Privacy Policy

The app

CompilePilot does not require an account and contains no advertising, tracking, or remote analytics. Non-secret connection information remains on the device. SSH credentials and host fingerprints are stored in the device Keychain.

Technical dictation

The microphone in agent sessions requests microphone and speech recognition permissions. Audio is processed on your iPhone or iPad and is neither saved nor sent. The draft and project vocabulary remain in memory; only a model with fixed technical phrases and your language choice are stored locally. When you tap Insert, the text travels to your Mac through the session channel. If on-device recognition is unavailable, you can use the keyboard.

Connections to your Mac

Your device communicates directly with a Mac you choose. CompilePilot operates no relay: your source code, projects, build results, binaries, and sessions never pass through a server of ours, and we store none of them. The only thing that can pass through a server of ours is the optional notifications described below.

The Mac Companion

The Companion is an optional, free Mac app, downloaded separately. It advertises itself on your local network over Bonjour, under the service type _compilepilot._tcp, so your device can find it without you typing an address. Pairing starts on the Mac, with a six-digit code you enter on the device; the resulting token is stored in the Keychain on each side. There is no account and no registration: the Companion talks only to the devices you paired.

To update itself, the Companion periodically checks its release feed hosted on GitHub. GitHub receives that request, not us, and it is governed by GitHub’s policies. Apart from that, the Companion only connects out on its own if you turn on notifications away from your local network on your device: it then sends each notification, encrypted, to the address your device gave it, as described below. It transmits none of your code, projects, or build results.

What runs on your Mac when you ask

Some actions you start from CompilePilot run tools on your Mac that connect to services you configured, over SSH or through the Companion: fetching with git talks to your repository’s remote, resolving Swift packages talks to their sources, and uploading a build talks to App Store Connect. Those connections leave your Mac, with your credentials, for those services, and are governed by their policies. CompilePilot neither receives nor relays any of that traffic.

Coding agents

With the Companion, CompilePilot can open a coding agent you already have installed on your Mac, such as Claude Code, Codex or opencode. These are third-party tools: they run on your Mac, with your account, and talk to their own provider just as they do when you use them on the Mac, under that provider’s policies. What the session shows travels only between your Mac and your device, directly: over your local network or your tailnet. The session does not pass through CompilePilot servers. Context you choose to hand off to another agent is handled as described below.

Images for agents

If you choose an image from Photos or the clipboard for an agent session, the app prepares it on your device, removes location data, and sends it directly to your Mac over the authenticated connection. The Companion keeps a copy in your user cache, outside the project, and pastes its path into the session so the agent can read it. The agent may send the image to its provider according to your configuration and that provider's policies. The image does not pass through CompilePilot servers. Mac cache copies older than seven days are removed when you attach another image; you can also delete them from that folder.

Agent handoff

When you ask to continue or review with another agent, the Companion prepares a private package on your Mac outside the project. It contains your note, Git evidence and, when available and requested, a bounded summary from the source agent. OpenCode and Codex use assisted context: your note and Git; their internal histories are not read and the conversation is not automatically exported. You can review the contents before confirming. The destination agent reads this package under its normal permissions and may send it to its provider according to its configuration and policies. The package is not sent to CompilePilot servers.

The package is limited to 64 KiB, the note to 8 KiB and a requested summary to 32 KiB. The Mac stores the package and recovery record in files accessible only to your user; the device persists only an identifier to recover the operation. Cancelling removes the package and current preview, but the recovery record may retain the original note for 24 hours. Abandoned drafts and failed operations are cleaned up after 24 hours without activity. For started destinations, the 24-hour period begins when closure is verified; context for a live destination or an uncertain outcome is retained to avoid losing it or launching twice. Cleanup happens when operations are reconciled or closed: it does not run while the Companion is off. Package contents are not added to logs or process arguments; those contain only a fixed instruction and the package path.

Notifications away from your local network

This is optional and off by default. If you turn it on in the app’s settings, your Mac can notify you when a build finishes or a coding agent is waiting for you, even when your device is not on your local network. Only Macs with the Companion send these notifications. With the setting off, the app connects to no server of ours.

When you turn it on, your device registers its Apple push notification token with our notification service, which runs on Google Cloud (Firebase) and delivers notifications through Apple Push Notification service (APNs). In return it gets a ticket encrypted by the service, which it passes to each paired Mac over your local network, together with an encryption key it generates itself. That key never reaches our service, and the Mac never sees your token.

Our service sees your push token, once, when your device registers; the ticket; and each notification as encrypted bytes it cannot decrypt. Your device decrypts the notification and shows its real text. Live Activity updates on the Lock Screen are the exception: iOS receives them without additional CompilePilot encryption. Build updates carry only the phase, progress, estimated end time, and result. Agent updates carry only the state, step counts when supplied by the agent, and update or expiry times. They never include task titles, instructions, terminal text, paths, or project, scheme, or Mac names. Step titles travel only over the authenticated direct connection between your device and your Mac. Like any web service, it also receives the IP address of the device or Mac that contacts it.

Our service stores nothing: it has no database, and it does not log push tokens, tickets, or notification contents. Google may process technical information needed to run it, such as IP addresses and request logs, under Google’s policies, and Apple delivers the notification under its own. The ticket and the key are kept in the Keychain of your device and of each Mac. Turning the setting off, or unpairing a Mac, deletes the subscription from that Mac.

Simulator screenshots and recordings

When you request a screenshot or recording from the mirror, the Companion creates a PNG or MP4 file on your Mac's Desktop. macOS may ask for permission to access that folder. The original stays there even if you edit or discard the copy on your device. The Mac keeps a local capture record so pending transfers can resume; only the paired device that created the capture can retrieve it through the Companion API.

Files download directly from your Mac over the authenticated connection, without passing through CompilePilot servers. The app keeps its queue and downloaded copies in local app storage. Downloading over a metered or constrained network asks for permission for that file; you can leave it waiting for Wi-Fi. Saving to Photos is optional and uses add-only permission; sharing uses the system share sheet and the destination you choose. The app does not need to read your photo library. Demo media is generated locally and does not capture your Mac.

This website

This is a static website. It uses no cookies, accounts, advertising pixels, or analytics tools. Firebase Hosting may process technical information needed to deliver the site, such as IP addresses and request logs, under Google’s policies. The same domain also serves, under /api/push, the notification service described above; browsing the site never uses it.

Support email

If you email compilepilot@gmail.com, Google processes the message through Gmail. We keep the content and your address only to respond and follow up on the case. You may request deletion by emailing the same address.

Changes and contact

We will publish material changes here. For privacy questions, email compilepilot@gmail.com.