Account & relay

The terminal needs no account. You can download Push, run agents in it for months, and never sign in — everything stays on your Mac. An account exists for exactly one reason: connecting other devices to that Mac.

What signing in adds

Sign in with Apple, Google, or GitHub (Settings → Account) to unlock:

• Your iPhone as a companion — capture by voice, watch live terminals, answer approvals from anywhere.
• Publishing — share a file or item as a public link.
• One identity across devices. You can link several providers to the same account (Connected Accounts), so "Sign in with Apple" on your phone and "Continue with GitHub" on a new Mac land in the same place.

When you're signed in, our servers hold your account identity (from the provider you chose), your avatar, and a workspace directory entry — a random fingerprint that lets your phone discover your Mac. They do not hold your issues, sessions, transcripts, recordings, or files; those live on your Mac.

The relay

Your phone usually can't reach your Mac directly — different networks, no port forwarding. The relay is our hosted tunnel that carries requests between your paired devices and your Mac.

What transits it is whatever your phone asks your Mac for: issue text, comments, live session output, files the Mac serves. The straight answer on its security posture:

• Traffic is encrypted in transit (TLS) on both legs.
• The tunnel is terminated at our relay infrastructure — it is not end-to-end encrypted today. End-to-end encryption at the relay layer is on our public roadmap.
• We don't store or log message contents; the relay holds pairing tokens and connection metadata (device pair, last seen).
• Pairing is explicit (QR / one-time link), and every paired device is listed under Settings → Workspace → Devices, where you can Revoke or Block it, or Disconnect All Devices.

If that posture doesn't fit your threat model, simply don't pair a phone: the relay is never contacted until you do.

Publishing

Create link on a file or item publishes a snapshot to a separate content domain and shows you the link once — links can't be retrieved again later, only revoked. Active links live under Publishing → Published; Stop publishing removes one. Publishing file generations is additionally gated by the Allow file publishing switch, which only a human can flip.

Live links expose their title and item kind to the trusted Push frame so chat and social apps can show a useful preview. The published bytes stay on the separate content domain. Revoked, expired, and unavailable links use a generic preview. All share pages are marked not to appear in search indexes. The full boundary is in How Push handles your data.

Leaving: signing out, disconnecting, deleting

Three different verbs, deliberately kept apart (the iPhone app spells out each one before you confirm):

• Sign Out — logs this device out and drops its Mac pairings. Your account and your data stay; sign back in anytime.
• Disconnect — unpairs this iPhone from a Mac but keeps you signed in. "Your Mac and everything on it are untouched."
• Delete Account — removes your account and sign-in identity from our servers (type DELETE to confirm). You're offered Export My Data First. Your actual work isn't on our servers to begin with: "Your todos, files, and voice recordings live on your Mac — deleting your account doesn't touch them."