Privacy Policy
The short version
Claude Code Notifier is built so that we cannot read your data, rather than promising that we won’t. Everything content-bearing — prompts, commands, file paths, Claude’s responses, your replies — is encrypted on your Mac with a key that only your Mac and your iPhone possess. Our relay stores and forwards ciphertext. There are no accounts with emails or names, no analytics in the apps, and nothing to sell.
How the architecture protects you
When your Mac has something to tell your phone, it encrypts the event with ChaCha20‑Poly1305 using a 32-byte key generated on your Mac at pairing time. That key is delivered to your iPhone only inside the pairing QR code — it crosses the gap between your Mac’s screen and your iPhone’s camera and never transits our servers. The relay (a Cloudflare Worker) receives an opaque encrypted blob plus the minimal metadata needed to store and route it. Decryption happens on your iPhone, inside the app and its Notification Service Extension.
Replies flow the same way in reverse: your approval, denial, or message is encrypted on the phone and decrypted on the Mac.
What the relay stores
Per paired account, the relay keeps exactly this:
| Data | Why | Retention |
|---|---|---|
| Encrypted event envelopes (ciphertext blob, event ID, timestamp, category, blob size) | So your phone can catch up on missed events | Ring buffer of the most recent 1,000 envelopes — older ones are overwritten, not archived |
| Encrypted reply envelopes | Queued for delivery if your Mac is briefly offline | Until delivered to the Mac |
| Auth token hashes (SHA-256) | Authenticating your Mac and devices — we store hashes, never the tokens themselves | Life of the pairing |
| APNs device token and environment (sandbox/production) | Delivering push notifications to your iPhone | Until the device is unpaired |
| Device name you chose at pairing (e.g. “Richard’s iPhone”) | So the Mac app can show you which devices are paired | Until the device is unpaired |
| Pairing codes (hashed) | Completing a pairing | Single-use, expire after 10 minutes |
The category is one coarse word — permission, attention, complete, or info — used to pick the right notification actions and urgency. It carries no content.
What the relay can never read
- Your prompts and Claude’s responses
- Commands, tool inputs, and tool outputs
- Your code, file paths, directory and project names
- The content of your replies, approvals, and denial reasons
- Anything else inside the encrypted blob
This is not a policy choice we could quietly reverse — the relay never receives the key, so there is nothing it could decrypt.
What Apple sees
Push notifications are delivered through the Apple Push Notification service (APNs). The payload APNs carries contains a generic placeholder alert (“Claude Code — Notification”) plus the same encrypted blob; your iPhone decrypts it locally and rewrites the notification before you see it. Apple also necessarily knows that a push was sent to your device at a given time, as with any app using APNs.
Identifiers, not identities
There is no signup. Pairing creates a random server-generated account identifier and random tokens — no email address, name, or phone number is requested or stored by the relay. Payment for the optional iOS Pro subscription is handled entirely by Apple through the App Store; we do not receive your payment details.
Analytics
- In the apps: none. The Mac and iOS apps contain no analytics, no crash-reporting SDKs, and no third-party trackers.
- On this website only, we use Umami, a privacy-focused, cookie-free analytics tool, to count page views. It does not track you across sites and collects no personal information.
Data retention and deletion
- Encrypted events live in a ring buffer capped at 1,000 entries per account; new events overwrite the oldest. There are no long-term archives and no backups of event content.
- Unpairing a device from the Mac app revokes and removes its registration and APNs token.
- Removing the pairing entirely deletes the account’s stored state on the relay. Any residual ciphertext is unreadable without the key, which only ever existed on your devices.
- To request deletion or ask anything about your data, email us (below).
Service providers
The relay runs on Cloudflare Workers (infrastructure hosting the ciphertext described above) and pushes are delivered via Apple APNs. Neither receives your encryption key. If you prefer zero third parties, the backend is self-hostable on your own Cloudflare account.
Children
Claude Code Notifier is a developer tool and is not directed at children under 13.
Changes to this policy
If we change this policy, we’ll update this page and the effective date above. Material changes to what the relay stores would also be called out in release notes, since they would require a protocol change.
Contact
Questions or requests: richard@techkudos.com
Affiliation
Claude Code Notifier is an independent project by touchtap. It is not affiliated with, endorsed by, or sponsored by Anthropic. Claude is a trademark of Anthropic, PBC.