Privacy

On your devices

• Your hosts, pairing tickets, device keys, SSH keys and saved passwords are stored in the Keychain on each device. They are not synced to iCloud.
• SSH keys that Gudo creates live in the Secure Enclave and can't be copied off the device.
• Settings stay on the device.

Between your devices and your hosts

Terminal output, what you type, files and approvals travel end to end encrypted (QUIC with TLS 1.3) between your device and your host. We never receive them. A host only accepts devices you paired with it.

Services Gudo uses

Relays

When there is no direct path to a host, the connection goes through a relay. The default relay is ours, relay.gudo.dev, on a Hetzner server in Germany. A relay forwards encrypted packets. It can't read or change them. It sees the IP addresses of both ends and the timing and size of the traffic, nothing else, and it keeps no logs of content.

In the default setup a host also publishes its current network addresses under its public key, so your devices can find it. You can point a host and the app at your own relay, or turn relays off and connect only on your network or over Tailscale.

Push notifications

If you allow notifications, your device registers its Apple push token with our push relay, which runs on Cloudflare. When an agent needs you, your host encrypts the notification for your device, signs it, and sends it to the relay, which hands it to Apple for delivery.

The relay and Apple can see that a notification was sent, when, its size, and a rough kind, like an approval request. They can't read it. The relay doesn't log tokens, IP addresses or payloads. It keeps only short-lived records to stop replays and rate limits, which expire within minutes to an hour. When you remove a device from a host, the host stops sending it notifications.

Apple and TestFlight

If you install a beta through TestFlight, Apple may share crash reports and any feedback you choose to send with us, under Apple's TestFlight terms. You can turn this off in TestFlight.

This website

gudo.dev is a static site on Cloudflare Pages. It sets no cookies and runs no analytics or third-party scripts. Cloudflare handles each request, including your IP address, to serve the page. When the Mac app checks for updates, it fetches a file from this site in the same way.

Invite and pairing links (gudo.dev/join, gudo.dev/pair) keep the invite after the #. Browsers never send that part to a server.

GitHub

Downloads, source code and issues are on GitHub, under GitHub's own privacy statement.

Other services you choose

The agents you run, like Claude Code or Codex, talk to their own providers under those providers' terms. Gudo doesn't sit in between. Some optional features connect to other services when you use them, for example a VS Code tunnel goes through Microsoft.

Changes

If this policy changes, we'll update this page and the date at the top. Every past version is in the repository history.

Contact

Questions about privacy: open an issue. For anything private, use a private report on GitHub.