Privacy Policy
Last updated: October 2026
Chill (the iPhone/iPad/Apple Watch app) and Chill Server (the companion Mac app) are built so that there is nothing for this policy to disclose beyond what's below — there is no Chill cloud, no account system, and no analytics. The one hosted piece is a notification relay, described below.
What we collect
Nothing is stored. Neither app sends any data to us (the developer) or to any third party, with one narrow exception: if you allow notifications, alert text passes through our push relay on its way to Apple (see "Notifications"). There is no analytics SDK, no crash reporter, and no other third-party service built into either app.
What the apps actually do with data
- The iPhone/iPad/Watch app connects only to the Mac you explicitly pair it with, over a direct, end-to-end encrypted connection (per-device keys; a relay, when one is needed to get through NAT, only ever forwards encrypted bytes and steps aside once a direct path is available). That Mac is yours. We never see this traffic, and it never passes through any server we operate (the notification relay below is the only exception, and it never carries this traffic).
- Your code, your agent transcripts, and your Claude Code / Codex API credentials stay on your own Mac. They are never uploaded to us, because there is nowhere for them to go — the app has no backend.
- Local preferences (things like whether approvals are shown, sound settings, which hub you last used) are stored only in the app's own local storage on your device, never transmitted anywhere.
Notifications
If you allow notifications, the app registers with Apple Push Notification service and gives the resulting device token to the Macs you pair with. When a reply is ready or an approval is waiting and you don't have that chat open, your Mac sends a short alert (a title such as "Claude needs approval · Fix login bug" and one line of text) to our push relay, which forwards it to Apple for delivery. The relay sees that alert text and your device token, forwards them, and keeps nothing: it has no database and does not log alert contents. It never sees your code, your transcripts, or your API credentials. You can turn notifications off in iOS Settings at any time, and self-hosters can point their Mac at their own relay instead of ours.
In-app purchase
The one-time "Unlock Chill" purchase is processed entirely by Apple through StoreKit. We never see your payment information — Apple's own privacy policy covers that transaction, not this one.
To unlock every Mac you pair without re-purchasing, your device signs a small proof-of-purchase claim (which product you bought and when) locally and sends it to a Mac you've paired with, which verifies it offline. This claim contains no personal information beyond the fact of the purchase, and it is never sent to us — only between your own devices.
Children's privacy
The app is a developer tool, not directed at children, and collects nothing from anyone regardless of age.
Changes to this policy
If this ever changes — for example, if a future version adds an optional cloud feature — this page will be updated first, and the change will be reflected in that version's release notes.
Contact
Questions: open an issue at github.com/Jian130/ai-studio/issues.