Privacy policy
Togo connects your iPhone, iPad and Apple Watch to computers you own. Togo itself sends your terminals, prompts and code nowhere else; your agents talk to their own model providers, as they do at your desk. This page lists everything Togo sends off those computers.
In short
There is no account, and no analytics, advertising, tracking or crash reporting. The app talks to your computers directly, over SSH or Mosh. The only service we run is a small relay that hands notifications to Apple and carries answers from the lock screen and Watch. It sees encrypted bytes it can't open, the plain status fields of Live Activity updates, your devices' push tokens and IP addresses. We don't sell or share data with anyone.
On your computers
The app reaches the Togo helper on your computer over an SSH connection you set up. What your agents print, what you type, your files and the answers you give in the app travel over that connection, straight between your device and your computer. We never receive them. Answers from the lock screen, a Live Activity or the Watch go through the relay, sealed, as described below.
Photos you attach are rebuilt from their pixels before they're sent, so location, camera and maker details never leave the phone. Dictation uses Apple's speech recognition on the device, or the optional Whisper model, which also runs on the device. No audio leaves it.
On your devices
Your SSH key is made on the device and never leaves it. Keys and passwords stay in the Keychain or the Secure Enclave, for that device only, and are never synced. Your list of machines (names, addresses and settings) syncs between your own devices through iCloud, which Apple runs. We can't read it.
The app keeps a diagnostics log on the device. Machines appear in it only as codes, with no names, addresses, prompts, terminal text, keys or passwords. It leaves the device only if you share it yourself.
On the relay
Apple delivers notifications only through a server that holds the app's push credentials, so your helper sends them through our relay, which runs on Cloudflare. This is everything it receives.
| What | What it is | What happens to it |
|---|---|---|
| Push tokens | The token Apple gives each paired iPhone, iPad and Watch, and each Live Activity. It names a device to Apple, not a person. | The relay keeps no list of them, and its logs show only a short hash. A token is stored inside notifications waiting to be sent, and as a hash in the limit counters. |
| Sealed notifications and answers | Encrypted on one of your devices for another. The relay has no key to open them. | An answer from a notification or the Watch waits for your helper and is deleted when it confirms it, or after ten minutes. A helper can leave up to eight notifications to send if it goes offline; each is deleted when sent, or after 24 hours. |
| Live Activity status | The session's number, the agent's name, its state, how many requests are waiting, when it started, the waiting request's id and, when a session ends, one word for why. iOS draws these without the app, so they can't be sealed. When an update stands in for a notification, the relay adds alert text chosen from these fields alone. The session's title, what it's doing and the request itself are sealed. | Passed to Apple, not stored. |
| IP addresses and a machine identifier | Used to limit how many requests one sender can make. | The limit counters hold a count and when it started. Cloudflare keeps a sample of the relay's request logs for a few days. |
Without the relay, Togo still works over SSH, but you get no notifications or Live Activity updates while the app is closed, and you can't answer from the lock screen or the Watch.
Other services
Apple delivers notifications and Live Activity updates, and syncs your machine list through iCloud, under Apple's privacy policy. Hugging Face serves the optional Whisper model: if you download it, Hugging Face sees your IP address, and nothing you say is sent. GitHub hosts the source and the releases, so it sees your IP address when you download the helper, and it receives a problem report only if you choose to send one.
The data we use, and why
We use push tokens and IP addresses only to deliver notifications and to keep the relay from being abused. Nothing is linked to your identity, used for advertising, or shared for tracking.
Removing your data
To stop notifications to a device, remove the machine in the app, or run togo devices revoke on your computer. The relay then gets nothing new for that device. Deleting the app removes everything it stored on the device. There is no account to delete.
Children
Togo is a developer tool and is not directed at children.
Changes and contact
Changes to this policy are published on this page with a new date, and in the source repository. Questions go to support.