Privacy Policy

1. Scope

Pi Remote is a mobile client for Pi, a coding agent that runs on a Linux server you control. It lets you start and follow Pi sessions, review file changes, and manage tasks from your phone.

This policy explains what information is involved when you use Pi Remote, where it is stored, and what we do and do not receive. It applies to the app and to the optional server-side agent you install on your own server.

2. Who we are

Pi Remote is published by Jimmy (“we”, “us”). For privacy questions, contact a2libra@outlook.com. We respond within 15 business days.

Pi Remote has no account system and no operator backend. We do not receive the content you create in the app, so most requests about that content can be handled directly on your device or server. Section 12 explains how.

3. Information stored on your device

The app stores the information needed to connect to your servers and remember your settings. It is kept in the app’s private storage and is not sent to us.

3.1 Server connection details

When you add a server, the app stores the details you enter, such as a name, address, port, username, authentication method, and a fingerprint used to recognise the server’s SSH host key. It also records when the server was added and last used.

3.2 Credentials

Passwords, private keys, passphrases, the per-server agent access token, and any model provider API keys you choose to keep on your phone are stored in the device’s system keychain or keystore. They are not placed in ordinary app preferences or in the app’s logs.

3.3 Preferences

The app stores appearance settings, your chosen language, the current model and thinking level, the last workspace and session, and a short list of recently used directories.

3.4 Content that is not stored on your device

Conversations, tool activity, file differences, usage and cost are kept by the agent on your server. The app reads them through your connection and displays them while it is open. It does not keep a separate copy on your phone.

Code files are read only when you open a file or a difference. They are displayed, not cached.

A note about the operating system. Your device may capture a snapshot of the app for the task switcher, and text you copy may enter the system clipboard. These are operating-system features; take care when sharing your screen or lending your device.

4. Information stored on your server

When you install the optional agent, it stores the information needed to run tasks on your server:

• task records and event logs, including prompts, model output, tool activity, file differences, and usage information;
• Pi session files;
• a temporary baseline of the workspace, where the workspace is a Git repository;
• a per-server access token;
• model provider keys, only if you choose to save them on the server.

These files are kept in the agent’s data directory and in Pi’s own configuration and session directories. We cannot access your server, and the retention, backup and deletion of this information are under your control. The app installs and updates the agent over your SSH connection and does not send your content to us.

5. How information is transmitted

• Between your phone and your server. The app connects over SSH. On first connection, it shows the server’s host key fingerprint so you can verify it; if the fingerprint changes later, the app stops the connection.
• Between the app and the agent. The app reaches the agent through an encrypted SSH tunnel. The agent is not exposed to the public internet and requires the per-server access token.
• Between your server and your model provider. Your server sends the model, prompt, relevant code context and tool results directly to the model provider you choose. This connection does not pass through us and is governed by that provider’s privacy policy and terms.
• Debug builds. A development build may be configured to connect to a local test agent. Release builds use the SSH connection described above.

6. What we do not collect

We do not collect, upload or store your prompts, code, file differences, model replies or usage. We have no technical means to read them.

We also do not:

• use advertising, analytics, crash-reporting or behavioural-tracking services in the app;
• read your contacts, photos, location, microphone, camera, health data or clipboard, except for text you choose to copy or paste;
• request notification permission in this version;
• build user profiles, personalise content, or track you across apps or websites;
• sell, rent or exchange personal information.

7. Third-party services

The app store console may show us aggregate download numbers, ratings and crash reports you choose to share. That information does not contain your conversations and cannot identify your code or prompts.

8. Permissions

The app needs network access to connect to your server. On iOS, it also uses local network access to reach the encrypted tunnel on your device. This version does not request camera, photo library, microphone, location, contacts or notification permissions. If a future version adds a permission, it will explain why and ask for your authorisation when it is first used.

