PRIVACY POLICY

Ground Control and Nightwatch · Last updated September 1, 2026

THE SHORT VERSION

Ground Control has no accounts and stores no content on any server. Your conversations are end to end encrypted between your Mac and your phone. We cannot read them, and we keep nothing to breach. The one thing we do keep is a count of how many devices are connected, with no identity and no content attached. That is spelled out below.

WHAT THE APP DOES

Ground Control shows the AI coding agent sessions running on your own computer and lets you send them messages from your phone. A small program (the daemon) runs on your Mac, encrypts session information with a key generated on your Mac, and sends it through a relay server to your phone.

To find those sessions the daemon reads the files your agent tools already write on your own machine: Claude Code in ~/.claude, and where present Codex in ~/.codex and Kimi in ~/.kimi and ~/.kimi-code. Everything it reads stays on your Mac until it is encrypted for your phone.

WHAT WE CAN AND CANNOT SEE

• The pairing key is created on your Mac and is shared with your phone only through the QR code you scan. It is never sent to us.
• All session content (names, statuses, messages, prompts) is encrypted with ChaCha20 Poly1305 before it leaves your Mac and is decrypted only on your phone.
• The relay server routes encrypted messages by an anonymous channel identifier. It does not store messages, does not log message content, and holds no decryption keys.
• Standard connection metadata (IP addresses, timestamps) is processed transiently by our hosting provider, Cloudflare, to deliver the service.

WHAT WE COUNT

The app itself counts nothing. No accounts, no advertising identifiers, no crash reporting tied to your identity, and no analytics inside Ground Control. The App Store privacy label for Ground Control is "Data Not Collected".

This website is a separate thing. groundcontrol.chat uses Google Analytics to count visits, so we can tell whether anyone is finding the page. That is ordinary web analytics: it sets cookies and reports your visit to Google. It runs on these web pages only. It is not in the app, it never sees your sessions, and it has no connection to the relay. Blocking it changes nothing about how Ground Control works.

The relay does keep one thing so we can tell whether the service is working: for each channel it records the anonymous channel identifier, how many Macs and how many phones are currently connected, and a timestamp. That is the whole record. It contains no names, no messages, no prompts, no file paths, and nothing that identifies you or your machine. It feeds a private dashboard that tells us how many people are using Ground Control.

PERMISSION APPROVALS

Ground Control can send Claude Code permission prompts to your phone so you can approve or deny them while you are away. This is off until you turn it on, and you are asked before anything is changed.

• Turning it on adds one entry to ~/.claude/settings.json. The change is strictly additive: nothing you already had is removed or rewritten, and if that file is not valid JSON it is left untouched.
• When a session asks for permission, the request reaches your phone as the tool name, the input it was given, the working directory, and the path to the transcript. It is encrypted on your Mac exactly like everything else and is readable only on your phone.
• Your Mac is never degraded. The normal terminal prompt still appears, and whichever answer comes first wins. Every failure path leaves the decision on the Mac.
• Choose when it applies with groundcontrol approvals away, always, or off. Remove the hook entirely with groundcontrol approvals uninstall.

WHAT STAYS ON YOUR DEVICES

• On your Mac: the pairing key and the daemon, in ~/.groundcontrol. If you turn on approvals, also a local socket and a small settings file there, plus the one hook entry in ~/.claude/settings.json.
• On your phone: the pairing key, stored in the iOS Keychain, and the app. Deleting the app deletes the key.

THIRD PARTIES

The relay runs on Cloudflare Workers. Cloudflare's processing is limited to routing encrypted traffic.

So that you never have to update by hand, the daemon periodically asks the public npm registry whether a newer version has been published. That request tells npm your IP address and that you are running Ground Control. It sends nothing about you, your machine, or your sessions. No other third parties receive any data.

NIGHTWATCH

Nightwatch is a separate Mac app that keeps your Mac awake while your agents are still working. It has no accounts, no server, and no network code of any kind. Nothing it sees leaves your Mac, because there is nowhere for it to go. Its App Store privacy label is "Data Not Collected".

• To tell whether an agent is working it reads one thing about the same files the daemon reads, in ~/.claude, ~/.codex, ~/.kimi and ~/.kimi-code: the time each journal was last written. It does not open them and never sees a prompt, a message or a file path from inside them. The folder name is used to show you which project is busy.
• It keeps its settings, and a count of how long your Mac was held awake each day for the last sixty days, on your own Mac. No content, no project names, just durations.
• The version downloaded from this site installs a small helper that runs as an administrator, so that a closed lid does not put your Mac to sleep while an agent is mid task. It changes one macOS power setting for the length of a session and puts it back afterwards, including if the app crashes or your Mac restarts. It does nothing else and talks to nothing but Nightwatch.
• The Mac App Store version is sandboxed and installs no helper. It asks you once, in a standard macOS panel, for permission to see the folder those journals live in, and macOS can revoke that at any time.

CHILDREN

Ground Control is a developer tool and is not directed at children under 13.

CHANGES

If this policy changes, the updated version will be posted at this address with a new date.

CONTACT

Questions: support@groundcontrol.chat