How Push handles your data
What stays on your machines, what leaves them, where it goes, and for how long — the complete map.
Push is local-first. The Mac app runs everything on your machine, works without an account, and treats your Mac as the system of record — your iPhone is a window into it, not a second copy in someone else's cloud. This page is the complete map of what lives where and what ever leaves. If a claim here and anything else disagree, tell us — this page is meant to be checkable.
On your Mac
Everything Push manages lives under ~/.push/ in your home folder:
- The workspace database — issues, sessions, run history, feed items.
~/.push/storage— recordings, images, and files attached to issues.- Logs, caches, and locally-stored secrets.
- Relay pairing and sign-in identity, if you use them.
You can see this inventory inside the app under Settings → Workspace → Your data, which also surfaces whether FileVault disk encryption is on.
Agent transcripts stay where your agent put them. Claude Code keeps its
JSONL files in ~/.claude, Hermes keeps SQLite in ~/.hermes, and so on.
Push reads those local stores to render session history — it never uploads
them.
Session archive. Some agent CLIs delete their own old transcripts after a
retention window. Push keeps a local copy of a session's transcript under
~/.push so your history survives the agent's cleanup. This archive never
leaves your Mac, and Settings → Workspace → Purged session history → Clear
purged history deletes it.
What leaves your Mac
| Where | What | When |
|---|---|---|
releases.pushto.do | Update check against a signed feed: your Push version and standard HTTP headers. | About every 30 minutes, and on launch. |
| Telemetry (see below) | One anonymous daily-active ping and a small set of low-detail product events. | Daily / on certain actions, unless you opt out. |
| Crash reporting | Crash and app-hang reports with personal data stripped. | On a crash or hang, unless you opt out. |
| Sign-in (optional) | Your account identity and a random workspace fingerprint so your phone can find your Mac. No issues, sessions, or transcripts. | Only if you sign in. |
| The relay (optional) | Whatever your paired phone or browser requests from your Mac — issue text, comments, session output, files it serves. | Only if you pair a device. See Account & relay. |
| Publishing (explicit) | A snapshot of the one item you chose to publish, plus its title and item kind for the link preview. Revocable. | Only when you click Create link. |
| Meeting transcription (Beta) | Recording audio, sent for transcription on your own OpenRouter key. Without a key, recordings are saved but not transcribed. | Only when you record a meeting. |
| Your model providers | Your agents (Claude Code, Codex, OpenCode, Hermes) call the providers you configured, directly, on your credentials. Push never proxies, intercepts, or mirrors that traffic. | Whenever an agent runs. |
Nothing else. There is no background sync of your workspace to our servers — if you never sign in, the only network traffic is the update check and (unless you opt out) telemetry.
Telemetry
The Mac app sends one anonymous daily-active ping — app version, build, and a random device identifier that is never tied to an account — plus a handful of low-detail product events (for example, that a terminal tab was opened; never its contents). Crash and hang reports carry no personal data.
One switch controls all of it: Settings → Permissions → Send anonymous telemetry. It is on by default; turning it off takes effect on the next launch. Terminal contents, session transcripts, file contents, and issue text are never part of telemetry — with it on or off.
The iPhone app contains no analytics at all — only opt-out crash reporting, described in the app itself as sharing "anonymous crash, hang, and watchdog termination reports … No account, personal data, voice audio, task content, or terminal contents." The toggle is Manage → Privacy → Share Anonymous Crash Reports.
What leaves your iPhone
Voice capture is the one iPhone feature that talks to our processing service: when you're online, your recording (or just its live transcript) is sent for transcription and structuring, and the audio copy used for processing is deleted within minutes of extraction. The full pipeline — including the offline on-device path and exactly what the request contains — is documented in What happens to your audio.
Everything you capture syncs to your Mac, which is the system of record. Your iPhone keeps a local cache of recordings and images and re-downloads from the Mac on demand — Settings → Transcription & Data → Clear Cache frees the space anytime. There is no iCloud copy of your Push data.
Public links
Publishing a file or item creates a share link on a separate content domain, shown to you exactly once. Anyone with the link can view that one item — nothing else. Every active link is listed under Publishing → Published, and Stop publishing / Revoke kills it. Nothing is ever published without you clicking Create link.
The trusted push.computer link frame reads only the published title and item kind
to make a useful link preview. Chat and social preview services may fetch that preview
when someone pastes the URL. The shared file, session, or transcript bytes remain on
the separate content domain and are never read into the trusted site origin. Revoked,
expired, and unavailable links stop returning their title and use a generic preview;
share routes are also marked not to appear in search indexes.
Leaving
Your workspace is yours to delete: quit Push and remove ~/.push/ and it's
gone — we can't return what we never had. Account removal, unpairing devices,
and data export are covered in
Account & relay.