01 / WHAT THE APPS STORE

On your devices, for you.

On your iPhone

The list of Macs you have paired (name and relay route), a per-Mac access token and encryption key in the iOS Keychain (shared only with the app’s own notification extension, which uses the key to decrypt alerts), and your notification preference. Conversation history is fetched from your Mac when you open a conversation and cached only in memory.

On your Mac

Session history, attachments, the local knowledge base and memory notes derived from your conversations, device pairings, and the Mac’s own identity key, all under ~/Library/Application Support/AgentRemote/ with owner-only permissions. Nothing in that folder is uploaded to us.

Camera

Used only while you scan a pairing QR code. No images are stored or transmitted.

Microphone and speech recognition

Used only when you tap the microphone to dictate a prompt. Transcription uses Apple’s speech recognition, preferring on-device processing where your iPhone supports it; otherwise Apple may process the audio under Apple’s privacy terms. The resulting text is sent to your Mac like any typed message.

Photos and files

Only the items you explicitly attach are sent, encrypted, to your Mac. Files your agent produces can be downloaded to your phone and shared through the iOS share sheet at your request.

02 / WHAT PASSES THROUGH THE RELAY

A courier that cannot open the envelope.

Your iPhone and Mac reach each other through a relay service we operate so that you do not need a VPN, port forwarding, or a fixed address. When you pair, the two devices agree on a shared secret using X25519 key agreement and HKDF. Every request, reply, and file is then encrypted on the sending device with AES-256-GCM and decrypted only on the receiving device.

The relay can see

Routing identifiers (random per-pairing values, not tied to your identity), the IP addresses of connecting devices, connection timing, and message sizes.

The relay cannot see

Message text, files, session names, project paths, voice transcripts, your provider credentials, or your encryption keys.

Retention

The relay has no database and stores no message contents. Undelivered ciphertext is held briefly in memory and discarded. Our hosting provider (Railway, United States) may retain standard connection logs for its own operational purposes; we do not use them to identify or profile you.

03 / MODEL PROVIDERS AND NOTIFICATIONS

Other parties, and when they are involved.

Anthropic and OpenAI

Agent Remote drives the Claude Code and Codex command-line tools already installed and signed in on your Mac. Your prompts, relevant files, and the excerpts used to build your local knowledge base are sent from your Mac to your provider account under that provider’s terms and privacy policy. The iPhone app never talks to a model provider directly, and we never receive those requests.

Apple Push Notifications

If you turn on reply notifications, your iPhone’s push token is sent, encrypted, to your Mac. When a reply finishes or your agent asks a question, your Mac asks Apple to deliver an alert, either with an Apple Push key you configure or through the Agent Remote relay’s sender. The readable part of that alert is always generic (“Your agent has replied.” or “Your agent has a question for you.”) plus opaque Mac and session identifiers. The useful details (the chat’s title, the first line of the reply or the question, and up to three answer choices) are encrypted on your Mac with the same per-device key that protects your conversations, so Apple and the relay see only ciphertext. Only your iPhone can decrypt them: its notification extension does so on the device, using the key stored in the iOS Keychain, and if anything fails it shows the generic alert instead. If you answer or reply from a notification, the text goes to your Mac over the same end-to-end encrypted connection the app uses.

No one else

There are no analytics, crash-reporting, advertising, or attribution SDKs in either app, and we do not sell or share data.

04 / YOUR CONTROL

Revoke, delete, forget.

Remove a phone

Revoke any paired device from the Mac; its token and key stop working immediately without affecting other devices.

Delete conversations and knowledge

Deleting a session on either device removes its saved history, attachments, and derived knowledge from your Mac. You can also forget individual learned notes. Deleting local data cannot recall information already sent to your model provider.

Stop everything

Quit Agent Remote on the Mac and remote access ends. Uninstalling the iPhone app removes its stored pairings and Keychain items.

Children

Agent Remote is a developer tool and is not directed to children under 13. We do not knowingly collect personal information from children.

Changes

If this policy changes, the new version will be posted at this address with an updated effective date.

Contact

Questions about privacy: open an issue on GitHub. To report a security problem privately, use Report a vulnerability.