that.

3. On your devices, and on a relay

This is the part Scope Scanner's policy does not have, because Scope Scanner has no bridge.

On the computer. Claude Code, the terminal, the files, and the screen are on the machine you chose. Optional reads run there, and only if you enable them. Ending the session or revoking the operating-system permission stops that read. Scope Labs does not get a standing copy of your disk from the fact that you installed a connector.

On the phone. The phone is where you talk to Claude and where you approve. The phone app does not, in this product description, take control of the phone's operating system.

Between them. The devices are not the same machine. A relay carries the consented bridge traffic from one to the other. The project that implements that path is ws-relay. This draft does not claim:

• that relay payloads are end-to-end encrypted;
• that Scope Labs, or a host Scope Labs uses, cannot see message content in transit or in logs;
• a number of days, hours, or minutes for which relay content is kept;
• a named cloud region, subprocessor list, or production host. The marketing site is still a local mock, and the public hostname spelling is unresolved.

A change dated 26 September 2026 in ws-relay keys sessions by an opaque hash of a GitHub numeric id and was described as making logs pseudonymous. That commit is not, in this policy, a guarantee of anonymity or of encryption. It is noted so we do not pretend the question was never worked on, and so we do not over-claim it.

Data minimization, as a rule we are willing to state now. The Connector should move the category you enabled and not a category you left off. Optional reads default off. Screen reads are on demand. We do not use bridge content to advertise to you, to sell you, or to train a Scope Labs model. We do not sell bridge content. We do not claim that Anthropic, or any other model provider, will refrain from training on what you send them. We do not operate an advertising SDK in the dependency list checked for this draft.

What we cannot honestly minimize on paper is a retention period we have not verified. Until engineering and counsel publish one, assume this policy is silent on relay retention on purpose.

4. What this policy refuses to copy from Scope Scanner

Scope Scanner (the Scope Labs iOS app) has a privacy posture that was written against that app's source. The following are true of Scope Scanner and are not claims about Deific:

• "The app collects none of your personal information."
• "There is no first-party server."
• Local notifications only, with no push token.
• Direct device calls to Binance.US, CoinGecko, and news publishers.
• A keychain entry that stores only a Pro-trial date.
• Apple in-app purchase as the only payment path.
• The iOS privacy manifest PrivacyInfo.xcprivacy (NSPrivacyTracking false, no collected data types, Required Reason APIs limited to file timestamp, UserDefaults, and system boot time). That file describes Scope Scanner's binary, not Deific Connector.
• A website mailing list already in production.
• United States-only App Store distribution, as a fact about Deific.

Those choices are good company patterns where they still fit. Section 5 says which patterns this draft actually uses.

5. Patterns this draft does use

Checked or adopted as stated:

No advertising or attribution SDK in the dependency list we checked. On 4 October 2026, ws-relay's declared npm dependencies were @modelcontextprotocol/sdk, express, sharp, ws, and zod. None of those is an analytics, crash, ads, or attribution SDK. No AppTrackingTransparency usage was part of that project check, and Deific is not the iOS app that files an App Store privacy label. We do not show an ATT prompt because we are not collecting an advertising identifier for Deific in this draft. Re-verify before ship. A local companion report used so the bridge can see a tool event is operational traffic, not a third-party analytics product, and it is not a warrant to say "we have no telemetry."

No sale and no share for cross-context behavioral advertising. We do not sell personal information. We do not share it for cross-context behavioral advertising. We do not offer a paid "do not sell" exception because we do not sell.

No Scope Labs account for core use, as this product is specified. Your Claude and Claude Code access is still your provider account. See the Terms.

Consent before the bridge moves anything, including a first-run acceptance idea Scope Scanner enforces in code for its own network calls. For Deific the equivalent rule is the product rule: grants on the desktop and the phone come first. This policy does not claim that a particular function in the Deific tree was unit-tested for that gate on 4 October 2026.

Re-verify before the handling changes. Same commitment Scope Scanner makes. It is a process rule, not a claim that the re-verification has already been done for a shipped Deific build.

Counsel reads it before publication. Same watermark Scope Scanner uses. This draft is not "reviewed by counsel."

Do Not Track and Global Privacy Control. The local marketing pages do not run a tracker this draft could honor or ignore. There is no advertising profile to opt out of. That is not a representation about a future production host. If a host is added, the policy will say whether a GPC signal is honored before that host is public. Adding a pixel, a heatmap, session replay, or a content-capturing chat widget without this update, and without any required consent, is outside what this draft allows. See Section 1.

