Privacy Policy

What sophonz's apps, account service and website keep, and where anything goes.

Effective 11 October 2026

This policy covers the iPhone and Android apps "sophonz" (iPhone bundle id io.sophonz.terminal, Android package io.sophonz.st, "the apps"), the sophonz account service they can sign in to, and this website. They are made by sophonz labs, a team at INOBS Inc. ("we"). About the product, write to support@sophonz.io; for anything about your personal data, ceo@inobs.io.

What the apps do

The apps are clients for st, which you run on your own computer. They connect to that computer and show its terminal sessions on your phone. They contain no advertising and no tracking; the only data they send us is the diagnostics described below and, if you turn notifications on, what is needed to deliver them.

Kept only on your phone

• The machines you add (name, tunnel address, stable-link id) and your settings (theme, font, voice language and so on).
• Access tokens or cookies for each machine, and, if you sign in, your sophonz sign-in tokens and account email. These are stored encrypted: in the iOS Keychain, and on Android with a key held by the Android Keystore.
• A random id made when the app is installed, which lets several devices watch the same tmux session at their own window sizes.

None of this is included in cloud backups or transfers to a new phone. Uninstalling the app deletes it.

Sent to your own computer

When you connect to a machine, what you type, paste or dictate and choose to send, your window size, the install id and the access token go to that machine over HTTPS and WebSocket, and the terminal's output comes back. This is between you and your own computer: we do not receive or store it.

st's default tunnel runs over Cloudflare's network (for example trycloudflare.com), so traffic passes through Cloudflare on the way and is covered by Cloudflare's privacy policy. If you use another tunnel or address, it passes through that provider instead.

Diagnostics from the apps

The apps send us diagnostics so we can fix what breaks: crash reports and hangs, how long the app took to start, which of its four screens (Machines, Sessions, Settings, Terminal) was open, and the state of the phone around them. They go over HTTPS to our own collector at in.sophonz.ai.

• The app: version and build, package or bundle id, the SDK's version.
• The phone: make and model, operating system and version, CPU architecture, screen size, storage size, time zone and language, whether it is rooted, jailbroken or an emulator, and network type, power-saving, thermal and low-memory state.
• What happened: session start and end, startup timings, frame smoothness, and for a crash or hang, the error, its stack trace and the threads' stacks.
• Identifiers: a random id made when the app is installed, and a random id for each session. Neither is tied to your account, your email or an advertising id, and uninstalling the app removes them.
• Seen by the server: your IP address, as with any request.

They do not include what matters to you. The apps record no network requests or addresses, so the machines you connect to, their links and tokens, cookies and sign-in traffic never reach it; nothing typed, nothing on the terminal, no taps, no app logs, no machine or session names. Everything the terminal shows stays between the phone and your computer.

Your sophonz account (optional)

The apps work with a QR code or a link and no account. If you register or sign in:

• auth.sophonz.ai, the account service, keeps your email address, your name if you give one, your password (hashed) and your sign-in sessions. Registration and sign-in happen on its page, shown inside the app. Signing in with GitHub also keeps the address of your GitHub account's public profile picture, fetched again at each sign-in.
• Your profile picture: the website, the apps and the terminal in your browser show the signed-in account's picture. A GitHub picture is loaded straight from GitHub (GitHub gets the request); otherwise Gravatar is asked for one. Gravatar is sent the SHA-256 hash of your email address, never the address; with no picture there, the address's first letter is shown.
• link.sophonz.io, the stable-link service, keeps the machines registered to your account: an id, the machine's name, its operating system, its current tunnel address and when it was last seen, plus the names of its tmux sessions and, where st watches an agent in them, their state and counts. From st v0.3.50 it also keeps each session's windows (their numbers, names and the program running), which agent runs in which window and in what state, how many subagents of each type it has running or finished, and which agents are leads or teammates of a Claude Code agent team. It never keeps what they are working on: no prompts, subagent descriptions, terminal titles or teammate names, which stay on your computer. st registers these from your computer; the apps read the list and use a stable link to get a one-time key for a machine.
• Resource numbers from each machine: while a computer is signed in to your account, st also sends link.sophonz.io its CPU use and load, memory and swap in use and in total, and how much memory st and the programs it started are using and how many there are, every 30 seconds. They let the apps and the dashboard show how each machine has been doing lately. Only the last 10 minutes are kept, and anything older is deleted within the next 10 minutes. They contain nothing from the terminal: no commands, output or anything typed. st --no-telemetry turns this off.
• How much of your AI plans is used: while a computer is signed in to your account, st also sends link.sophonz.io, with the same heartbeat, how much of the Claude Code and Codex plan limits on that computer has been used: for each window (the 5-hour and weekly ones) the percentage used and when it resets, the plan's name, a masked email address of the provider account (y***@example.com) and a one-way hash of that account's id, so the apps can tell which machines share an account. Only the latest report from each machine is kept, for two weeks after the machine was last heard from. To read the limits, st asks Anthropic and OpenAI directly every few minutes with the login Claude Code and codex keep on the computer; that login goes only to its own provider and never to us. st usage poll off or st --no-telemetry turns this off, and the apps then read the limits from the machine itself.
• Both services keep access logs, such as IP addresses and request times, for at most 30 days, for security and troubleshooting.

