This policy covers the Code Remote iPhone app (the "App") and the coderemote command-line tool for your computer (the "CLI"), together "Code Remote". Code Remote is made by Thanh Tran ("we", "us").

What we collect

Nothing, in the App or the CLI. They don't use analytics, crash reporting, advertising or tracking SDKs, and we don't track you across other apps or websites. We have no way to see your files, your git repositories, your terminal sessions, your coding agents' sessions or the commands you run.

Notifications

If you turn on notifications for a computer (optional), that computer can tell your iPhone when a coding agent such as Claude Code needs an answer or has finished. Apple only delivers notifications sent with the app's own key, so your computer sends them through a small relay we run on Cloudflare Workers, which adds that key and passes them to Apple's push service right away. The relay receives your iPhone's push token, a ticket that lets your computer notify that iPhone, and the notification. What the notification says (the session, the command, the question) is encrypted on your computer with a key that only your iPhone and that computer have; the relay and Apple see only a generic "A session needs your attention". The relay has no database and no request logs, and keeps nothing once it has passed a notification on; the only state is a short-lived counter, keyed by a hash of the push token, that limits how many notifications one device can get per minute. Its source code is public in the coderemote repository.

This website

This website (coderemoteapp.github.io/web) uses Google Analytics to count visits and see which pages are read, so we know what to improve. Google Analytics sets cookies in your browser and receives the pages you visit, your browser and device type, your approximate location (country or city, derived from your IP address, which Google Analytics doesn't store) and the site you came from. We see only aggregated reports, and use them for nothing else. We don't link them to the App or the CLI, and the App and the CLI never load Google Analytics. You can block it with your browser's tracking protection or a content blocker, or with Google's opt-out add-on. See how Google uses data from sites that use its services. The site itself is hosted on GitHub Pages, which may log visitors' IP addresses for security; see the GitHub Privacy Statement.

Beta invites

If you ask for a beta invite on this website, the form sends your email address and the message you write (if any) to Formspree, a form service that stores them and forwards them to us by email. We use your email only to invite you to the App's beta on Apple's TestFlight, which means giving it to Apple in App Store Connect; Apple then emails you the invite. We don't use it for newsletters or marketing and don't share it with anyone else. To have it deleted, from Formspree, our inbox and the TestFlight tester list, email us at the address below. See the Formspree Privacy Policy and Apple's privacy policy.

What stays on your devices

On your iPhone

• Pairings: the address of each computer you pair with and its access token, stored in the iOS Keychain.
• Device keys: for each computer, two keys this iPhone makes in its Secure Enclave, which never leave it, and the id the computer gave it, stored in the iOS Keychain.
• Tunnel sign-in tokens: the token Microsoft Dev Tunnels issues after you sign in, stored in the iOS Keychain.
• Notification keys: for each computer you turn notifications on for, the key that decrypts its notifications, stored in the iOS Keychain and shared only with the App's notification extension.
• Settings: your preferences in the App, stored on the device.

Deleting a computer in the App, or deleting the App, removes this data from your iPhone. It may be included in your own encrypted device backups, under Apple's control.

On your computer

The CLI keeps its access token and configuration in ~/.coderemote/ (readable only by your user account), including the name and public keys of each iPhone enrolled with it, and, for each iPhone that turned notifications on, its push token, ticket and notification key. Running coderemote rotate-token revokes every paired device and deletes those.

If you run coderemote setup claude or coderemote setup codex, Claude Code or Codex reports its sessions (prompts, replies, the tools it runs and their output) to the coderemote running on the same computer, which keeps them in memory to show in the App and forgets them when it stops. Nothing of it leaves your computer except through your own connection to the App, and in the encrypted notifications above.

Device permissions

• Camera: used only to scan the pairing QR code that the CLI shows. Images are processed on the device and never saved or sent anywhere.
• Notifications: optional, asked when you turn notifications on for a computer. You can turn them off per computer in the App, or for the whole App in iOS Settings.
• Face ID: optional, to unlock computers you choose to lock. Face ID is handled entirely by iOS; the App only learns whether authentication succeeded.

Third-party services

To reach your computer from anywhere, Code Remote uses services run by other companies. They process data under their own privacy policies, not ours:

• Microsoft Dev Tunnels. Traffic between the App and your computer passes through Microsoft's Dev Tunnels relay, over HTTPS / WSS and end-to-end encrypted between the App and your computer, so the relay only forwards ciphertext. Media you play, files you upload to a coding agent and some large downloads are not end-to-end encrypted (on the same Wi-Fi the App connects to the computer directly instead). The CLI downloads Microsoft's Dev Tunnels command-line tool on first run, and that tool may send diagnostic data to Microsoft. See the Microsoft Privacy Statement.
• GitHub or Microsoft sign-in. When you sign in to Dev Tunnels, you do so on GitHub's or Microsoft's own page in the system browser. We never see your password. See the GitHub Privacy Statement.
• Apple Push Notification service and Cloudflare. Notifications reach your iPhone through Apple's push service, sent by our relay on Cloudflare Workers, as described under Notifications. See Apple's and Cloudflare's privacy policies.
• Formspree. Receives the beta invite form on this website, as described under Beta invites.
• npm. Installing the CLI downloads it from the npm registry, operated by GitHub.
• Apple. If you download the App from the App Store, Apple may share anonymous usage and crash statistics with us when you've agreed to that in iOS settings. These are aggregated by Apple and don't identify you.

Commands you run in the terminal, such as git push or a package install, connect wherever those programs connect, exactly as if you ran them at your computer.

Children

Code Remote is a developer tool and isn't directed at children under 13. We don't knowingly collect data from children, including through the beta invite form.

Your rights

The only personal data we may hold about you is the email (and message) you sent through the beta invite form; email us to see, correct or delete it. Website analytics are kept by Google, as aggregated reports for us; you can block them as described under This website. You control everything Code Remote stores, on your own devices, as described above.

Changes

If this policy changes, we'll update it on this page and change the effective date above. If a change ever means Code Remote starts collecting data, we'll say so in the App before it happens.

Contact

Questions about privacy: trantienthanh2412@gmail.com.