PRIVACY POLICY

Ground Control and Nightwatch · Last updated October 16, 2026

THE SHORT VERSION

Ground Control has no accounts and stores no content on any server. Your conversations are end to end encrypted between your Mac and your phone. We cannot read them, and we keep nothing to breach. The one thing we do keep is a count of how many devices are connected, with no identity and no content attached. That is spelled out below.

WHO RUNS THIS

Ground Control, Nightwatch and this website are made and run by Carlos Lastres. Write to support@groundcontrol.chat about anything on this page.

WHAT THE APP DOES

Ground Control shows the AI coding agent sessions running on your own computer and lets you send them messages from your phone. A small program (the daemon) runs on your Mac, encrypts session information with a key generated on your Mac, and sends it through a relay server to your phone.

To find those sessions the daemon reads the files your agent tools already write on your own machine: Claude Code in ~/.claude, and where present Codex in ~/.codex and Kimi in ~/.kimi and ~/.kimi-code. Everything it reads stays on your Mac until it is encrypted for your phone.

WHAT WE CAN AND CANNOT SEE

• The pairing key is created on your Mac and is shared with your phone only through the QR code you scan. It is never sent to us.
• All session content (names, statuses, messages, prompts) is encrypted with ChaCha20 Poly1305 before it leaves your Mac and is decrypted only on your phone.
• The relay server routes encrypted messages by an anonymous channel identifier. It does not store messages, does not log message content, and holds no decryption keys.
• Standard connection metadata (IP addresses, timestamps) is processed transiently by our hosting provider, Cloudflare, to deliver the service.

WHAT WE COUNT

The app itself counts nothing. No accounts, no advertising identifiers, no crash reporting tied to your identity, and no analytics inside Ground Control. The App Store privacy label for Ground Control is "Data Not Collected".

This website is a separate thing. groundcontrol.chat can use Google Analytics to count visits, so we can tell whether anyone is finding the page. It only runs if you say yes, as described under Cookies and your choice below. If you do, it sets cookies in your browser and reports your visit to Google, including the pages you view, where you came from, your browser and device type, and a rough location that Google works out from your IP address. It runs on these web pages only. It is not in the app, it never sees your sessions, and it has no connection to the relay. Saying no changes nothing about how Ground Control works.

The relay does keep one thing so we can tell whether the service is working: for each channel it records the anonymous channel identifier, how many Macs and how many phones are currently connected, and a timestamp. That is the whole record. It contains no names, no messages, no prompts, no file paths, and nothing that identifies you or your machine. It feeds a private dashboard that tells us how many people are using Ground Control.

COOKIES AND YOUR CHOICE

The only cookies on this website are the Google Analytics ones described above. The app uses none.

• The first time you visit, a banner asks whether we can count your visit. Until you choose Allow, nothing is loaded from Google, nothing is sent to Google, and no analytics cookie is set. No thanks, or ignoring the banner, keeps it that way.
• Your choice is saved in your own browser, in local storage, under gc-analytics-consent. Clearing your browser data clears it, and the banner asks again.
• You can change your mind at any time: open cookie settings. The same link sits in the footer of the home page as Cookies. Switching to No thanks also removes the analytics cookies already set.

The website is hosted on Cloudflare, which keeps standard request logs (IP address, time, page requested) for security and to keep the site running. The fonts on these pages are served from groundcontrol.chat itself, so loading a page does not contact a font service.

PERMISSION APPROVALS

Ground Control can send Claude Code permission prompts to your phone so you can approve or deny them while you are away. This is off until you turn it on, and you are asked before anything is changed.

• Turning it on adds one entry to ~/.claude/settings.json. The change is strictly additive: nothing you already had is removed or rewritten, and if that file is not valid JSON it is left untouched.
• When a session asks for permission, the request reaches your phone as the tool name, the input it was given, the working directory, and the path to the transcript. It is encrypted on your Mac exactly like everything else and is readable only on your phone.
• Your Mac is never degraded. The normal terminal prompt still appears, and whichever answer comes first wins. Every failure path leaves the decision on the Mac.
• Choose when it applies with groundcontrol approvals away, always, or off. Remove the hook entirely with groundcontrol approvals uninstall.

WHAT STAYS ON YOUR DEVICES

• On your Mac: the pairing key and the daemon, in ~/.groundcontrol. If you turn on approvals, also a local socket and a small settings file there, plus the one hook entry in ~/.claude/settings.json.
• On your phone: the pairing key, stored in the iOS Keychain, and the app. Deleting the app deletes the key.

THIRD PARTIES

The relay runs on Cloudflare Workers. Cloudflare's processing is limited to routing encrypted traffic.

So that you never have to update by hand, the daemon periodically asks the public npm registry whether a newer version has been published. That request tells npm your IP address and that you are running Ground Control. It sends nothing about you, your machine, or your sessions. No other third parties receive any data.

NIGHTWATCH

Nightwatch is a separate Mac app that keeps your Mac awake while your agents are still working. It has no accounts and no analytics. Nothing it sees on your Mac ever leaves it. Its App Store privacy label is "Data Not Collected".

• Since version 1.0.4 it makes one anonymous version check: when it opens, and when you come back to it at most every ten minutes, it asks telemetry.intdesign.jp whether this version is still supported, so it can ask you to update if it is not. That request carries only the app's name, plus the word "dmg" for the version downloaded from this site. When a required update waits on an App Store release, it also asks Apple's public App Store lookup which version is current, sending only the app's store id and your region. Like any web request, these show your IP address to the server they reach. We do not store or log them, and nothing in them is linked to you or your Mac.
• To tell whether an agent is working it reads one thing about the same files the daemon reads, in ~/.claude, ~/.codex, ~/.kimi and ~/.kimi-code: the time each journal was last written. It does not open them and never sees a prompt, a message or a file path from inside them. The folder name is used to show you which project is busy.
• It keeps its settings, and a count of how long your Mac was held awake each day for the last sixty days, on your own Mac. No content, no project names, just durations.
• The version downloaded from this site installs a small helper that runs as an administrator, so that a closed lid does not put your Mac to sleep while an agent is mid task. It changes one macOS power setting for the length of a session and puts it back afterwards, including if the app crashes or your Mac restarts. It does nothing else and talks to nothing but Nightwatch.
• The Mac App Store version is sandboxed and installs no helper. For each agent it watches, it asks you once, in a standard macOS panel, for permission to see the folder that agent's journals live in. That is at most four folders, and macOS can revoke any of them at any time.

YOUR REQUESTS

There are no accounts, so we hold nothing that points back to you by name. If you want to know what analytics data relates to your visits, want it deleted, or have any other privacy request, write to support@groundcontrol.chat and we will handle it by hand. If you are in the EU or the UK you also have the right to complain to your local data protection authority.

CHILDREN

Ground Control and Nightwatch are developer tools and are not directed at children under 16. Neither app asks for your age, a name, an email address or any other personal detail, because neither has an account to create. If you believe a child has sent us something, write to the address below and we will delete it.

CHANGES

If this policy changes, the updated version will be posted at this address with a new date.

CONTACT

Questions: support@groundcontrol.chat