Privacy Policy

This policy explains what personal data Maude handles, where it goes, and what you can do about it. It covers the Maude app for iPhone, iPad and Android, the website at maude.pilotdev.fr, the Maude relay and the update channel the Maude daemon checks.

Maude is published by Pilot Dev (Lucas Bastien), based in France. For the processing described here, Pilot Dev is the data controller. You can reach us at pilotdevelopper@gmail.com.

The short version

• Your conversations, code, files and agent logins stay on your own server. Maude installs a small program (the daemon) there, and that's where sessions run and are stored. We don't receive them.
• Your SSH passwords and keys stay on your phone, in the system keychain. They're never sent to us.
• The relay can't read your sessions. When your phone reaches your server through our relay, the traffic is end-to-end encrypted with a key only your devices hold.
• Some data does reach us or our providers: usage analytics and crash reports (you can turn these off), subscription status, push notification tokens, short notification texts, and the records the relay needs to route messages.
• We don't sell data, show ads, or track you across other apps and websites. The website sets no cookies and runs no analytics.

What never reaches us

Maude is built so that the important material stays on hardware you control:

• Sessions and transcripts. The daemon keeps each session's history in ~/.maude/sessions on your server. The app keeps a cached copy on your phone so it can show sessions quickly. Neither copy is sent to us.
• Agent credentials and API keys. When you sign in to Claude Code, Codex, OpenCode, Grok Build or Antigravity, or paste an API key, the login happens on your server. Keys you enter in the app are saved in ~/.maude/secrets.json on your server (readable only by that user).
• SSH credentials. Hostnames, usernames, passwords, private keys and key passphrases are stored in your phone's keychain (iOS) or encrypted storage (Android).
• Files and photos you attach. They go from your phone to your server, over SSH or through the encrypted relay.

Once something is on your server, the agent you chose may send it to that agent's provider. That part is between you and them; see AI agents and other services below.

Data we process

Data	Where it's stored	Why	Legal basis	Retention
Usage events: screens and steps you go through (onboarding, paywall, adding a server, connection results and failure categories, daemon install results, notification permission), plus app version, device model, OS version, language and approximate location derived from your IP address. Linked to a random analytics ID.	PostHog, EU cloud (Frankfurt)	Understand where setup fails and which features are used	Legitimate interests (improving the app). You can opt out.	Up to 12 months
Session replays: a recording of the app's interface while you use it. Conversation content, code, file contents, terminal output, typed messages, credentials, hostnames and usernames are masked before anything leaves the phone.	PostHog, EU cloud	See how people actually move through the app, to fix confusing screens	Legitimate interests. You can opt out.	Up to 30 days
Crash and error reports: error type and message, stack trace, app version, device and OS.	PostHog, EU cloud	Find and fix bugs	Legitimate interests. You can opt out.	Up to 12 months
Subscription data: an anonymous purchase ID, products bought, trial and renewal dates, store country and currency, linked to your analytics ID.	RevenueCat (US); Apple or Google	Sell and verify your subscription, restore purchases	Contract	While you're a customer, then as long as tax and accounting law requires
Relay identity: a random account ID, one record per device (a generic name such as "Maude iOS", platform, public key, hashed access token, creation and last-seen times).	Our relay server	Let your devices reach your servers and each other	Contract	Until you remove the device in Settings → Relay & devices
Relay server records: the display name you gave each server, a hashed access token, creation and last-seen times, and your server's data key sealed to each of your devices (we can't open these).	Our relay server	Route encrypted traffic to the right server	Contract	Until you turn the relay off for that server or remove the server
Queued messages: encrypted messages sent while your server was offline.	Our relay server	Deliver them when the server reconnects	Contract	Deleted on delivery, or after 24 hours at most
Push tokens: the token Firebase Cloud Messaging gives your device.	Our relay server; Google	Send you notifications	Contract	Until you turn notifications off, remove the device, or the token expires
Notification text: a title and a body of up to 80 characters each, plus random session and server IDs.	Passes through our relay, Google (FCM) and, on iOS, Apple (APNs). The relay doesn't keep it.	Tell you when an agent needs approval, asks a question, finishes or fails	Contract	Not stored by us
Update checks from the daemon: build number, OS, CPU architecture, C library, CPU feature flag, runtime version, the agent versions it was built for, and the oldest Maude app version that used that server in the last 30 days. Your server's IP address is seen by our server.	Our server (request logs)	Tell the daemon which tested agent versions and daemon updates it should install	Legitimate interests (keeping installs working and secure). You can turn it off.	Request logs: up to 30 days
Web requests: IP address, time, page requested and browser user agent, when you visit the website or the app fetches the "What's new" feed.	Our server (request logs)	Serve the site, keep it secure	Legitimate interests	Up to 30 days
Emails you send us.	Our mailbox (Google)	Answer you	Legitimate interests; contract where it's about your purchase	As long as needed to help you, then up to 3 years

Analytics, crash reports and session replay

Release builds of the app send usage events, crash reports and session replays to PostHog, an analytics service we use on its EU cloud (servers in Frankfurt). We use this to find out where people get stuck, mostly in connecting a server, which is where most problems happen.

