Privacy
Last updated: August 11, 2026
Ciao has no accounts, no telemetry, no analytics, and no user database. The app talks to the Mac or Linux machine you pair it with, end to end encrypted. We designed the product so there is almost nothing about you for us to hold.
On your devices
Pairings, session names, and preferences live on your phone. Conversations and drafts are held in memory and never written to disk. Keys live in your Keychain.
The 20-action free trial counter is a Keychain item: it syncs to your other devices through your own iCloud Keychain, survives deleting the app, and never touches our servers.
Deleting the app removes everything else. The host CLI keeps its own files on your machine: ciao reset deletes your host identity, pairings, and configuration, and uninstalls the background service. Logs and the installed program files stay until you remove them.
What transits, and what we could see
Traffic between your phone and your host is end to end encrypted: mutually authenticated QUIC, TLS 1.3. When a direct path is not available, one of our two relay servers (Hetzner, US East and US West) forwards the ciphertext.
A relay cannot read your content, but it can observe routing metadata: endpoint IDs, IP addresses, timing, byte counts. That metadata is not anonymous, and we will not pretend it is. We run the stock iroh-relay binary; its operational logs go to the systemd journal on those two machines with default retention, and we do not use them to count or track anyone. That is a written rule for this project, not a vibe: no counting at the relays, no usage metrics derived from routing data.
- Endpoint addresses are published to and resolved through dns.iroh.link, a service run by Number 0, a third party.
- The website, feedback endpoint, notification relay, and download proxy run on Cloudflare, which terminates TLS and keeps standard operational request logs: IPs, paths, timing. We add no logging of our own and store nothing there: no database, no KV.
- Installing or updating the host CLI is a plain HTTPS download, so the CDN sees your IP and which version you fetched. Release files come from a public Backblaze bucket behind our proxy.
Notifications
Pushes are sealed on your host with a key only your phone holds: ChaCha20-Poly1305, agreed during pairing. The relay stores nothing. Your push token travels inside a sealed ticket that expires after 30 days, and expiry is the whole revocation story, because there is nothing stored to delete.
Apple sees the device token, timing, and a fixed generic message (“A session needs your attention.”) plus ciphertext. When iOS declines to run the decryption extension, that generic text is all that shows.
Feedback, only if you send it
A report carries your message plus 14 fields you are shown before sending: a random report ID, the screen you sent it from, app and OS versions, device model, host platform details, connection path, recent connection wait times. The report ID is stored only on your phone and resets if you delete the app. Deliberately excluded: names, endpoint IDs, session names, paths, terminal contents, screenshots.
The report travels through our Cloudflare worker, which strips your IP and adds nothing, to Resend, an email service, and lands in our inbox as plain email. Deleting it is deleting the email: write to us and we will.
TestFlight
If you request an invite, your email goes to Apple’s App Store Connect tester list for this app, and to a database we keep on Cloudflare so an outage at Apple cannot lose your invite. Alongside it we store the time and a short word for which link you arrived from, such as the site of the post you read. That is the whole row: no name, no IP address, no tracking of what you do afterwards.
We use it to send your TestFlight invite and occasional notes about what is new in Ciao. Never for login, never sold, never shared. Every note carries an unsubscribe link, and emailing us removes you from both lists at once.
This website
These pages count visits with PostHog, set up more narrowly than it ships by default. It records the page you landed on, the link that brought you here, your browser and device type, and an approximate location worked out from your IP address. It sets no cookie and stores nothing on your device, so there is no banner to dismiss and no way for it to recognise you on a later visit: every visit is counted as a new anonymous one.
Three things it is capable of are switched off, both in the page and in the account, so they cannot be turned back on without changing this site: it does not record clicks or form interactions, it does not record sessions, and it does not track dead clicks. Nothing you type into the email box on the front page reaches it.
One click is counted on purpose, and it is the only one: pressing Get the app records that the press happened and which advert brought you, so we can tell which advert was worth running. That is a count, not a trail. It carries no identifier, nothing about what you did before or after, and it is the same anonymous visit described above. If you did not arrive from an advert, nothing is recorded at all.
The app and the host daemon are a separate matter and are unchanged: neither reports anything anywhere. This is website traffic only.
Purchases
Payments are processed entirely by Apple. We never see your payment details, and nothing on our side learns who paid. Your purchase lives with your Apple ID.
Permissions
- Camera: used only to scan the pairing QR code. Frames are never stored or uploaded.
- Speech to text: runs on device with Apple’s on-device models. Apple downloads the model to your phone on first use; audio never leaves the device.
- Local network: used to reach your paired host directly.
Third parties, the complete list
- Apple: payments, push delivery, TestFlight, on-device speech models.
- Cloudflare: website hosting, the feedback and notification endpoints, the download proxy, the signup list, and the bot check on the signup form.
- Resend: feedback email delivery.
- Backblaze: release file storage.
- Hetzner: the relay servers.
- Number 0: endpoint address publication, and the relay software we run.
- PostHog: counting visits to this website, and nowhere else.
No ad tech, no data brokers, and no analytics of any kind inside the app or the host. Nothing is sold or shared beyond what is listed here.
Changes
If Ciao ever needs to collect more than this, the change gets written here first, before it ships.