User guide · 6

What is yours alone, what we store, and what to do about a key.

A short, plain account for people who use the product. The binding text is the Privacy policy; the site's Security section has more background. Where something is not as strong as you might assume, this page says so.

Checked on a live phone · 12 Oct 2026Early accessNo certifications claimed

What is isolated

Your phone, your network, your key.

Your phone is its own Android system with its own storage. It is not shared with another account, and it is not wiped between sessions.
Your phone sits on its own private network. On the test account we checked for this guide, the network held exactly one device: that account's phone.
Your key reaches your phones only. A request for a phone that is not yours gets the same refusal whether that phone exists or not:

shell · curlcopy-paste

curl -s -w "\nHTTP %{http_code}\n" -H "X-API-Key: $ERIUS_KEY" $ERIUS_API/device/not-my-phone

responsereal output · 12 Oct 2026

{
  "ok": false,
  "error": "forbidden",
  "message": "device not found or not accessible with this key",
  "requestId": "27639e2e9f0e6aaa"
}

HTTP 403

The phone's ADB port is not exposed to the internet. It listens on the server's loopback address only. That is why ADB and scrcpy are not offered.
Support tickets, call minutes and call state are looked up by the account your key belongs to. There is no way to name another account in a request.

The honest limit. Phones run on servers we operate and are not end-to-end encrypted from us. People who operate the service have the technical ability to access a phone. The Privacy policy says when we would. We hold no security or privacy certification at this stage.

What we store

The short list.

From the Privacy policy and from the dashboard's Settings page, "What we can see".

What	Detail
Your email address	From sign-up. Used for the confirmation, the welcome email and replies.
A hash of each API key	Never the key itself. We can check a key; we cannot read it back or show it to you again.
An audit log line per API request	Time, account, a short fingerprint of the key, IP address, method, path, phone and action, status and duration. For installs and launches also the app's package name.
Not in the audit log	Request bodies: no typed text, no web addresses your agent opens, no intents. No keys.
Your phone's content	Apps, app data, accounts you sign into, files. It stays on the phone. We do not look through it, analyse it or use it to train anything.
Support tickets	The subject, your messages and our replies.
Calls	The minutes ledger and a log line per call: when, how long, how it ended.
In your browser	The dashboard keeps your key in this browser's local storage until you sign out or the session times out. The dashboard sets no cookies. For the website's analytics tags see Cookies.

Audit logs are kept in rotating files. A fixed retention period has not been set yet.

During a call To let the persona hear and answer, the guest's voice and picture are processed by third-party AI voice and avatar services while the call is connected. The guest is told at the start that they are talking to an AI assistant with a synthetic voice, and the video carries that label. Tell your guests before you send them a link.

How the key works

One credential for everything.

The key starts with sdk_. It is shown once, on the page behind the link in your welcome email. The email never contains the key.
The same key signs you in to the dashboard and authenticates your agent. There is no password and no second factor today.
Signing out of the dashboard removes the key from that browser. It does not revoke the key: your agents keep working.
The dashboard signs you out after a time without activity. You choose it in Settings: 15 minutes, 30 minutes, 1 hour or 4 hours.

A lost or leaked key

We issue a new one. The old one stops working at once.

You cannot create or revoke keys yourself yet. Until that exists, this is the way.

You can still sign in (for example the key is in your password manager but was pasted somewhere public): open a ticket from API keys, Ask for a key, and say the key must be replaced.
You cannot sign in: write to info@eriusphone.com from the email address you signed up with, so we can tell it is you. The new key link is sent to that address only.
We reissue the key. You get a new "Your ERIUS PHONE device is ready" email with a new one-time link.
Open the link, press Show my API key, store the new key, and update your agents.

We ran this on the test account on 12 October 2026. The reissue took 3 seconds; the phone, its apps and its data were untouched, and the old key has answered like this ever since:

shell · curlcopy-paste

curl -s -w "\nHTTP %{http_code}\n" -H "X-API-Key: $ERIUS_OLD_KEY" $ERIUS_API/whoami

responsereal output · 12 Oct 2026

{
  "ok": false,
  "error": "unauthorized",
  "message": "missing or wrong X-API-Key",
  "requestId": "a14d6cf77e30dde0"
}

HTTP 401

This step needs a person on our side today. The reissue itself is one command, but someone has to read your message first. Self-service key rotation is on the list.

The one-time link was already used? Each link shows a key once. The page then says "This link has already been used". If that was not you, treat the key as leaked and ask for a new one.

Your data

See it, fix it, delete it.

To get a copy of your account information and logs, to correct them, or to delete your account and phones, email info@eriusphone.com from the address on your account. Deleting a phone erases everything on it and cannot be undone.

Reporting a problem

Tell us first.

If you find a security problem, write to info@eriusphone.com with what you saw and how to reproduce it. Please do not test against phones or accounts that are not yours.

Stuck on something?

Open a ticket from your dashboard and we answer there. No key yet? Write to info@eriusphone.com.

Open a support ticket