What it covers:

• Identifier. PostHog assigns a random ID to your installation. We don't attach your name or email to it. We pass the same ID to RevenueCat so we can tell whether a purchase completed.
• Events. Things like "onboarding page viewed", "server added", "connection failed" with a failure category such as "timeout" or "auth", "daemon installed" with build numbers and error codes, "relay enrolled", and app opened or backgrounded.
• Error reports include the error message and stack trace. Messages are written by the app's code, but occasionally one can contain a path or host name.
• Session replay records the app's screens so we can see how a flow felt. Every part of the app that shows conversation content, code, diffs, files, terminal output, what you type to an agent, credentials, hostnames or usernames is masked on the phone, before the recording is sent. Buttons, menus and headers stay visible.

Turning it off: go to Settings → Privacy → Share usage analytics. While it's off, the app sends no events, crash reports or replays to PostHog.

The relay

The relay at relay.maude.pilotdev.fr lets the app reach your servers when SSH isn't practical (for example, from mobile data, or behind a firewall), and lets your server notify you. It's on by default. You can switch it off for all servers in Settings → Relay & devices, or for one server on that server's page. With it off, the app talks to your server directly over SSH, and you won't get push notifications.

How the encryption works: when you connect a server, your phone generates a random 256-bit key for that server and keeps it in the keychain. Every message between your devices and that server is encrypted with that key (AES-256-GCM) before it leaves the device. To give your other linked devices access, your phone encrypts ("seals") the key separately for each one using that device's public key. The relay stores those sealed copies but holds no key that can open them.

What the relay can see: which of your devices talks to which of your servers and when, how big the messages are, whether each device and server is online, the display names you gave your servers, and the text of push notifications (next section). It also sees IP addresses, which it uses only in memory to limit abusive request rates. Its own logs record IDs, event types and error codes, not message contents, tokens or IP addresses. Our hosting provider's network equipment may log IP addresses separately.

Removing data from the relay: removing a device in Settings → Relay & devices deletes that device's record, its access token, its sealed keys and its push tokens. Deleting a server in the app, or turning the relay off for it, deletes the server's record, its sealed keys and any queued messages. To delete everything at once, including the account record, email us.

Push notifications

If you allow notifications, your phone gets a token from Firebase Cloud Messaging (a Google service; on iPhone it hands the message on to Apple's push service). The app registers that token with the relay. When an agent needs you, the daemon on your server sends the relay a short notification, and the relay passes it to Google for delivery to every device of yours that isn't already showing the app.

Notification texts are kept short, but they are readable by the relay, Google and Apple while in transit. They can contain:

• the session's title (which you can rename);
• a one-line summary of what the agent wants to do, such as the first line of a command or a file name ("Allow Run npm test?", "Allow Edit src/app.ts?");
• the first words of a question the agent is asking you;
• the first words of an error message.

Each part is cut to 80 characters. The relay doesn't store notification text. You can mute each kind of notification, or all of them, in Settings → Notifications. If your session titles or commands are sensitive, mute the categories you don't need.

The daemon on your server

To run agents, Maude installs a program called the Maude daemon on each server you connect, in ~/.maude for the user you logged in as. It stores, on that server only:

• session histories (~/.maude/sessions) and the daemon's own log (daemon.log);
• API keys you entered in the app (secrets.json), the relay connection details (relay.json), notification and security settings;
• the agent programs it installs (~/.maude/engines) and the JavaScript runtime it runs on;
• the versions of the Maude app that connected in the last 30 days (version numbers only).

The daemon never sends that content to us. It does make these network requests of its own:

• Update check, every 6 hours, to maude.pilotdev.fr. It sends the technical details listed in the table above, nothing about you or your sessions. The answer tells it which tested agent versions to use and whether a newer daemon is available. Every download is checked against a published SHA-256 hash before it's used. Set MAUDE_CHANNEL=off in the daemon's environment to stop the check, or MAUDE_SELF_UPDATE=off to stop only the daemon updating itself.
• Downloads from vendors when it installs or updates an agent or its runtime: Anthropic (downloads.claude.ai), GitHub (Codex, the Bun runtime), the npm registry, Google Cloud Storage (Grok Build, Antigravity) and the vendors' install scripts. These vendors see your server's IP address, as with any download.
• The relay, if enabled, over an encrypted WebSocket.

