Privacy policy

Last updated: 19 October 2026

Flockdeck is made by Jim Wright, an individual based in the United Kingdom. This policy explains what personal data is involved when you use the Flockdeck desktop app, the Flockdeck relay at remote.flockdeck.ai, and this website, and what your rights are. Jim Wright is the controller of that data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

If you have a question or a request, email privacy@flockdeck.ai.

The short version

• The desktop app runs on your computer. It has no accounts, no analytics, no telemetry and no crash reporting. Your code, your terminals and your API keys stay on your machine, unless you use a built-in API agent, Flockdeck Remote, or turn on the optional TypeSafe feature, as described below.
• The relay is optional. It is used only if you turn on Flockdeck Remote. It keeps what it needs to connect your devices to your desktops: names, random identifiers, timestamps, public encryption keys, and your account's plan. When a relay asks you to confirm an email address before it adds a desktop, it also keeps the address that confirmed the account, and uses it to find that account when the same address is confirmed on another desktop. It keeps no password, real name or IP address.
• If you pay for Flockdeck Remote, a separate billing service keeps the email address and country you give Paddle's checkout, your plan and a record of each payment, for as long as UK tax records must be kept. The relay never receives that address. It keeps an email address of its own only if you confirmed one to add a desktop, whether or not you pay. Paddle, which takes the payment, keeps its own records under its own policy.
• This website sets no cookies, runs no analytics, and loads nothing from anyone else.
• Downloads keep short-lived access logs. The app, the installer scripts, the update check and the optional lens helper are served from dl.flockdeck.ai, which keeps standard access logs for 30 days, for security and to fix problems. They are not used for analytics; see Downloads and update checks.
• Nobody's data is sold, and nothing is used for advertising.

The desktop app

The app runs on your computer. It keeps its settings, layouts, conversations with built-in API agents and any API keys you give it in Flockdeck's configuration folder on your computer. Version 0.7.0 and earlier also kept a record there of which models routing chose. Later versions do not write it, and Settings can clear one an older version left. If you are still on version 0.7.0 or earlier, the old behaviour applies: it writes that record, and its routing setting "Ask Jev to rate unmatched work", if you turned it on and set a TypeSafe key, sends a task's text (cut at 2,000 characters and redacted the same way) to TypeSafe.

The same folder also holds:

• the folders you have opened recently, by their full paths and when each was last used, and which were open when the app last quit;
• a record of the running app, with its process number, the local address its window uses and the token that address asks for, so that starting it again joins it;
• the settings it hands each Claude Code pane, which name that address;
• updates it has downloaded and not yet installed;
• if you turn on Flockdeck Remote, the relay's address, the random identifiers of this desktop and its account, the name you gave the desktop, and the token it signs in to the relay with;
• a photo you attach to a message from a paired phone, removed after about a week;
• if you turn on recording for a pane, or export a pane's transcript, a transcript file of that conversation, in a recordings folder there. It is built from the conversation Claude Code stored on your computer, with secrets removed on a best-effort basis, so it can still contain some. Recording is off until you turn it on and confirm. Recordings older than 30 days are deleted as new ones are made, as are the oldest beyond 100 files or 256 MiB; exports are kept until you delete them. Flockdeck sends them nowhere and writes none into a project.

If the app fails to start, it writes the error to a file there, error.log, which can include the paths of files and folders on your computer. Nothing there is sent anywhere by Flockdeck.

Outside that folder, the app writes to one file of another program's. When a helper started in a new worktree carries Claude Code's folder trust over to it, Flockdeck records in Claude Code's own configuration file (~/.claude.json) that those worktrees are trusted, as the folder they came from already was.

To show what each agent has spent, the app reads what the agents report about their own usage on your computer: the tokens, cost estimate and usage limits Claude Code hands its status line, and the token counts of the built-in API agents. It keeps those figures in memory only. Flockdeck sends them nowhere itself; if you turn on Flockdeck Remote, they are part of the state of your panes that your own paired devices receive through the relay, as What passes through describes.

The app makes these network connections of its own.