No sale and no share, restated. Personal information, including an accessibility report, is not sold and is not shared for cross-context behavioral advertising.

6. Who else receives information

Your model provider. Prompts and session content you send to Claude or Claude Code are received by that provider under your relationship with them. Scope Labs does not control that provider's privacy policy, training choices, or retention. BYOT means you pay them, and their terms bind you.

Operating-system permission services on the phone and the computer, when you answer a system prompt. Those prompts are the platform's, not a Scope Labs form.

A relay, if the build you are using uses one, as Section 3 describes. No subprocessor is named here because none was verified for a production Deific host. Naming one we have not contracted would be a false disclosure. Scope Scanner names Porkbun for its mailing list. Deific has no such list and this policy does not name Porkbun as a Deific processor.

Support mail. If you write to us, we receive the address you wrote from, what you sent, and our reply. That correspondence is separate from the bridge. We keep it only as long as it is useful for the request and as a record of what was asked, and not longer than 24 months, then delete it, unless the law requires longer. Ask sooner and we will delete it sooner unless the law requires us to keep it. The 24-month ceiling is the period Scope Labs already states for Scope Scanner support mail. It is adopted here as a ceiling for Deific support mail, not as a measurement of a Deific mailbox that does not exist yet.

We do not sell support mail. Writing to us does not put you on a mailing list.

Accessibility reports are support correspondence for this section. If you write about a barrier, we receive what you chose to send, which may include the fact of a disability or a description of how you use assistive technology. We use that only to understand and fix the barrier. We do not use it for advertising. We do not sell it. We do not add you to a mailing list because you sent it. The same 24-month ceiling applies, and the same "sooner if you ask" rule applies. There is still no verified Deific inbox. See Section 14 and the accessibility statement.

7. Children

Deific is not directed to children under 13, and the Terms require you to be at least 18. We do not knowingly want bridge content from a child. If you believe a child has used the Connector, revoke the permissions and disconnect it on the devices. If you also believe you sent us a support message about a child, use Section 11 and we will delete that correspondence.

Because the Connector can relay whatever is on a session you enable, the practical control is on the devices: do not install it for a child, and do not leave it granted on a machine a child uses.

8. Security

Your devices' own protections (lock screen, disk encryption, operating-system permissions) are the first control, because that is where the session actually is. Revoking a permission is the brake you can pull without us.

We do not claim SOC 2, ISO 27001, GDPR compliance, or a bug-bounty program. This policy is not a GDPR representation. We do not claim that transport is encrypted in every build, or that data is encrypted at rest on a relay, because those designs were not verified for this draft. Connections that use HTTPS or WSS are encrypted in transit by that protocol. Do not read this paragraph as a statement that every Deific socket uses them.

Scope Labs will use safeguards reasonable for a permission-gated bridge. Before any public launch, access controls on a store Deific hosts have to be reviewed so that an open, unauthenticated database is not how customer or session data is kept. Shipping that open store is forbidden practice. The review is a process commitment. It is not an audit and not a certification.

No security practice in this policy is a promise that unauthorized access cannot happen.

9. Retention

What	How long
Material that stays only on your phone or computer	Until you delete it, revoke the grant, or remove the software. We cannot delete a copy that never left your device.
Relay traffic	Not stated. No retention period was verified. We will not invent one in this draft.
Support correspondence	No longer than 24 months, or sooner if you ask and the law allows. See Section 6.
Marketing-site visits, as built in the local mock	The pages do not ask for an account or an email, and this draft found no analytics tag storing a visit. No third-party pixel was found in the local pages.
Accessibility reports	Same ceiling as support correspondence: not longer than 24 months, or sooner if you ask and the law allows. Used to fix the barrier, not for advertising.

Cached market data, a 90-day headline cache, and a 24-hour movers log are Scope Scanner retention rules. They are not Deific features.

10. Changes

If Deific's data handling changes — an account system, an analytics SDK, session replay, a heatmap, a third-party chat widget that captures content, an advertising pixel, a mailing list, a named host, a verified retention period, a push token, a payment form, or a feature that collects a biometric identifier or handles voice at Scope Labs — this policy is updated and the date above changes before that handling ships. A capture tool on the marketing site is not a small change. It does not go live on the strength of this draft. Material changes will be brought to your attention in the Connector or on the site.