This is used only to run your account and stable links. It is never sold or used for advertising.

Camera

The camera is used only to scan the QR code st prints. Frames are analysed on the phone and never stored or sent. On iPhone this uses Apple's frameworks. On Android it uses Google ML Kit, which may send Google usage statistics such as device information, app information and performance metrics; these do not include camera images or what the code contained.

Voice input

The mic button in the Compose sheet and on the key bar turns speech into the text you send.

• iPhone (v0.1.9+): dictation uses Apple's Speech framework. It runs on the device when your language supports it; otherwise Apple's speech service processes the audio, under Apple's own terms, as the system permission prompt says. The app asks for microphone and speech-recognition permission only the first time you tap the mic.
• Android: the key-bar mic uses Android's speech recognizer (on the device when the phone has a model for your language, otherwise the recognizer's provider, usually Google, processes the audio under its own terms). For this the app asks for microphone permission the first time you tap the mic, and the audio goes only to that recognizer. The Compose sheet's mic opens your phone's own speech input instead and needs no permission. Either way the app receives only the recognised text.

Neither app stores audio or transcripts. Recognised text lands in the compose box and reaches your own computer only when you press Send, exactly like typed text. None of it goes to sophonz servers, and none of it is in the diagnostics above.

Notifications

If you turn on agent notifications, the app tells you when an agent in one of your tmux sessions (Claude Code, Codex and the like) needs your input or has finished. On iPhone, a Live Activity on the lock screen can also show what the agents on a machine are doing while they work. st on your computer notices this and sends it to link.sophonz.io, which passes it to your phone. It needs a sophonz account and is off until you turn it on.

• What link.sophonz.io keeps for each phone: a random ID the app creates when it is installed, the phone's model name (for example "Pixel 9"), the push token Firebase (Android) or Apple (iPhone) gives the app, on iPhone the tokens for starting and updating a Live Activity and whether the app is a development or an App Store build, the phone's public encryption key, the platform, the app version, the language, and your notification settings (on or off, how long a task must run before "finished" is worth a notification, muted machines and sessions, and quiet hours). It also remembers which notifications it sent in the last 24 hours, so a notification is never sent twice. The app also sends the same random ID to your own computer when it opens a terminal, so st can skip notifying a phone that already has that session open.
• The content is end-to-end encrypted. What a notification says — the prompt, the command or file an agent wants to act on, the answer options, and any text from the terminal — is encrypted on your computer with a key that only your phone holds. Neither link.sophonz.io nor Google or Apple can read it.
• What travels in plaintext is what the phone needs to show a notification before it is unlocked: the machine's name, the session name, which agent it is and what kind of prompt it shows, the agent's state (for example working or waiting), how long a task ran, and counts such as how many sessions are working or how many subagents are running.
• The Live Activity is plaintext. On iPhone it shows the machine's name, the names of its sessions with their states, the counts above and when the work started. Apple does not let an app decrypt what a Live Activity shows, so these reach link.sophonz.io and Apple unencrypted. It never shows prompts, commands or anything from the terminal.
• Notification history: so that every phone on the account can list the notifications it was sent and what you read on one phone is read on the others, link.sophonz.io keeps a record of each notification for 30 days (at most the latest 1000): its kind, the machine and session names, the pane, the agent and prompt kind, counts and durations, when it was sent and whether and when it was read. It never keeps what a notification said; each phone keeps its own copy of that, on the phone. Deleting an item in the app deletes it here, and deleting your account deletes them all.
• Documents (st doc): a document an agent hands you stays on your computer, and the app reads it through your machine's own link, as it reads the terminal. link.sophonz.io relays only the notification that one is ready: the document's title, encrypted to your device like other notification text, and its id and size in plaintext. What you save on the device (the Documents tab) stays on that device, in the app's own storage (on iPhone and iPad, its folder in Files), with a note of which machine and document each file came from; nothing of it is sent anywhere. Save to computer sends your edit straight to your machine through its own link, as the terminal does; it does not go through link.sophonz.io.
• AI usage and past sessions: how much of their plan's limits Claude Code and Codex have used, and the list of past agent sessions, are read by st on your computer from the agents' own files and reach the app through your machine's own link, as the terminal does; the Machines list's usage comes from the heartbeat described under Your sophonz account. The account they belong to is told apart by a one-way hash of its id, shown with your masked email address and plan; the agents' sign-ins that st uses to ask for the limits go only to their own provider, never to the app or link.sophonz.io. The app keeps each machine's last numbers on the device. Of past sessions only a title line (the session's name, or the first line you typed), the folder and counts are read out; the conversation stays on your computer. Beyond that heartbeat, link.sophonz.io relays only the notification that a limit passed 80 % or 95 %: the agent and the level in plaintext, the rest encrypted to your device.
• Delivery: on Android, notifications go through Google's Firebase Cloud Messaging, under Google's privacy policy. On iPhone, notifications and Live Activity updates go through Apple Push Notification service, under Apple's privacy policy.
• Deleting it: turning notifications off or signing out of the app removes the phone from link.sophonz.io, and deleting your account removes all of its phones. A token that Firebase or Apple reports as no longer valid is deleted too, and a Live Activity's token is deleted when it ends.