• Update checks. It asks dl.flockdeck.ai, where Flockdeck's releases are published, whether a newer version exists. This happens when it starts and then every six hours. When a new version exists, it downloads it from there. If dl.flockdeck.ai can't be reached, it asks GitHub instead, which mirrors every release. Nothing identifying is sent either way, but whichever it reaches sees your IP address, as it would for any download; see GitHub's privacy statement. dl.flockdeck.ai keeps access logs, as Downloads and update checks describes. You can turn update checks off in Settings or with FLOCKDECK_UPDATE=off.

• The lens helper download, only if you install the optional helper app lens (Helper apps in the command palette, or flockdeck helpers install lens). lens reads your agent session transcripts from disk and shows what they did in a page on your own computer. Flockdeck fetches it from dl.flockdeck.ai/lens and from no other address: it refuses redirects and any other host. An install asks latest.json which version is newest (unless you name a version), reads that release's signed manifest, checksums and their signatures, and downloads the archive for your operating system. It asks you first, unless you pass -yes. Flockdeck checks the signatures and the archive's SHA-256 and size before it unpacks anything. Once lens is installed, Flockdeck asks the same address for a newer version while the Helper apps dialog is open, and when you run flockdeck helpers list -check. It downloads a newer version only when you confirm. These requests send the user agent flockdeck-helpers and nothing else that identifies you. The server sees the address they come from (your IP address, or your network's outbound address if you use a gateway), as with any download, and dl.flockdeck.ai keeps access logs for them. This is separate from the update checks above, so the update setting does not turn it off; not installing lens does. Once installed, lens runs on your computer and listens on 127.0.0.1 only. Flockdeck gives it none of its tokens or API keys. lens may contact whatever AI service you configure in its own settings, under that service's terms; Flockdeck does not send anything to that service itself.

• The relay, only after you turn on Flockdeck Remote. See below.

• Your git remotes, when you push, pull or fetch from the review panel. These are the remotes your repository already has.

• Model providers, only if you use a built-in API agent (Claude API, OpenAI API, Gemini API, or an endpoint you name). When you store a key with flockdeck keys, the app makes one request with it to that provider, asking for its list of models, to check the key is accepted; the request carries nothing else. The app then sends your conversation to the provider you chose, using your own API key. That includes the files and command output the agent reads, the working folder's path, and your operating system's name. What the provider does with it is governed by your agreement with them.

• TypeSafe AI (api.typesafe.ai), only if you turn on one optional feature, status detection. It is off by default and needs an explicit setting in Flockdeck and a TypeSafe API key that you have set yourself, either in Flockdeck's Settings or as TYPESAFE_API_KEY in the environment Flockdeck starts in; with either missing, nothing is sent. A key entered in Settings is kept in Flockdeck's key store on your machine and is sent only to api.typesafe.ai. The request carries that key as a bearer token, TypeSafe sees your IP address as any server does, and two fixed questions go with the text.

  Status detection (Settings, Status detection). When an agent that reports no status of its own goes quiet, the last 30 lines of that pane's terminal output, at most 2,000 bytes and with escape sequences removed, are sent so that TypeSafe can help tell whether the agent has finished or is waiting for you. This setting can be turned on only on the computer Flockdeck runs on, not from a window reached through the relay.

  Nothing else is sent: not the rest of the scrollback, the pane's name or its folder. Nothing else in Flockdeck sends text to TypeSafe: not task text, not the prompts you type, not the files or conversations of a project. Before it sends anything, Flockdeck redacts what looks like a secret: API keys of the common providers, bearer tokens, passwords in URLs, private key blocks, values assigned to names such as TOKEN or PASSWORD, and paths to files such as .env or id_rsa. This is done by pattern and does not catch every secret, so a password or key with no recognisable shape that is on screen is sent with the rest of it. The lines sent can include file names and code shown in the terminal. Leave this setting off for work like that. What TypeSafe does with what it receives is governed by TypeSafe's own terms and privacy policy, which you can find at typesafe.ai.

Flockdeck also starts programs you choose, such as Claude Code, Codex or Gemini CLI, and opens its window in a browser already installed on your computer. Those programs make their own connections under their own terms and privacy policies. Flockdeck does not control them.

The relay (Flockdeck Remote)

Flockdeck Remote lets you use your desktop's Flockdeck from another device, such as a phone, tablet or laptop, through the relay. It is off until you turn it on.