The same commitment covers a change that would make any sentence in Section 3 untrue in the other direction, including a future claim of end-to-end encryption. We will not add that sentence until it has been checked against the build.

11. Your choices and your privacy rights

On the devices. Refuse a permission. Turn optional reads off. Stop a screen read. End the session. Disconnect the Connector. Remove the software. Those are the controls for bridge content, and they do not require us to hold a copy in order to honor them.

If you write to us. You can ask what support correspondence we have, ask us to correct it, or ask us to delete it. Deletion of support mail does not reach content that lives only on your devices or content a model provider holds under its own policy.

California and other U.S. state privacy laws. Where a law such as the CCPA/CPRA applies, this is the statement in the form those laws use. It is written for Deific's actual bridge, not copied from Scope Scanner's "categories collected: none."

• Categories that may be processed to provide the Connector: identifiers you include in a support email (your email address); internet or network activity incidental to connecting the bridge (such as an IP address a relay necessarily sees in order to carry the connection — we do not claim we store it, and we do not claim we do not); and user content you choose to put on the bridge (prompts, messages, conversation text, terminal text, screen content, file names, and similar session material listed in Section 2). Commercial information about token spend is between you and your model provider, not a Scope Labs purchase record. This draft describes no Scope Labs payment account.
• Sources: you; the devices and sessions you connect; a support email or accessibility report you send.
• Business or commercial purpose: providing the Connector you enabled, securing it, and answering support. Not advertising. Not training a Scope Labs model.
• Sold or shared for cross-context behavioral advertising: none. That includes accessibility reports and support mail. We do not sell personal information. We do not share it for cross-context behavioral advertising.
• Sensitive personal information: we do not ask for it as its own product field. Session content you enable can include it. This draft does not collect a voiceprint or other biometric identifier; see Section 2. An accessibility report may include disability-related information you choose to share; we use that only to fix the barrier you reported, we do not use it for advertising, and we do not sell it. We do not use sensitive personal information to infer characteristics for advertising. We do not sell it.
• Retention: Section 9. Relay retention is deliberately unstated.
• Automated decision-making or profiling that produces legal or similarly significant effects: none in this product. A model provider's own ranking of a prompt is that provider's system, not a Scope Labs eligibility decision about you.

Rights you can send to the address in Section 12, if we hold information that a statute covers:

• know and access;
• delete;
• correct;
• opt out of sale or sharing (there is no sale or sharing to opt out of; the request still confirms that);
• limit use of sensitive personal information to what is necessary to provide the Connector;
• not receive discriminatory treatment for exercising a right;
• appeal a denial where your state's law gives you an appeal.

We may need to verify that the request comes from you. An authorized agent may submit a request where the statute allows it, with proof of authority. We will respond within the time that statute requires. If we deny a request, we will say why and, where the law requires, how to appeal.

Much of the Connector's information is on your devices or at your model provider. A request to Scope Labs does not compel Anthropic to delete a prompt you sent Claude. You have to use that provider's own tools for that.

Do Not Track. See Section 5.

12. Contact

Scope Labs LLC 10412 China Spring Rd Ste F PMB 1120 Waco, TX 76708-5685 United States

Email: TODO. No Deific privacy inbox was verified. Do not send Deific requests to [email protected].

The Terms of Service are at TERMS_OF_SERVICE.md (on the site, terms.html). The accessibility statement is at ACCESSIBILITY.md (on the site, accessibility.html).

13. How to read this policy next to the Terms

The Terms cover acceptable use, tokens, liability, and disputes. This policy covers information. If a marketing sentence on the site is shorter than this policy, this policy is the one that controls what we do with personal information. The site line "This is not a product of anthropic." is incorporated as a statement of whose product Deific is, not as a privacy claim.

14. Accessibility

How the marketing site aims to be used, and the limits of that aim, is in the accessibility statement: ACCESSIBILITY.md (on the site, accessibility.html). This policy does not repeat that statement as a warranty, and it does not claim an accessibility audit.

If you send a report about a barrier, you may include disability-related information. You do not have to. If you do, we use it only to understand and fix that barrier. We do not use it for advertising. We do not sell it. We do not share it for cross-context behavioral advertising. Retention is the support-mail ceiling in Sections 6 and 9.

The statement asks for a postal address because no Deific email was verified. The address is Scope Labs LLC, 10412 China Spring Rd Ste F PMB 1120, Waco, TX 76708-5685. Email: TODO. Do not send Deific accessibility reports to [email protected].