How Remotly handles your data.

The services involved

Remotly has no Remotly account or account sign-in. The apps contain no advertising, advertising SDK, analytics SDK or crash-reporting SDK of our own. Pairing gives your phone access to your bridge; it does not create an account with us. Push delivery and service diagnostics do process data, as described below. Apple and Google may also provide crash, installation and usage information through their developer consoles under their own policies and your device settings.

What stays on your phone

• Your paired bridge’s address and name, device identifier, certificate fingerprint when used, and the bearer token that authorizes access to the bridge. iOS keeps the paired-host record in Keychain. Android uses app-private DataStore; Remotly does not add a separate encryption layer to that store, and Android backup is disabled for the app.
• Your settings, such as text size, scroll modes and notification preferences. Android also stores its Firebase Cloud Messaging (FCM) registration token. Apple and Google manage additional push-registration data for their notification services.
• The app holds terminal frames in memory rather than saving a terminal transcript to disk. Your operating system may retain delivered notifications, and the apps can write local diagnostic logs.
• Photos you choose or take for an attachment are processed on the phone before upload. Android camera captures can remain in the app’s cache until that cache is cleared. Selecting a photo starts its upload to your bridge; removing its attachment chip does not delete a copy already uploaded.

What stays on your bridge

The bridge runs on your own computer, under your control. Its state directory (normally ~/.config/remotly) holds configuration, TLS keys and certificates, and paired-device records:

• The device’s name, platform and identifier, pairing and last-seen timestamps, the SHA-256 hash of its bridge-access token, push tokens (including iOS Live Activity tokens when used), and panes selected for completion alerts. The bridge stores the access-token hash rather than the original access token.
• Any Apple or Firebase push credentials you choose to configure for direct delivery. Standard relay-based setup does not require you to supply these credentials.

Uploaded photos are stored separately, normally under ~/.local/share/remotly/uploads, so programs on your computer can read them. The default cleanup setting is 14 days: when another upload is saved, the bridge attempts to remove dated folders older than that setting. This is not a guaranteed deletion exactly 14 days after upload; you can change the setting or delete the files yourself.

Bridge logs go to your system journal. The default log level excludes terminal text and authentication tokens, but includes operational information such as device and pane identifiers. Debug logging can include error text and connection details. Journal retention is controlled by your computer. The terminal programs and agents you run may keep their own files, history and logs or send data to their own providers; Remotly does not control those programs.

Terminal access and photos

Pairing, terminal frames, keystrokes, prompts, approval responses and attached photos travel between your phone and your bridge using TLS-protected connections over your Tailscale network, or the supported Android LAN setup. This traffic does not pass through our push relay. Notification excerpts of terminal content are a separate data flow, described next.

Push notifications and our relay

Unless your bridge has its own push credentials, it sends notification requests over HTTPS to relay.remotly.dev, a Cloudflare Worker operated by Inference Aftermath. The relay forwards them to Apple Push Notification service (APNs) or Google FCM. A bridge with its own credentials sends directly to the relevant provider instead.

The relay receives the destination push token, platform, notification payload and delivery settings. Depending on the notification, the payload includes your host name, pane and prompt identifiers, agent type, work or approval status, and timestamps. iOS Live Activities also use their own push tokens.

Notification content includes pane text by default. The bridge setting push.include_excerpt defaults to true. Notifications can contain a session title or directory name, terminal excerpts, the agent’s closing text, and parsed approval details such as a command, file path, question, description and choices. This content is available to the relay and to Apple or Google for delivery; it is not end-to-end encrypted against those services.

Set push.include_excerpt: false in your bridge configuration and restart the bridge to exclude pane text from notifications. Bodies then use generic messages such as “Approval needed” or “Finished”, and your host name replaces the session title. Push tokens, host name, identifiers, agent type, status, timestamps and dialog kind may still be transmitted. The notification request does not include your phone’s bridge-access bearer token. Approve, Deny and Reply actions go from the phone to your bridge, not through the relay.

Relay diagnostics and retention

• Message processing: the relay processes push tokens and notification payloads in memory while forwarding the request. It does not maintain a database or archive of these messages or device registrations.
• Abuse prevention: Cloudflare receives the connecting bridge’s IP address and request metadata. The relay uses that IP address and the destination push token as rate-limit keys with one-minute counting windows. Those windows describe the rate limit, not the retention of all Cloudflare records.
• Diagnostics: relay application logs record delivery outcomes, platform, upstream status or error reason, and duration. Normal push log entries exclude the token and notification payload. Cloudflare also produces invocation and security records with request and response metadata; these are separate from our application log fields.
• Retention: Cloudflare Workers Logs currently retains logs for three days on its Free plan or seven days on its Paid plan. Other Cloudflare security and service records follow Cloudflare’s applicable retention policies. Apple and Google handle their own push-service data under their policies. The bridge normally sets notification delivery expiry to ten minutes, or one minute for live-status updates; this is not a promise that provider logs or already-delivered notifications are deleted at that time.

We use relay processing and diagnostics to deliver notifications, troubleshoot failures and limit abuse. They are not an app-usage analytics feature.

Service providers and this website

• Cloudflare hosts this website and the push relay and provides network security. Website visits also expose normal connection and request information, such as IP address, requested URL and browser headers, to Cloudflare. See Cloudflare’s privacy policy.
• Google/Firebase provides Android push delivery. The FCM SDK and its Firebase Installations dependency process a per-installation identifier, push-registration information and technical app/device information needed to operate the service. This can happen independently of whether a notification is currently displayed. Remotly does not include Firebase Analytics or Crashlytics. See Firebase’s privacy information and Android SDK data disclosures.
• Apple provides APNs, Live Activities and App Store distribution. Google also provides Google Play distribution. Their services process registration, delivery, store and diagnostic information under their respective policies: Apple and Google.
• Tailscale provides your private network and certificate-related services under its privacy policy. Your Tailscale account is separate from Remotly.

These providers operate internationally, so data they process may be handled outside your country. If you email us, we receive the address, message and any attachments you send; avoid including secrets or private terminal output.

Children

Remotly is a developer tool and is not directed at children under 16.

Your choices

• Limit notification content with push.include_excerpt: false and restart the bridge after changing its configuration. Manage notification display and previews in your phone’s settings. Turning off notification display does not by itself erase push registrations or stop all provider processing.
• Remove the paired host in the app to clear its saved pairing record. The app also attempts to unregister push delivery from the bridge when it can connect. On the bridge, remotly-bridge devices revoke <device_id> removes that device’s record and push registration and prevents it from authenticating again.
• Delete local uploads and bridge state on your own computer when no longer needed. Clear Android app data or uninstall to remove saved app data; clearing cache removes cached files. On iOS, remove the paired host before uninstalling to delete the Keychain entry; uninstalling alone should not be relied on to clear Keychain data. Copies in backups, system logs, delivered notifications or other programs need to be managed separately.
• Set push.relay_url to an empty string and restart the bridge to disable relay use. A bridge with its own push credentials can still send directly to Apple or Google. These controls do not stop the phone’s push SDK from communicating with its provider.

For questions or requests about data processed by Inference Aftermath, including access or deletion requests, contact us below. We do not have access to the files and paired-device records on your own bridge. Provider-held records follow the relevant provider’s processes and retention rules.

Changes

We update this policy when Remotly’s data practices change and revise the date above. The 18 September 2026 revision described the push relay and replaced the earlier statement that we operate no Remotly server.

Contact

Inference Aftermath Private Limited, Bengaluru, India · [email protected]