What is stored

For each account:

• a random account identifier;
• the date it was created;
• when anything on it was last used: a desktop connecting, a paired device being used, a registration, a desktop joining it, or a desktop being removed;
• its plan (a free trial, a subscription, or lapsed once either has run out), and the date the trial or the time paid for runs until;
• the email address that confirmed it, if the relay asked for one when the account was made, and a record that the address belongs to the account.

The account has no name or password. The email address is the one you typed on the relay's confirmation page, never in Flockdeck itself. It is kept for as long as the account is and deleted with it, and is sent to Postmark to mail you the confirmation link and the notices described under Joining an account by email, as Who else is involved describes. An account made before the relay asked for an address has none. When you pay, the relay learns only your plan and its date from the billing service, as Paying for Flockdeck Remote describes, and not the address you give Paddle.

For each desktop you connect:

• a random identifier;
• the name you gave it (by default, your computer's name);
• when it was added and when it last connected;
• a code that proves it is yours, stored only as a one-way hash.

For each device you pair:

• a random identifier;
• the name you gave it, or one guessed from its browser (such as "iPhone Safari");
• when it was paired, when it was last used and when its sign-in expires;
• its sign-in token, stored only as a one-way hash;
• if you turn on notifications on it, its notification subscription: the address its browser's push service gave it, and the two keys the browser gave for encrypting messages to it.

The relay also stores pairing codes, as hashes, until they are used. One that is never used expires after ten minutes, and is deleted within ten more.

While a desktop's email confirmation is waiting, the relay keeps the address typed for it, with hashes of the codes involved, until the account is made or joined, five wrong match codes cancel it, or it expires (30 minutes by default).

What passes through

Your devices and your desktop reach the relay over encrypted connections (TLS). Terminal input and output (what you type and what an agent prints back) are also end-to-end encrypted on top of that, once the device and the desktop have each registered a key: the relay then carries them but cannot read them. Until both have, they are protected by TLS only. The state of your panes still passes through the relay in the clear, so it can be seen there: what each pane's agent has spent, its usage limits, and which model routing chose for it. End-to-end encryption protects your terminal's contents from an honestly-run relay, including one you host yourself. Against a relay that has been tampered with to swap the keys it hands out at pairing, it needs one more check from you: the device and the desktop can each show a code for the other (Verify, under Devices on the phone and in the desktop's Flockdeck Remote settings), and comparing them by eye catches a swapped key.

The relay does not record, store or log the content of that traffic. It never receives your API keys, unless you type one in through Flockdeck Remote. Where a pane opens as a conversation rather than a terminal (a Claude Code pane, or Flockdeck's own chat client), the conversation view is not end-to-end encrypted: its messages, what you search it for and the matches it finds, and any photo you attach reach the relay decrypted, over TLS, and the relay passes them on without storing them. What you type into the message box is the exception: it goes to the agent's terminal, end to end. Searching runs on your desktop, against what it has already kept. A photo you attach from your phone is kept only on your desktop, in Flockdeck's own folder, never your project, and removed after about a week.

Muting a single pane's notifications from a phone is held only in that desktop's memory while it keeps running: it is not persisted there or anywhere else, and the relay stores nothing about it. Which paired devices have a pane open right now, shown as a small phone glyph naming the device on the desk's own window, is worked out from those same connections and kept the same way: in memory only, forgotten the moment the pane is closed or the device disconnects.

Notifications are the exception. When an agent has been waiting on you for a while and you haven't touched this computer (no keyboard or mouse input in any application for two minutes, or its screen is locked), your desktop encrypts a notification for each device you turned notifications on for, with that device's own keys, before it leaves your computer. Whether you are at this computer is worked out here, on this computer, and is never sent anywhere, encrypted or not. The relay adds its signature and posts the notification to the device's push service, and neither can read it. It says which pane needs you, with its project, and on which desktop; if you choose notifications without names, it says only how many agents need you, and on which desktop.

When a paired device reaches your desktop, the relay passes your desktop the device's IP address, its identifier and its name, along with the headers its browser sends with every request, such as its browser type and language. That lets your own Flockdeck tell your devices apart. Your desktop keeps them only in memory.

