Cipher — Privacy

Your messages are end-to-end encrypted: Cipher can’t read them. To run the relay we process limited security, delivery and abuse-prevention data, described below. There’s no account and no API key. This policy may change; we’ll tell you first and ask you to agree again.

Cipher was called TsskFlow until 9 November 2026. It is the same product from the same maker, and this policy covers it under both names.

The app and the Mac program have no analytics or crash reporting. The relay passes along encrypted messages it can’t read; it does handle network addresses, delivery details, security identifiers and notification tokens, as described below. If you’ve chosen to share analytics with app developers in your iPhone’s settings, Apple may send us crash reports for the Cipher app. They contain technical details about the crash, not your messages. Apple’s setting decides this; Cipher sends nothing itself.

Cipher connects your phone and your Mac through a relay. Each message is sealed on your phone or your Mac and opened only on the other. We have no key, and neither does our hosting provider.

• No account in the app. It asks for no name, email or password.
• Your Mac password stays with macOS. When you pair, macOS asks for Touch ID or your Mac password in its own window and checks it itself. The password and the fingerprint stay with macOS; Cipher learns only whether the check passed.
• We can’t read your content. Your code, messages, files and the commands your agent runs travel encrypted between your phone and Mac. The relay briefly holds encrypted copies for delivery and keeps no copy of your code. What your agent itself sends to its provider, GitHub or the internet is covered under The coding agent you run, below.
• Held briefly, then deleted. The relay holds a sealed message only until your phone or Mac picks it up, and deletes it then. Anything not picked up is deleted within 6 minutes.
• Live connections. While the app is open and the Mac program is running, both stay connected to the relay, which joins them so messages arrive at once. The relay can tell the two belong to the same pairing, but it can’t read what passes between them. Closing the app closes its connection.
• Lock-screen notifications. To reach your phone while the app is closed, the relay sends Apple one fixed sentence, such as “Claude Code needs you”. The relay and Apple handle your push token (which tells Apple where to deliver the notification), the agent’s name, the kind of event and when it was sent. They don’t receive your command or conversation text. The Mac stores the token until notifications are disabled, Apple invalidates it, or the phone is unpaired.
• Verifying the app. So that only the real Cipher app on a real iPhone gets full use of the relay, the app proves itself with Apple’s App Attest. The relay keeps a hashed key ID, an encrypted public verification key, a counter that blocks reused requests, and the dates the record was created and last used. These records expire after 30 days unused. They are not linked to an account or used for tracking. Unpairing doesn’t remove this key. If a key is banned for abuse, we keep its hash, the date and the reason for up to 90 days. Records of keys that hit their limits are deleted after 30 days.
• Same network, to pair. During pairing, the relay compares the phone’s and the Mac’s network addresses to confirm their public networks match. These addresses are held briefly in memory to complete pairing and limit repeated attempts. Matching addresses don’t prove the devices are on the same home network: a VPN or a shared network can match too. Always compare all four words on your phone and Mac.
• Service totals. To keep the relay running, we count messages passed, pairings allowed or refused, and how often a phone or Mac was asked to slow down. We keep these totals for three months. They hold no address, phone or Mac, pairing or content: nothing that tells one person from another.
• What the network sees. Cipher’s servers see when your devices connect, how much they send and the network address they connect from, but not what they say. Like any internet service, our relay’s hosting provider sees basic traffic information, such as IP addresses and timing. We don’t log it.

What’s stored, and for how long

On your phone. Your pairing keys and the key that encrypts your history stay in the phone’s Keychain, on that phone only: they don’t move to another device through a backup. Your history and unsent messages are stored encrypted in the app. Previews of attachments may stay in the app’s cache until you delete them or unpair.

On your Mac. The Mac keeps its pairing secrets encrypted, and your conversations, jobs and unsent messages in files only your Mac account can read. These files can include commands and their output. The Mac keeps a copy of each message and reply until your phone has caught up, and never longer than three days or past the last 200 messages. Files and photos you send from your phone are saved in Downloads/Cipher on your Mac and stay there until you delete them, even if you uninstall Cipher.

Unpairing. Unpairing clears the history, unsent messages and pairing keys on your phone. If your Mac is offline, the phone keeps the unpair notice, with its keys still protected, until the Mac gets it; unpair on the Mac too if it can’t. Deleting the iPhone app alone may not unpair it, because iOS can keep Keychain data after an app is deleted. Unpairing doesn’t erase history or jobs on the Mac; delete them there, or uninstall, if you want them gone.

On the relay. The relay keeps a record that a pairing is in use, and its daily message and data totals (never content), until the pairing has gone unused for 30 days. Encrypted messages expire within 6 minutes. A separate pseudonymous usage log for each pairing is currently off; we’d update this policy before turning it on, and it would keep daily totals for up to 31 days. Service-wide totals aren’t linked to any pairing and are kept for three months, as above.

Who’s involved

Cloudflare runs the relay and serves the Mac program’s downloads. Apple delivers the app and its lock-screen notifications. Vercel hosts the website. Buttondown keeps the signup list.

The website is hosted by Vercel, which keeps standard request logs (such as IP address and pages visited) for a short time. The app uses Vercel only to show you these pages when you tap Terms or Privacy Policy.

The Mac program is downloaded from Cloudflare, which keeps standard request logs. Cipher doesn’t check for updates on its own: you get a new version by running the install command again. We may release a new version to some Macs first. The installer picks a random number and keeps it on your Mac; it’s never sent, but the download your Mac asks for shows which version it got.

The coding agent you run

Cipher lets you use an agent already on your Mac from your phone: Antigravity, Claude Code, Codex, GitHub Copilot, Grok Build, Muse Code or opencode. The agent may send your messages, code, files and photos to its own provider, push them to GitHub or use the internet, just as it does when you work at your Mac. The provider’s own terms and privacy policy apply, and it may collect data under your account with them. Cipher doesn’t control that, and this policy doesn’t cover it.

This website’s signup form

This website has one form: the signup near the bottom of the home page. If you use it, we keep the email address you give it and the platforms you tick (Windows, Linux, Android) with Buttondown, only to email you when Cipher runs on them. Buttondown stores your address as unconfirmed and sends you a link to confirm it’s you. You won’t get updates until you tap it. Unsubscribe any time.

To limit repeated signups, the form keeps keyed hashes of network addresses, not the addresses, in server memory for at most ten minutes. Our error logs never include submitted email addresses or the email provider’s replies.

Getting in touch

Help and feedback: feedback@cipherflow.dev
Security reports: security@cipherflow.dev