Privacy Policy

Last updated: 2026-10-27

1. Data that stays on your devices

iPhone

• The list of paired Macs (name, ID, key fingerprint, rendezvous service address) and your settings are kept in the app's own storage.
• The phone's private key is kept in the Secure Enclave (or, on devices without one, in the keychain, limited to this device) and never leaves the phone.
• The camera is used only to scan the pairing QR code. Recognition happens on the phone; images aren't saved or uploaded.
• Face ID is handled by iOS. The app only learns whether it succeeded and never gets your face data.

Mac

• The Mac's private key, the public keys and names of paired phones, the phones' Live Activity push tokens and DuoDesk Host's settings are kept in ~/Library/Application Support/DuoDesk/.
• A connection log is kept in ~/Library/Logs/DuoDesk/: when DuoDesk Host started, paired, connected and disconnected and why, the paired phones' names, and troubleshooting details such as how the connection was made. It rotates at 1 MB, stays on your Mac and is never uploaded.
• The Screen Recording and Accessibility permissions are used only while a paired iPhone is connected: to capture the screen for that iPhone and to carry out what it sends. The screen is never recorded or saved.

2. The connection between iPhone and Mac

• Each device has its own key pair. When pairing, the iPhone scans a QR code that only appears on the Mac's screen; from then on each side accepts only the other's public key (key pinning), and unpaired devices can't connect.
• Sessions use QUIC, encrypted with TLS 1.3. Everything in a session (the screen, touch and keyboard input, clipboard sync, display selection and so on) travels inside that encrypted connection, which only your iPhone and your Mac can decrypt.
• DuoDesk prefers a direct, peer-to-peer path (over the local network, or through the routers by hole punching). When that isn't possible, the encrypted packets go through Cloudflare's relay (see section 4). If both devices run Tailscale, a direct path may also go over the Tailscale network.

The technical details of pairing and connecting are on How it works.

3. The rendezvous service

We run a rendezvous service on Cloudflare Workers (rv.spailab.com) that helps your iPhone find your Mac and lets them exchange what they need to connect directly. It never handles session content.

What it sees

• While the Mac is online: DuoDesk Host keeps a connection open to the service. The service sees the Mac's IP address, the Mac's ID and public key (the ID is derived from the key and proves it's that Mac), and the Mac's computer name (the one in System Settings › General › Sharing, which may contain your name). The name is held only while that connection is open.
• When an iPhone pairs or connects: the service sees the iPhone's IP address, which Mac it wants and when. The request is passed to the Mac as is, without the service reading it (except the push token, see section 5). It contains both devices' network addresses (local and public addresses and ports), one-time connection credentials, and the fingerprint of the iPhone's key with a signature; when pairing, the iPhone's public key and its device name (iOS only provides a generic name such as “iPhone”). These pass through and aren't stored.
• Online status: anyone who knows a Mac's ID can ask the service whether it's online. The answer is only “online” or “offline”.

What it keeps

The only things it keeps long-term are two items for Live Activity pushes, stored separately for each Mac (see section 5):

• SHA-256 hashes of push tokens (not the tokens themselves) and when they were registered, up to 32 per Mac, the oldest replaced by newer ones.
• The IDs of the Live Activity push channels the Mac created, up to 2 per push environment.

Logs

• The service's own log records events only: a Mac came online, a connection request was forwarded, the Mac accepted or rejected it (and why), how long it took, and the status Apple returned for a push. Entries carry only the first 6 characters of the Mac's ID, with no IP addresses, keys, tokens or push contents.
• To prevent abuse, the service counts requests per minute by IP address and by Mac ID and turns away requests over the limit.
• Cloudflare operates the platform the service runs on. It processes requests (including IP addresses) under its own privacy policy and keeps platform logs for a limited time.

4. Cloudflare relay and address lookup

• Address lookup (STUN): for every connection, both devices ask Cloudflare's STUN server (stun.cloudflare.com) for their public address so they can try a direct path. Cloudflare sees the devices' IP addresses.
• Relay (TURN): when a direct path isn't possible, the encrypted session data goes through Cloudflare TURN (turn.cloudflare.com). Cloudflare sees both devices' IP addresses and ports, how much data is sent and when, but not the content. Relay credentials are issued only after the Mac accepts a connection and expire after 12 hours.