IP addresses and logs

• Rate limiting. The relay holds IP addresses in memory, for a little over an hour at most, to limit repeated sign-up and pairing attempts. It does not write them to its database.
• Relay logs. The relay's own logs record events such as "desktop connected" or "device paired" against the random identifiers above, not names or addresses. A desktop tells the relay which version of Flockdeck it runs when it connects, and that version is logged with the connection.
• Front-end server logs. The load balancer in front of the relay and this website may keep standard access logs, which include IP addresses, temporarily, for security and troubleshooting. The web server behind it that serves this website keeps no access logs.

Joining an account by email

On a relay that asks you to confirm an email address, one address belongs to one account. If you confirm an address that already has an account, the new desktop is added to that account, and no second account is made. It does not start a second trial or a second subscription, and the account's plan, paired devices and other desktops are untouched. Phones and browsers do not join this way: they pair with a code from a desktop already on the account.

Because the address is how the relay finds the account, anyone who can read that mailbox can add a desktop of theirs to the account. Two things limit that. The desktop prints a match code that is never emailed, and the page the emailed link opens asks for it before anything is confirmed. The relay never stores the match code in readable form, only a one-way hash, and cancels the registration after five wrong codes. And the account is told:

• An email to the confirmed address says that a desktop joined, with the name that desktop was given, how many desktops the account now has and, on a relay that has plans, its plan. When an account is first made, it says that an account was made with the address and by which desktop. Neither email has a link in it.
• A push notice to your paired devices that have notifications turned on, titled "A desktop joined your Flockdeck account", with the desktop's name and the new number of desktops. The relay writes this message itself and encrypts it to each device's keys before sending it to the device's push service.

If either cannot be sent, the join still goes ahead.

How long it is kept

• A paired device is deleted when you remove it, when it signs out, or 30 days after it was last used.
• A desktop is kept until you remove it from the account (flockdeck remote remove) or from another of your devices. Turning Flockdeck Remote off on it keeps it. A desktop that enrolled and never connected is removed after seven days, and only that desktop. One that has connected is not removed for being quiet. The one exception is a desktop that joins an account already at its limit of desktops: it takes the place of the desktop that has been quiet longest, if that one has been quiet for 30 days or more. Removing a desktop, the last one included, removes only that desktop. It never deletes the account.
• An account is kept while it is paid for, or while anything on it has been used in the last 90 days. Paid for means its plan is a subscription, or a subscription ended less than the grace period ago (90 days). Used means a desktop connecting, a paired device being used, a registration, a desktop joining, or a desktop being removed. Otherwise the account is deleted, with its desktops and devices and the confirmed email address, and we do not warn you by email first. Taking the last desktop off an account starts those 90 days from that day. A free trial that has ended is not paid for, so an account that never subscribed is deleted once nothing on it has been used for 90 days.
• An account whose free trial has ended, or whose subscription has lapsed, can no longer be used for Flockdeck Remote. A lapsed subscription keeps the account as it was for 90 days, so that subscribing restores it. After that it is kept only for as long as it is in use, as the previous bullet says.
• Pairing codes expire after ten minutes.
• A device's notification subscription is deleted when the device is removed or signs out, when its browser's push service says it no longer exists, or when the relay's notification key changes. Turning notifications off on the device deletes it too.

To delete everything the relay holds about you, run flockdeck remote delete-account on a desktop on the account. It shows what will go, asks you to type delete my account, and then erases the account, its desktops, its devices and the confirmed email address. It refuses while a subscription is running, because deleting the account does not cancel it: cancel the subscription in the Paddle customer portal first. Removing a desktop (flockdeck remote remove) takes only that desktop off the account, and turning Flockdeck Remote off (flockdeck remote disable) keeps the desktop enrolled; both keep the account. If you have no desktop left on the account, email us.

