Privacy policy

Effective November 5, 2026

Who we are

Ovis is made by devswha, who publishes its source on GitHub. "We" on this page means devswha.

What the app keeps on your phone

• The addresses of the PCs you add, so you can open them again.
• The sign-in cookie a PC gives your phone when you pair it, so you stay signed in to that PC.
• For a PC paired through the Ovis relay: its address on app.ovis.sh, its name, and a key pair made on your phone for that PC alone. The private half cannot be read out of the app, and the PC keeps only the public half, to know your phone.

All of this stays on your phone and is never sent to us, except that opening a relay-paired PC requests its address from app.ovis.sh and names its relay ID to relay.ovis.sh or relay-ap.ovis.sh (see The Ovis relay). Forget on the connect screen removes a PC from the list, and uninstalling the app deletes everything it keeps.

Camera

The camera is used only when you tap Scan QR code, to read the pairing QR code your PC shows. The picture is not saved or sent anywhere; only the address in the code is used.

What travels over the network

The app connects only to the PC addresses you add or scan, to our relay services for a PC you pair through the Ovis relay (see The Ovis relay), to our account service if you sign in (see Your account), and, once you turn alerts on, to our push relay (see Alerts). What you see and type in the app, such as agent conversations, terminal output and files, travels between your phone and your own PC over the route you set up (for example Tailscale or your Wi-Fi), or through the Ovis relay if you pair your PC that way (described below). A direct route passes no server of ours, and the relay and the push relay pass on only what your phone and PC have encrypted for each other, so they cannot read it (for a relay-paired PC, this rests on the app code we serve; see The Ovis relay).

Because these leave your phone, the app's Google Play listing names them as collected: messages, what you type, files, photos, videos and audio you attach, voice you dictate, the PC's sign-in cookie and connection diagnostics. They are used for the app's own functions, shared with no one, and go only to your own PC (voice you dictate goes on to the transcription service you set up there).

The app tells your PC which settings you chose in it (such as theme, font sizes, language and alert options, never anything you typed). The Ovis server includes the settings of the last browser or phone that opened it in its anonymous usage counts, described below, so the Play listing also names app settings, a random ID and your country as collected for analytics. They are on by default; turning them off under Settings → About → Anonymous usage counts, in the app or on the PC, stops them.

The demo on the connect screen runs entirely on your phone.

The Ovis relay

The Ovis relay lets your phone reach your PC from anywhere, without Tailscale. It is off until you turn it on under Settings → Phone & devices on the PC; a phone then pairs by scanning the QR code shown there. Two services of ours are involved, both run on Cloudflare, except the regional relay endpoint relay-ap.ovis.sh, which runs on a server we rent from a hosting provider:

• relay.ovis.sh, and its regional endpoint relay-ap.ovis.sh (which a PC also connects to, and names in new pairing codes, when it answers much faster), join your phone's connection to your PC's. Everything between them is end-to-end encrypted, so a relay cannot read, change or add to it. For each connection a relay sees your PC's relay ID (and, when the PC connects, its public key), whether a phone or the PC is connecting, the address it comes from, and when each piece of traffic passes and how big it is, so it can tell when a phone uses which PC and how much goes each way, but never what is said. It writes no logs and stores nothing; the address is used only to limit how often one address can connect.
• app.ovis.sh (and, for a PC on the regional relay, its copy app-ap.ovis.sh on the same rented server as relay-ap.ovis.sh, which serves the same files and sees the same requests; a phone pairs there when the copy is up) serves the app a relay-paired PC opens in, as static files built from each Ovis release. It sees requests for those files: your phone's address and your PC's relay ID in the page address. What a page shows, such as the path of a file you open or the workspace you are in, stays in the part of the address your browser never sends. It never gets the pairing details from the QR code, which stay on your phone, or any of the traffic, which goes through the relay. The code it serves is the app itself: it holds your phone's key for that PC and shows what the PC sends, so end-to-end encryption protects your content from the relay, not from that code. That code is open source, built from each Ovis release tag and published with its checksum so anyone can compare it with what app.ovis.sh serves, and it sends your content only to your PC.

Cloudflare carries these connections for us (the hosting provider, for relay-ap.ovis.sh), so like any network in front of a service it could record what these services see. The PC you pair keeps your phone's public key in its device list, where you can remove it. The relay's code is open source, and its trust model describes what each part can see.

Your account

Signing in is optional: every way of pairing above works without it. When you sign in with GitHub or Apple, the app uses our account service, account.ovis.sh, run on Cloudflare, to find your PCs and to let one approval add a new device to all of them. It never decides who gets into a PC: each PC still keeps its own device list, and the account service can neither read your sessions nor add a device to a PC. It stores only:

• Your account: a random account ID, which provider you signed in with, and a one-way hash of that provider's ID for you. Not your email, name, avatar or GitHub repositories.
• Your sign-ins: one-way hashes of the tokens each signed-in device holds, and when they expire.
• Your PCs: for each PC you add, its name, its relay ID and public key, the relay it uses, when it was added and when it last checked in.
• Messages waiting for a PC: signed records that add or remove a device (that device's public key and name, and which device signed it), kept until the PC collects them; after 30 days they are no longer handed out, and they are deleted within a day after that.
• Join requests: which PC a new device is waiting at, the name it gave and its public key, handed out for 10 minutes and deleted within a day, used to alert your other devices and to let them check the device they approve.

It never receives what you type, what your PCs show, your files, the six-digit numbers you compare, or any device's private key. To stop using it, choose Sign out in the app; to have your account and everything above deleted, write to us (see Contact).

Alerts

When you turn alerts on in the app, your phone gets a push token from Apple (iOS) or Google's Firebase Cloud Messaging (Android), and the app registers it with our push relay at push.ovis.sh, together with your PC's public alert key. The relay keeps the token, so it can forward your PC's alerts to Apple or Google, until Apple or Google says the token no longer works, or until no alert has used it for 60 days (turning alerts off stops the alerts, and the relay then deletes it after those 60 days). Each alert is encrypted on your PC for keys that only your phone holds: the relay, Apple and Google pass it on without being able to read it. The relay keeps no logs and does not store your IP address. Its code is open source. This token counts as a device ID collected for the app's functionality and shared with no one.

The software on your PC

The app shows the Ovis server, a separate open-source program that runs on your computer, under your control:

• The Ovis server sends anonymous usage counts to its maintainer: when it is installed, when it is updated, and once a day it is opened. They hold a random ID made on your PC, the version, the operating system and CPU type, how it was installed, the app settings people choose, and the kinds of coding agents running (such as claude or codex). The receiver keeps the country the message came from (two letters) and never stores your IP address. Never included: pane names, paths, terminal content, code or messages. You can see exactly what is sent, and turn it off, under Settings → About → Anonymous usage counts on the PC. Details.
• Features you turn on there, such as voice input or subscription usage meters, contact the providers you set up, under those providers' terms.

Coding agents

The agents you run on your PC, such as Claude Code or Codex, talk to their own model providers under their own terms. Ovis is not involved in those connections.

App stores

Apple and Google may collect information when you download or use apps from their stores, such as download counts and, if you allow it, crash reports. That is covered by their privacy policies.

Children

Ovis is a tool for software developers and is not directed at children under 13.

Changes

If this policy changes, the new version is posted on this page with a new date.

Contact

Questions about privacy: open an issue on GitHub.