Privacy Policy

Subscription verification

Personal uses the signed-in GrantTap account UUID as Apple appAccountToken. The account service independently verifies Apple-signed purchases and retains product IDs, original/renewal transaction IDs, signed time, expiry and revocation status for computer limits. It does not receive payment-card details or your Apple password. Sandbox purchases are not paid production rights. Account deletion removes these service records but does not cancel the Apple subscription.

Mac and endpoint discovery

App Store purchase evidence is verified by StoreKit; we do not receive payment-card details. The native Mac keeps its separate local MCP access token in its device-only Keychain. Direct mode announces only authenticated encrypted endpoint records with opaque room and recipient identifiers, sizes and expiry. The managed directory cannot decrypt an address; network operators still observe connection IPs and timing. Directory records expire within 15 minutes. In fully self-hosted mode, pairing and chat traffic use your endpoint and do not contact that directory. You administer your own server logs, queues and retention.

Privacy at a glance

• QR pairing requires no account. The optional account uses a passkey without a password.
• Repositories, provider credentials, model prompts, and model traffic do not pass through the GrantTap relay.
• Task messages, commands, questions, attachments, replies, and decisions are end-to-end encrypted before leaving an authorized endpoint.
• GrantTap does not sell personal data or use app data for advertising, tracking, productivity scoring, or profiling.

Data processed to provide the app

• Pairing uses a random mailbox identifier and a single-use encrypted blob. The independent transfer key remains in the QR or manual token and never reaches the relay.
• If you use an account, the service stores a passkey public credential, account ID, computer name and identifier, a hash of the Mac credential, and last-seen time. A recovery request holds an ephemeral phone public key and encrypted offer for up to five minutes. The service cannot read the offered pairing key.
• Delivery uses opaque room, task, message, and delivery identifiers; sender and recipient roles; timing; ciphertext size; expiry; delivery status; and retry state.
• Hetzner hosts the current relay, website and account bridge and may process IP addresses and ordinary security request data. Cloudflare provides DNS and may process DNS request metadata.
• Background delivery stores an APNs device token, environment, bundle identifier, and update time. Push payloads contain no prompt, command, title, path, request identifier, or message body.

Encrypted content and local storage

The relay receives authenticated ciphertext and a nonce, not readable task content. Pairing and per-task keys are created locally and are absent from relay code, storage, logs, and secrets. Each task has an independent key.

Readable content exists only on the computer and Apple devices you authorize, plus tools you explicitly use there. GrantTap does not proxy provider model traffic.

• Received active-chat pages, original images and fetched Mesh snapshots are saved in protected local storage on iPhone, iPad and Mac. Settings can clear this replica without signing out or deleting pairing keys, queued deliveries, provider history or computer policy. Content not yet received is unavailable offline.
• The helper stores local pairing and provider integration configuration under ~/.granttap.
• Each Mesh has an additional key. The phone hands it only to computers you have already paired, inside the pairing encryption they already use, so shared Task state, Governance policy, and cost figures travel as ciphertext like everything else.
• Report a problem composes its text on your device and hands it to the system share sheet. The report contains no keys, tokens, chat content, or commands, and the app itself sends nothing.
• Camera, photos, files, microphone, speech recognition, biometrics, and notifications are used only for the features you explicitly invoke or enable.

Retention, deletion, and your choices

Pairing blobs expire after 15 minutes and are single-use. Encrypted offline queues are bounded and expire. Local data remains until you clear it, unlink a computer, reset pairing, or remove the app/helper.

You may decline optional system permissions. Account devices can be revoked and the account deleted on the account page or from the Devices screen in the Apple app. Deleting the account does not remove QR pairings stored on your own devices or cancel an Apple subscription. Depending on applicable law, you may request access, correction, deletion, restriction, portability, or objection for data GrantTap can identify and control. The relay cannot decrypt task payloads or search their readable content by account.

Service providers, website, and changes

Hetzner hosts the current relay, website and account bridge; Cloudflare provides DNS. Apple provides APNs, system speech and biometric APIs, and App Store services under Apple's terms. These providers do not receive GrantTap decryption keys from the app.

The website stores your language choice locally and uses an HttpOnly session cookie when you sign in to an account. It uses no advertising or product analytics. Material policy changes will be posted here with a new effective date.