9. Why we process information

Most of the processing described above happens on your device and your server, under your control. Where the law requires a legal basis, we rely on:

• performance of our agreement with you, to provide the app’s features;
• your consent, for optional settings and for any information you choose to send us;
• our legitimate interest in keeping connections secure and preventing abuse;
• legal obligations, when we respond to lawful requests.

We do not use your content for automated decision-making or targeted advertising.

10. Retention

• On your device: connection details, preferences and credentials remain until you delete them or uninstall the app. Some iOS keychain entries may remain after uninstall; see section 12.3.
• On your server: task records, sessions and baselines remain until you delete them. We cannot delete them for you.
• Information we hold: we do not hold your app content. An email you send us is deleted within 30 days after your question is resolved.

11. Sharing and disclosure

We do not sell your information or share it with third parties, because we do not hold it.

Information can leave your device or server only when:

1. you configure a connection, such as SSH to your server or your server’s connection to a model provider;
2. you export or copy content, such as a file difference or a session;
3. we receive a lawful request from a court or authority. We can provide only what we actually hold, which does not include your conversations or code. Where the law allows, we will tell you about the request.

12. Security and important limitations

12.1 Measures we take

• Credentials are stored in the system keychain or keystore.
• The app shows the server’s host key fingerprint on first connection and stops if it changes.
• The agent is reached through an encrypted SSH tunnel, is not exposed to the public internet, and requires a per-server access token.
• The agent does not keep request logs containing your content.
• Where the workspace is a Git repository, the app records a baseline so the changes made by a task can be reviewed and reverted.
• Model provider keys stay on your phone by default and are passed to Pi only for the task that needs them.

12.2 Limitations you should know

• There is no sandbox. Pi runs with the permissions of the server user that started it and can reach anything that user can reach. We do not claim isolation in the interface.
• Other processes running as the same user can read the access token. The protection is between you and other users of the server; it does not protect you from programs running under your account, or from an administrator.
• A compromised server or device is outside our controls.
• A provider key may be briefly visible on the server. Depending on the provider and how Pi is invoked, other users on the same server may be able to see a key while a task is running. If this matters to you, use server-side authentication or a provider that receives the key through an environment variable.
• Keys you save on the server are readable there. If you choose to save a model key on the server, it is stored in Pi’s configuration and can be read by processes running as your user or by an administrator.
• Third-party providers are outside our control. Once information reaches a model provider, its retention, training and international transfer practices are governed by that provider’s policy.

12.3 Deleting your information

1. Remove the server entries you no longer need in the app. This also removes the matching credentials and access token.
2. Delete any model API keys saved in the app.
3. Uninstall the app. iOS note: keychain entries can survive uninstall in some cases. Check Settings → Passwords, or erase the device to remove them.
4. On your server, stop the agent, delete its data directory, and remove any model keys you saved there. If you also want to remove Pi’s sessions and configuration, delete them separately.
5. Revoke any API keys you no longer use in the model provider’s console.

13. Your rights

Where the law gives you rights such as access, correction, deletion, restriction, objection, withdrawal of consent or a copy of your information, you can exercise them as follows:

Because we do not hold your content, most requests can be completed directly on your device or server. If you need help, email us and we will respond within 15 business days.

14. Children

Pi Remote is a developer tool for people who can enter into a binding contract. It is not directed to children. If you are under 18, use it only with the knowledge and consent of a parent or guardian, who is responsible for your use. We do not knowingly collect personal information from children.

15. International transfers

We do not transfer your information. If your server or the model provider you choose is outside your country or region, your configuration sends information there. You are responsible for assessing the legal requirements that apply.

16. Changes

We may update this policy when the app or the law changes. The new version will be published at https://legal.orga.day/pi-remote/privacy/ with a new “Last updated” date. If the change is material, we will also highlight it in the app or on this site. Continuing to use the app after the change means you accept the updated policy. If you do not agree, stop using the app and uninstall it.

17. Contact

• Operator: Jimmy
• Address: China
• Email: a2libra@outlook.com
• Response time: within 15 business days

Appendix: one-page summary