Cookies

The relay sets a cookie on a device you pair, that keeps it signed in. It is strictly necessary for Flockdeck Remote to work, lasts up to 30 days, and is removed when you sign out. Opening a desktop's own window (Full interface) sets a second cookie, __Host-fdr_desk, scoped to that desktop's own address alone, so a page from one desktop cannot use another's session; it carries no permission of its own, is checked against your account on every request, and stops working the moment the device or the desktop is removed. Getting there uses a one-time code, kept in the relay's memory for 60 seconds and good once, never written to a cookie or stored any longer. The relay's web client also remembers four display preferences in your browser's local storage: notifications, zoom, fit to screen and whether the second row of keys is open. It keeps a message you've started typing to an agent there too, per pane, so switching away and back doesn't lose it. It stays on your device only, and is never sent anywhere until you send it. It also remembers, per desktop, when you last had that desktop's list of panes open, so it can show what's changed since, and whether an agent's helpers are folded or shown, in the same way, on your device only. It also keeps the messages you have recently sent, so you can send one again; which view (chat or terminal) each pane was last in; and, in the browser's IndexedDB, this device's private encryption key, which never leaves it. None of this is used for tracking, or shared with anyone. The billing service sets no cookies; Paddle's checkout and customer portal are on Paddle's own site, under Paddle's policy.

Paying for Flockdeck Remote

Flockdeck Remote through the shared relay comes with a free trial, and after it is a subscription. Nothing below applies until you subscribe: an account on its free trial is known only to the relay, as described above.

Who takes the payment

The subscription is sold by Paddle, as the merchant of record: you buy it from Paddle, which takes the payment, charges and pays the sales tax, sends your receipts and handles refunds. Paddle collects what its checkout asks for, such as your email address, your country and your payment details, and is a separate controller of that data under its own privacy policy. We never see or keep your payment card details.

To connect a payment to your relay account, the checkout is opened with your relay account's random identifier attached, and Paddle holds it with the subscription.

What the billing service keeps

A small billing service, separate from the relay, keeps for each paying account:

• the relay account identifier the subscription pays for;
• Paddle's identifiers for you and your subscription;
• the email address and billing country you gave Paddle;
• the plan: its price, its status, and the dates it started, renews and is paid until, and any cancellation you have asked for;
• a record of each payment and refund: its amount, tax, fee, currency, country and invoice number, and the reason given for a refund.

It keeps nothing about your desktops, your devices or what you do with them. It tells the relay only your account's plan and the date it runs until.

Your email address is used for receipts and notices about your subscription, and to recover a subscription if you lose every paired device: on request, the subscription is moved to a new account. It is not a way to sign in, it is not used for marketing, and it is never shared except with Paddle, which already has it.

How long it is kept

UK law asks a sole trader to keep business records for at least five years after the 31 January Self Assessment deadline for the tax year they fall in. So each payment and refund is kept until then, and deleted after it. Your subscription and your email address are kept while the subscription runs, and afterwards as long as a record of one of your payments is kept. After that, nothing about you remains in the billing service.

This website

flockdeck.ai sets no cookies, runs no analytics and loads nothing from third parties; its fonts are served from the site itself. Its web server keeps no access logs, though the load balancer in front of it may, as described above. Downloads from dl.flockdeck.ai may get its content delivery network's security cookie, as Who else is involved describes.

Downloads and update checks

The app, the installer scripts, the update check (latest.json) and the optional lens helper app (under /lens) are all served from dl.flockdeck.ai. It is a DigitalOcean Space behind DigitalOcean's content delivery network, and it keeps standard access logs. Each entry records the address the request came from (its IP address), the path requested, the time, the response code and the user agent.

• How long. Entries are kept for 30 days, and then deleted.
• Where. They are stored privately, and are not published.
• What for. Only to investigate security problems and abuse, and to find and fix problems with downloads. They are not used for analytics, marketing or profiling, and we do not analyse them to see how the app is used.
• Who sees them. Nobody else. They are not shared, except where the law requires it.

The basis is our legitimate interest in running a secure and reliable service. The content delivery network handles each request on its way, as Who else is involved describes. Flockdeck itself still has no analytics: the app sends nothing to dl.flockdeck.ai beyond the request for a file or for latest.json, and none of your code or terminal content is ever part of it.

Sponsoring

If you sponsor Flockdeck, you do it through GitHub Sponsors, which handles the payment under its own terms and privacy statement. We see what GitHub shows a maintainer about a sponsor. This website names a sponsor only if they ask to be named, and takes the name off when they ask. Sponsoring buys no features, support or priority.

