Privacy Policy

What we never receive

None of the following leaves the pair of your own devices in a form anyone else can read:

• The contents of your files, and their names and paths.
• Commands you type and the output they produce.
• Terminal sessions, AI CLI conversations, and process logs.
• Repository contents, diffs, branch names and commit messages.
• Credentials for CI providers, SSH keys, and anything else in your keychain.

The phone and the Mac authenticate each other with keys that only they hold, and everything between them is encrypted end to end. On a local network no server takes part at all: the devices find each other directly.

What our relay nodes see

When a direct connection cannot be made — some networks do not allow one — the encrypted stream is forwarded by a relay node. A node handles an opaque stream: it cannot decrypt it, and it stores nothing on disk. It holds, in memory and only while a session lasts:

• Device public-key fingerprints, so two devices can find each other.
• Network addresses of the connecting devices, for as long as the connection lasts.
• Counters of bytes forwarded, to keep the service running.

Nothing here survives a restart of the node, and none of it is written down. If even this is more than you want, run your own node — the app works with it exactly as it works with ours, and no request reaches us on that path.

What the subscription service stores

A subscription is needed only for the outside path through our nodes and for a second Mac. If you use ShiftStage on your local network, or through your own node, none of this exists for you and no account is created.

If you do subscribe, the service stores:

• The original App Store transaction identifier, the product, the state of the subscription and its expiry.
• A fingerprint of your device's public key, so an entitlement can be issued to it.
• If — and only if — you choose to sign in so a subscription can follow you to a new device: the account identifier your provider (Apple or Google) returns, and the email address it releases.

Buying does not require signing in. Signing in is a way to move a subscription between devices, and nothing else.

The entitlement the service issues to your device carries no account identifier, no address and no transaction. It says that a device with a given key may use the outside path until a given date, and it is signed. Our relay nodes verify that signature; they never talk to the subscription service, and the service never learns which node you used or when.

Analytics

The app collects no analytics and contains no third-party SDKs, trackers or advertising identifiers. Diagnostics — timings and error counts — stay on your device, are shown to you on the app's diagnostics screen, and are sent nowhere. You may export them to a file yourself, and then it is your file.

This website loads no third-party scripts, no third-party fonts, and sets no cookies.

Notifications

When your Mac tells your phone that a marked command has finished, the message travels through Apple's push service. Its payload is encrypted: Apple forwards bytes it cannot read, and the text you see is composed on your device.

What is stored on your devices

Device keys, paired-device records, tokens for CI providers you connected, and your settings live in the system keychain and in the app's own storage. They stay on the device. Deleting the app removes them; the app also offers to erase them from its own interface.

Your rights

If a subscription account exists, you can delete it from inside the app: the account, its sign-in methods and its device records are removed. The record of the purchase itself is kept as long as tax and accounting law requires, because that is a record of a payment, not of you.

Purchases, refunds and cancellations are handled by the App Store under Apple's terms; we neither see your payment details nor hold them.

Children

ShiftStage is a developer tool and is not directed at children.

Changes

If this policy changes in a way that affects what is collected, the app will say so before the change takes effect. The date at the top of this page always matches the version in force.

Contact

Questions about this policy: see the support page.