To remove the daemon, run ~/.maude/bin/maude uninstall-service on the server and delete ~/.maude. Deleting a session in the app deletes its history on the server.

AI agents and other services

Maude starts and controls agents you choose: Claude Code (Anthropic), Codex (OpenAI), OpenCode (which can use many model providers), Grok Build (xAI) and Antigravity (Google). They run on your server, under your own accounts. When you send a prompt, the agent sends your prompt and the code and files it reads to its provider for processing. That provider handles the data under its own terms and privacy policy, as the controller of it. We're not part of that exchange and can't see it.

Check the provider's policy before using an agent on sensitive code: Anthropic, OpenAI, xAI, Google, and the policy of whichever provider you configure in OpenCode.

The same applies to anything else your agents or your server talk to, such as GitHub when you push code or open a pull request from the app (Maude runs git and GitHub's gh tool on your server with your credentials).

The website

maude.pilotdev.fr sets no cookies, uses no analytics or tracking scripts, and loads its fonts from our own server. App Store and Google Play links carry a tag naming the page you clicked from, so Apple and Google can tell us in aggregate how many installs a page led to. Our server keeps ordinary request logs (see the table).

Subscriptions and payments

Purchases go through Apple's App Store or Google Play. We never see your card details, name or billing address. RevenueCat, the subscription service we use, receives the receipt from the store and tells the app whether your subscription is active. RevenueCat uses an anonymous ID; it doesn't know who you are unless the store tells it. Apple and Google process your payment under their own privacy policies.

On your phone

The app stores on your device: your server list and settings, a cache of recent sessions, unsent drafts, preferences, and, in the keychain or encrypted storage, your SSH credentials, relay keys and a few random IDs. Uninstalling the app removes most of this. On iOS, keychain items can survive a reinstall.

The app asks for the camera only when you scan a setup code or take a photo to attach, and for photos only when you pick one to attach. Images go to your server, not to us. The app doesn't use your location, contacts or advertising identifier.

Who we share data with

We don't sell personal data or share it for advertising. These providers process data for us:

Provider	What for	Location
PostHog Inc.	Analytics, crash reports, session replay	EU (Frankfurt)
RevenueCat Inc.	Subscription management	United States
Google LLC (Firebase Cloud Messaging), Google Play	Push delivery; Android purchases	United States and worldwide
Apple Inc. (APNs, App Store)	Push delivery on iOS; iOS purchases	United States and worldwide
Hetzner Online GmbH	Hosting for the website, relay and update channel	EU (Germany / Finland)

We may also disclose data if the law requires it, or to protect our users or the service from abuse.

International transfers

Some providers above are in the United States. Where personal data leaves the European Economic Area, the transfer relies on the EU–US Data Privacy Framework where the provider is certified, or on the European Commission's Standard Contractual Clauses.

Security

Relay traffic between your devices and your servers is end-to-end encrypted. The relay stores only hashes of access tokens, never the tokens themselves. Credentials on your phone are kept in the platform's secure storage. Daemon files that hold secrets are readable only by the server user. Downloads the daemon installs are checked against SHA-256 hashes. No system is perfectly secure, though: if your phone is unlocked and linked, anyone holding it can reach your servers through Maude, so keep a screen lock on.

Your rights

If you're in the EU, the UK or another place with similar laws, you have the right to access the personal data we hold about you, correct it, delete it, restrict or object to how we use it (including objecting to analytics at any time), and receive it in a portable format. Where we rely on legitimate interests, you can object and we'll stop unless we have compelling grounds. California residents have equivalent rights to know and delete, and we don't sell or share personal information as California law defines those terms.

Several of these you can do yourself in the app: turn off analytics, remove devices from the relay, turn the relay off, delete servers and sessions. For anything else, email pilotdevelopper@gmail.com. We don't know your name or email unless you give them to us, so we may ask for something that helps us find your records, such as when you linked a device or your subscription's order ID. We answer within one month.

You can also complain to a data protection authority. In France that's the CNIL; you can also contact the authority where you live.

Children

Maude is a tool for software developers and isn't meant for children. Don't use it if you're under 16 (or under the age of digital consent where you live, if higher). If you think a child has given us personal data, email us and we'll delete it.

Changes to this policy

When Maude starts handling data differently, we'll update this page and change the date at the top. If a change materially affects how your data is used, we'll also say so in the app before it takes effect. Earlier versions are available on request.

Contact

Pilot Dev (Lucas Bastien), France. Email: pilotdevelopper@gmail.com. See also our Terms of Use.