Why this data is used (lawful basis)

• To provide Flockdeck Remote, which you asked for: the account, desktop and device records, the sign-in cookie, and the notification subscription of a device you turned notifications on for. The basis is performance of a contract (the relay's terms).
• To confirm an email address when a relay asks for one: the address you type on the confirmation page, which is sent to Postmark to mail you a link and then kept on the account it confirmed. The purposes are to check that whoever enrols a desktop can read that address before an account is made, to find the account again when the same address is confirmed on another desktop, and to mail you a notice when a desktop joins or an account is made. The basis is performance of a contract.
• To tell you when a desktop joins your account: the notice emailed to the confirmed address and the push notice to your paired devices, both described under Joining an account by email. The basis is our legitimate interest in keeping your account secure.
• To delete accounts that are not in use: the last-used time kept on each account, which decides when an unpaid, unused account is deleted, as How long it is kept describes. The basis is our legitimate interest in not keeping data we no longer need.
• To provide a subscription you have bought: your plan, the identifiers that connect it to your relay account, and your email address for receipts, notices and recovery. The basis is performance of a contract.
• To keep tax records: the record of each payment and refund, for as long as the law requires. The basis is legal obligation.
• To keep the relay and the downloads secure and working: rate limiting, logs and access logs, including dl.flockdeck.ai's. The basis is our legitimate interest in running a secure and reliable service.

Who else is involved

The relay and this website are hosted by DigitalOcean, in its London region. DigitalOcean provides the servers, the database and DNS, and serves releases and update downloads from dl.flockdeck.ai through its content delivery network, which answers from locations around the world. DigitalOcean also keeps dl.flockdeck.ai's access logs for us, as Downloads and update checks describes, and the network sees each request's address as it passes. That network is Cloudflare's, and Cloudflare sets a short-lived security cookie, __cf_bm, on downloads from dl.flockdeck.ai to tell people from bots. It is strictly necessary, it is set by Cloudflare rather than by Flockdeck, and the app's update checks send no cookies. GitHub mirrors every release. TLS certificates come from Let's Encrypt, which receives no personal data about you. These providers process data on our behalf or as independent services, under their own terms.

If you turn on notifications on a device, each notification goes through the push service that device's browser uses: Google's for Chrome and most Android browsers, Apple's for Safari, Mozilla's for Firefox, and Microsoft's for Edge on Windows. It receives the notification encrypted, the device's push address, and when it was sent, and it cannot read the notification. You chose that service when you chose your browser, and it works under its own terms.

When a relay asks you to confirm an email address, the address goes to Postmark, our email provider, once for each confirmation email and once for each notice that a desktop joined or an account was made, so that Postmark can send you the message. Postmark sees the address and the message. It works under its own terms.

If you turn on the optional TypeSafe feature, what it sends goes to TypeSafe AI, as The desktop app describes. It works under its own terms.

The billing service is hosted by DigitalOcean too, in the same region as the relay. Paddle sells the subscription as the merchant of record and is a separate controller of what its checkout collects, as Who takes the payment describes.

DigitalOcean, GitHub and Postmark are United States companies. Where your data is handled outside the UK, it is protected by the safeguards UK law requires, such as the UK International Data Transfer Addendum or the UK–US data bridge.

No personal data is sold, rented or shared for advertising.

Your rights

Under UK data protection law you have the right to:

• ask for a copy of your data;
• have it corrected;
• have it deleted;
• object to its use, or ask for its use to be restricted;
• take it elsewhere.

Most of this you can do yourself, by renaming or removing desktops and devices in Flockdeck, or by erasing the whole relay account with flockdeck remote delete-account. For anything else, email privacy@flockdeck.ai. An account made before the relay asked for an address has none, so we may ask you to prove a desktop or device is yours, for example from the desktop itself. For an account made with a confirmed email address, we may ask you to confirm that address again. Records of payments cannot be deleted before the law allows, but everything else about a subscription can be. For what Paddle holds, ask Paddle.

If you're unhappy with how your data is handled, you can complain to the Information Commissioner's Office at ico.org.uk. We'd appreciate the chance to put it right first.

Children

Flockdeck is a developer tool and isn't aimed at children under 13.

Changes

If this policy changes, the new version will be posted here with a new date. Material changes will also be noted in the release notes.