Overview
Push is a macOS application you install and run locally, with an optional iPhone companion app and browser extension. It is local-first: your workspace lives on your Mac, and this policy lists every path by which anything leaves your devices. It does not cover the AI agents you run through Push — those follow their own providers’ policies. A plain-language version of everything here lives in the docs.
What stays on your Mac
Push stores your workspace locally in ~/.push/: issues, sessions and run history, recordings and media, logs, configuration, and locally-stored secrets. Agent transcripts stay in each agent’s own local store (for example ~/.claude); Push reads them locally to render history and may keep a local archive copy under ~/.push/ so your history survives an agent’s own cleanup. This workspace is not mirrored to our cloud. Device pairing, optional processing, diagnostics, and public sharing use the network paths described below.
What the Mac app sends to us
- Update checks. Push polls
releases.pushto.doon launch and periodically (about every 30 minutes) for a signed update feed. These requests carry your Push version and standard HTTP headers. We don’t set cookies and don’t fingerprint. - Anonymous telemetry (opt-out). One daily-active ping — app version, build, and a random device identifier never tied to an account — plus a small set of low-detail product events (for example, that a terminal tab was opened; never its contents). Crash and app-hang reports are sent with personal data stripped. Terminal contents, session transcripts, file contents, and issue text are never included. One switch controls all of this: Settings → Permissions → Send anonymous telemetry (on by default; turning it off takes effect on next launch).
- Sign-in (optional). If you sign in (Apple, Google, or GitHub), we store your account identity, avatar, and a random workspace fingerprint that lets your other devices discover your Mac. We do not store your issues, sessions, transcripts, recordings, or files.
If you never sign in, the Mac app’s only network traffic to us is update checks and — unless you opt out — telemetry.
The iPhone app and voice processing
The iPhone stores captures and a clearable workspace cache locally. Captures sync to a paired Mac when it is reachable. Captures made before pairing remain on the phone until they are synced or deleted. Push does not keep a cloud mirror of your workspace or an iCloud database.
Without your own provider key, Whisper transcribes audio on your iPhone. Apple Foundation Models can structure the transcript when Apple Intelligence is available; otherwise Push keeps the transcript. Downloading a speech model requires a network connection, but this local processing does not send audio or transcript text to Push or an AI provider.
If you add an OpenRouter key, the app sends audio and transcript text directly to OpenRouter and its selected model providers for transcription and extraction, using your provider account. Their privacy and retention policies apply. A failed provider request can fall back to local processing. Current production iOS does not silently switch to Push-funded hosted processing. Older app versions and developer-only tools may still use our legacy processing service. See voice capture.
Optional diagnostics are on by default. Sentry receives crash, hang, app termination, and performance reports, including app/device information, timing, stack traces, and a pseudonymous workspace identifier when paired. This identifier may be associated with your workspace. We do not attach voice audio, task text, file contents, or terminal contents to reports. Session replay is disabled. Turn off Share Diagnostics in Settings → Manage → Privacy; changes take effect on the next launch.
Device pairing and notifications
Sign-in uses Supabase to store your account identity, sign-in provider details, and workspace/device registrations. Pairing lets your phone discover and authenticate to your Mac. Our hosted relay transports the workspace data your device requests, such as issues, comments, terminal output, and files; it is not a cloud workspace backup.
Current compatible iPhone and Mac versions use end-to-end encryption for their paired channel when the Mac has published its encryption key. The relay can see connection metadata, message sizes, and timing, but cannot read the channel contents. A failed encrypted handshake does not fall back to plaintext. Older Macs or clients without this capability can still use a TLS-encrypted relay connection that terminates at our infrastructure. This protection does not cover separately published links or requests you send to an AI provider.
If you enable notifications, we store a device push token and use Apple Push Notification service to deliver alerts and Live Activity updates. Compatible paired devices receive encrypted notification content or generic alerts. Delivery metadata is still handled by the notification infrastructure. You can turn notifications off in iOS Settings and revoke a paired device from your Mac’s device settings.
Publishing
Creating a public link publishes a snapshot of that one item to our content domain. Links are created only by explicit action, are listed in the app, and can be revoked at any time. The trusted push.computer share page reads only the published title and item kind to create link-preview metadata; chat and social preview services may request that preview when the URL is pasted. Published file, session, or transcript bytes remain on the separate content domain and render in an isolated frame. Revoked, expired, and unavailable shares return a generic preview instead, and share pages are marked not to be indexed by search engines.
Meeting transcription (Beta)
If you enable meeting recording and add your own OpenRouter API key, recording audio is sent to OpenRouter for transcription on your key, only when you record. Without a key, recordings stay on your Mac untranscribed.
Agents you run
Push runs the agent CLIs you installed — Claude Code, OpenAI Codex, OpenCode, Hermes, or any other CLI as a plain terminal. Each agent calls its own provider directly from your Mac, on your credentials, under that provider’s policy. Push does not intercept, proxy, or mirror agent traffic, and never meters or marks it up.
Website visitors
Selected public marketing pages use PostHog and Vercel Analytics for page views and explicitly recorded product events. These services receive page paths and browser/device metadata; pseudonymous visitor identifiers may be stored by the analytics SDK. Query strings and fragments are removed before analytics events are sent. PostHog automatic interaction capture and session recording are disabled.
Authentication, account, and public-share routes are excluded from this analytics allowlist. Our hosting providers also handle standard network requests and their associated metadata to serve the website. App diagnostics switches control the apps, rather than website analytics.
Third parties
- Cloudflare serves release downloads, the relay, and published content. Vercel hosts this website and provides website analytics.
- Apple — notarization (Apple may log that your Mac first ran a notarized app) and Sign in with Apple if you choose it, plus App Store distribution and push notification delivery on iOS.
- Google / GitHub — sign-in, only if you choose them.
- PostHog handles Mac telemetry and the selected website analytics described above.
- Sentry handles optional crash and performance diagnostics as described above.
- Supabase stores account identity, sign-in details, and workspace/device registrations.
- OpenRouter and its model providers process optional iPhone voice requests and Mac meeting transcription when you configure your own key.
- Agent providers (Anthropic, OpenAI, etc.) — only via agents you configure.
We don’t use advertising SDKs or any third-party service that fingerprints users.
Your rights
- Access / export — your workspace is in
~/.push/on your Mac. Account data can be exported from the iPhone app before deletion ( Export My Data First). - Deletion — drag Push.app to the Trash and remove
~/.push/to erase your workspace. Delete your account in the iPhone app ( Manage → Delete Account) to remove your identity from our servers. The iPhone clears its local data, including captures that have not synced to a Mac. Your Mac workspace is kept and must be managed on that Mac. Revoke published links separately before deleting your account. - Unpair — revoke any device in Settings → Workspace → Devices; no further messages route between devices.
Children
Push is not directed at children under 13. We don’t knowingly collect data from children.
Changes
We’ll update this policy as Push evolves. Material changes get a note in the changelog.
Contact
Questions or data requests: privacy@massless.ai.