5. StandBy panel (Live Activity)

The StandBy panel shows the status and usage of Claude Code and Codex on your Mac on your iPhone's Lock Screen and in StandBy. It's on by default. You can turn it off in DuoDesk's settings on the iPhone (“Show Claude / Codex Status in StandBy”), or turn off Live Activities for DuoDesk in the iPhone's Settings › DuoDesk.

What the Mac reads

• DuoDesk Host reads, without changing them, the session files Claude Code and Codex keep on your Mac, to learn which tasks are running and which are waiting for you. The files aren't modified or sent anywhere as a whole; only the summary listed under “What is pushed” leaves the Mac.
• Usage: DuoDesk Host uses the sign-in Claude Code already has on this Mac to ask Anthropic for your subscription usage, and asks the Codex program on this Mac, which in turn asks OpenAI, for Codex usage. These requests go straight from your Mac to Anthropic and OpenAI. They don't pass through our servers, and your credentials are never sent to us.

What is pushed, and how

• A push contains: the Mac's name; up to 6 tasks, each with its title (the session name, or the start of the latest prompt if there is no name, up to 28 characters), project folder name, state and current step (up to 40 characters); and usage percentages with their reset times.
• The Mac sends this through our rendezvous service to the Apple Push Notification service (APNs), which delivers it to your iPhone. The rendezvous service handles it only in transit and neither logs nor stores the contents. Apple processes pushes under its own privacy policy.
• Push token: each time your iPhone connects to a Mac, it includes the push token iOS assigned to DuoDesk's Live Activity, which the rendezvous service passes to the Mac. Once the Mac accepts the connection, the service keeps only a hash of the token, so that a Mac can push only to phones that have connected to it.

6. Purchases (DuoDesk Pro)

• DuoDesk for iPhone is free to download. Connecting to a Mac requires DuoDesk Pro, an auto-renewing subscription sold through the App Store. DuoDesk Host for Mac is free.
• Apple handles the purchase, billing, renewals, cancellations and refunds with your Apple Account, under its own terms and privacy policy. We never receive your payment details. Apple gives us sales reports, such as how many subscriptions were sold in which countries, without your name, email address or payment details.
• The app checks whether your subscription is active on the iPhone itself, using Apple's StoreKit. Nothing about your purchases or subscription is sent to our servers; the rendezvous service neither receives nor checks it.
• DuoDesk's terms of use are Apple's standard Licensed Application End User License Agreement.

7. What we don't do

• We don't sell data, show ads or build profiles.
• The apps contain no analytics, crash-reporting or advertising SDKs. If you chose to share with app developers under iOS Settings › Privacy & Security › Analytics & Improvements, Apple provides us with anonymous crash reports and usage statistics under its own policy.
• We don't collect your name, email, phone number, location, contacts, photos or similar personal information.

8. Third parties involved

9. Retention and deletion

• Data on your devices: delete a Mac in the iPhone app or delete the DuoDesk app; on the Mac, remove paired phones from the menu, or uninstall DuoDesk Host and delete the two folders named in section 1.
• Push token hashes and channel IDs on the rendezvous service: kept until newer entries replace them. To have them removed sooner, contact us.
• Connection details and push contents passing through: not stored.

10. Other

• International processing: Cloudflare and Apple run servers worldwide, so connection details and pushes may be processed in data centers outside your country or region.
• Children: DuoDesk isn't directed at children and doesn't knowingly collect personal information from anyone.
• This website: is hosted on Cloudflare. It uses no cookies, analytics or third-party scripts, and we don't keep access logs. As the host, Cloudflare processes requests (including IP addresses) under its own privacy policy.
• Changes: when the way DuoDesk handles data changes, we'll update this page and the date above.

11. Contact

For privacy questions or deletion requests, write to duodesksupport@signalplus.com.