Overview
Push is a macOS application you install and run locally, with an optional iPhone companion app and browser extension. It is local-first: your workspace lives on your Mac, and this policy lists every path by which anything leaves your devices. It does not cover the AI agents you run through Push — those follow their own providers’ policies. A plain-language version of everything here lives in the docs.
What stays on your Mac
Push stores your workspace locally in ~/.push/: issues, sessions and run history, recordings and media, logs, configuration, and locally-stored secrets. Agent transcripts stay in each agent’s own local store (for example ~/.claude); Push reads them locally to render history and may keep a local archive copy under ~/.push/ so your history survives an agent’s own cleanup. None of this is uploaded to our servers.
What the Mac app sends to us
- Update checks. Push polls
releases.pushto.doon launch and periodically (about every 30 minutes) for a signed update feed. These requests carry your Push version and standard HTTP headers. We don’t set cookies and don’t fingerprint. - Anonymous telemetry (opt-out). One daily-active ping — app version, build, and a random device identifier never tied to an account — plus a small set of low-detail product events (for example, that a terminal tab was opened; never its contents). Crash and app-hang reports are sent with personal data stripped. Terminal contents, session transcripts, file contents, and issue text are never included. One switch controls all of this: Settings → Permissions → Send anonymous telemetry (on by default; turning it off takes effect on next launch).
- Sign-in (optional). If you sign in (Apple, Google, or GitHub), we store your account identity, avatar, and a random workspace fingerprint that lets your other devices discover your Mac. We do not store your issues, sessions, transcripts, recordings, or files.
If you never sign in, the Mac app’s only network traffic to us is update checks and — unless you opt out — telemetry.
The iPhone app and voice processing
Captures sync to your Mac, which is the system of record; the iPhone keeps a local, clearable cache. There is no cloud copy of your workspace on our servers and no iCloud database.
When you capture by voice while online, your recording (or, when a live transcript already exists, just its text — no audio) is sent to our processing service to be transcribed and structured into a todo. The audio copy used for processing is deleted within minutes of successful extraction, with a 24-hour sweep for any stragglers. Offline, on supported devices, processing runs entirely on-device instead. The full pipeline is documented in the docs.
The iPhone app contains no analytics SDK. It sends opt-out crash reports only (Manage → Privacy in the app): anonymous crash, hang, and termination reports with no account, personal data, voice audio, task content, or terminal contents.
Optional device pairing (relay)
If you pair an iPhone or browser with your Mac, both sides connect through our hosted relay at push-relay.com. The relay carries whatever your paired device requests from your Mac — issue text, comments, live session output, files. Traffic is encrypted in transit (TLS) on both legs and the tunnel is terminated at our relay infrastructure; it is not end-to-end encrypted today (end-to-end encryption at the relay layer is on our public roadmap). We don’t store or log message contents; the relay holds short-lived pairing tokens and connection metadata (device pair, last seen). Pairing is opt-in — the relay is never contacted until you pair — and every paired device can be revoked or blocked in Settings → Workspace → Devices.
Publishing
Creating a public link publishes a snapshot of that one item to our content domain. Links are created only by explicit action, are listed in the app, and can be revoked at any time. The trusted push.computer share page reads only the published title and item kind to create link-preview metadata; chat and social preview services may request that preview when the URL is pasted. Published file, session, or transcript bytes remain on the separate content domain and render in an isolated frame. Revoked, expired, and unavailable shares return a generic preview instead, and share pages are marked not to be indexed by search engines.
Meeting transcription (Beta)
If you enable meeting recording and add your own OpenRouter API key, recording audio is sent to OpenRouter for transcription on your key, only when you record. Without a key, recordings stay on your Mac untranscribed.
Agents you run
Push runs the agent CLIs you installed — Claude Code, OpenAI Codex, OpenCode, Hermes, or any other CLI as a plain terminal. Each agent calls its own provider directly from your Mac, on your credentials, under that provider’s policy. Push does not intercept, proxy, or mirror agent traffic, and never meters or marks it up.
Third parties
- Cloudflare — serves our website, release downloads, the relay, and published content.
- Apple — notarization (Apple may log that your Mac first ran a notarized app) and Sign in with Apple if you choose it.
- Google / GitHub — sign-in, only if you choose them.
- PostHog — anonymous telemetry (opt-out, see above).
- Sentry — crash reports (opt-out, see above).
- Speech and AI processing partners — voice captures from the iPhone app are transcribed and structured by our processing providers as described above.
- OpenRouter — Mac meeting transcription, on your own key.
- Agent providers (Anthropic, OpenAI, etc.) — only via agents you configure.
We don’t use advertising SDKs or any third-party service that fingerprints users.
Your rights
- Access / export — your workspace is in
~/.push/on your Mac. Account data can be exported from the iPhone app before deletion ( Export My Data First). - Deletion — drag Push.app to the Trash and remove
~/.push/to erase your workspace. Delete your account in the iPhone app ( Manage → Delete Account) to remove your identity from our servers; your local data is untouched because it was never on our servers. - Unpair — revoke any device in Settings → Workspace → Devices; no further messages route between devices.
Children
Push is not directed at children under 13. We don’t knowingly collect data from children.
Changes
We’ll update this policy as Push evolves. Material changes get a note in the changelog.
Contact
Questions or data requests: privacy@massless.ai.