The browser terminal

The terminal page st serves — the one a link or a QR code opens — sends us anonymous usage. That is page loads and performance metrics, JavaScript errors and their stacks, how long same-origin requests took, browser and screen information, the st version, and a random session id that belongs to that one visit (the __sophonz_rum_sid cookie, which expires after 15 minutes of inactivity and never lasts more than four hours).

It does not send what is in the terminal. Session replay, console output, clicks, request and response bodies, WebSocket traffic and the page title are all switched off, and every piece of text on the screen is masked. Anything after ? or # is cut off the URL, so a join token never travels with it.

It is on by default. The machine's owner turns it off with st --no-telemetry or SOPHONZ_TELEMETRY=off, and that covers every browser joining that machine. Everything it sends is listed here.

This website

The website has no analytics and sets no tracking cookies. If you sign in to the dashboard, the sign-in tokens are kept in your browser's local storage, so every tab of that browser stays signed in, and they are cleared when you sign out. Our hosting provider (Vercel) keeps standard request logs.

Who else handles data

We do not sell or share personal data. Only these handle data, as part of the features above:

• Cloudflare, for tunnel transport.
• Apple and Google, for speech recognition when your phone's speech service does it, and on Android, Google for ML Kit statistics; and, if you turn notifications on, for delivering them (Firebase Cloud Messaging on Android, Apple Push Notification service on iPhone).
• Oracle Cloud Infrastructure, which hosts the account and stable-link services and the diagnostics collector.
• Vercel, which hosts this website.
• GitHub and Gravatar (Automattic), for the signed-in account's profile picture: GitHub gets the request for the picture, Gravatar the hash of the email address.

Keeping and deleting

• On the phone: removing a machine or signing out deletes its tokens; uninstalling the app deletes everything.
• Your account: when you delete it, the account is removed at once, and its machine registrations and notification devices on link.sophonz.io within 30 days. Access logs expire on their own within 30 days.
• Diagnostics: kept for at most 90 days, then deleted. They carry no account, name or email, so they cannot be traced back to you or picked out on request.
• How to delete: see Delete your account, or email support@sophonz.io.

Security

Everything the apps send is encrypted with HTTPS (TLS); they do not make plain HTTP connections. Tokens on the phone are stored encrypted.

Children

The apps are developer tools and are not directed to children under 13.

Changes

If this policy changes, the new version is posted here with a new effective date.

The company, and who is responsible for privacy

Write to ceo@inobs.io to ask about how your data is handled, or to see, correct, delete or restrict it; we answer within ten days of receiving the request. You can also delete your account yourself, as Delete your account describes.

In Korea, a complaint about personal data can also be taken to the Personal Information Dispute Mediation Committee (1833-6972, kopico.go.kr) or the Privacy Violation Report Centre (118, privacy.kisa.or.kr).