Privacy Policy

Information we collect

When you sign up, we receive your email address and password. We don't store your password as typed; we convert it into a value that can't be reversed (bcrypt) and store that.

Each time you log in, we record a login entry (when you logged in, the address you connected from, and the type of browser or app) and a token that keeps you logged in on the RUNNERS system server (server.system.runners.im).

How we use it

We use it only to verify logins and to let computers and phones on the same account find each other. We don't use it for advertising, sell it, or give it to other companies.

When you log in on runners.im

When you log in on runners.im, your email and password travel over an encrypted connection (HTTPS) through the runners.im server to the RUNNERS system server. The runners.im server does not store your password.

The token that keeps you logged in is stored in a cookie in this browser (ra_refresh, 30 days). Scripts on web pages cannot read this cookie. When you log out, we delete the cookie and also end that token on the server.

Retention and deletion

We keep your account information until you delete your account. To delete your account, email support@runners.im from the email address you signed up with. After we confirm it's you, we'll delete your account and login history.

What Split collects

Split has no ads and no analytics. It sends nothing about you or your computer to Runners or anyone else, except what is listed under "Phone tab" below, and only after you sign in there.

What Split reads on your computer

To move a window, Split reads the position and size of windows and which app they belong to. It never reads what is inside a window. This happens only on your computer and is never sent anywhere.

Your shortcuts and settings are saved on your computer in Split's own settings. When you save a layout, Split also saves each window's title, the app it belongs to and its position on your computer (Layouts.json in Split's data folder) so it can put the windows back. Deleting the layout removes them.

Phone tab

The Phone tab in settings lets the Split phone app arrange this computer's windows. It does nothing until you sign in there with a RUNNERS account. Once you sign in:

Your email and password are sent to the RUNNERS account server (server.system.runners.im) to sign in. The password is not saved on your computer. The sign-in tokens the server returns and your email are saved on your computer (Account.json in Split's data folder), with the tokens encrypted by the system keychain.

While you stay signed in, Split keeps one connection open to server.system.runners.im and sends: an ID for this computer made by Split, the computer's name, the names of the connected monitors, the window shapes Split offers, and the names of your saved layouts. The phone app signed in to the same account sees these to draw this computer.

Commands from your phone (apply a shape, bring back a saved layout, undo) come back over the same connection and run only on your computer. Window titles, window contents and the apps you use are not sent.

Signing out in the Phone tab tells the server to end that sign-in, closes the connection and deletes the tokens and the email from your computer.

Updates

The version downloaded from GitHub, runners.im or Homebrew checks GitHub (github.com/RUNNERS-IM/split) for a new version once a day and downloads it from there. You can turn this off in settings. The Mac App Store version is updated by the App Store and does not check for updates itself.

Account and usage statistics

Prompt has no cloud account. Sign-in and relay through Orca's company servers are turned off, and it does not send usage statistics. A connection to another computer happens only when you create a link with “Share This Computer…” and hand it over yourself.

The app it is built on

Prompt is built on Orca (MIT) and does not connect to the Orca company's servers.

Sending feedback

Choosing to send feedback opens a new-issue page for Prompt on GitHub in your web browser. Below what you wrote, it fills in the Prompt version, the operating system and its version, and the chip type.

What Monitor collects

Nothing, unless you sign in under 'Phone…' (below). Monitor has no ads and no analytics. Without signing in, it does not send anything about you or your computer to Runners or anyone else.

What Monitor reads on your computer

Every few seconds Monitor reads CPU use, memory use and the free space on the system disk. It also reads the names of running processes, only to count claude processes, to see whether a GitHub Actions runner is waiting or working (and, from launchd, whether one is turned off), and to name the apps using the most. It notes which app is in front, only to avoid suggesting you quit an app you are using. It never reads what is inside a window, a file or a process. This happens only on your computer and is not stored or sent anywhere.

Network

Monitor connects to the network for updates, for other computers on your Tailscale network and, only when you sign in, for the phone app, both described below. A minute after it starts, and once a day after that (checked again when the Mac wakes, so a day spent asleep is not skipped), it reads the list of releases and the update file (latest-mac.yml) from Monitor's GitHub release page to see whether there is a newer version; if there is, it downloads it, then asks you, and only installs it when you choose 'Install Now'. Choosing 'Later' means it does not ask again that day. The requests carry nothing about you or your computer; like any download, GitHub sees the computer's IP address. Turning off 'Check for Updates Automatically' stops the daily check. Choosing 'Check for Updates…' does the same check right away. Choosing 'Help & Feedback' opens Monitor's GitHub issue page in your web browser.

Other computers on your Tailscale network

This only happens when the computer runs Tailscale and is connected to a tailnet. Without Tailscale, Monitor does none of it.

Monitor answers on the computer's Tailscale address (port 7788) and asks the other computers of the same tailnet for their numbers every 30 seconds (every 5 seconds while the All Computers window is open). It answers only devices of the same tailnet, never devices shared in from another tailnet, and it reads the tailnet's device list with the tailscale status command to tell them apart. The answer holds the computer's name, system and Monitor version, CPU, memory and disk use, whether it is slow, the names and memory of the five apps using the most memory, how many claude processes and GitHub Actions runners are running, and how much could be emptied. It never holds file paths, window contents, or what a claude session is called or doing. Nothing goes to Runners or any server: the numbers travel only between your own computers, inside Tailscale's encrypted network, and are kept only in memory. Another computer can only read these numbers; it cannot quit apps or delete anything.

Phone app

This only happens after you sign in to a RUNNERS account under 'Phone…' in Monitor's menu. Signed out, Monitor does none of it.

Signing in sends your email and your password, as typed, over an encrypted (HTTPS) connection to the RUNNERS system server (server.system.runners.im); the tokens it returns are kept on the computer, encrypted with the system keychain. While signed in, Monitor stays connected to that server and sends, every 5 seconds, the same numbers as above plus the kinds of folders that could be emptied with their sizes and the names of GitHub Actions runners. The server passes them on only to the Monitor phone app signed in with the same account and keeps only the latest numbers, in memory, to show a phone that opens later. When the computer stays slow, Monitor also sends the slow-computer notice (its title and the names of the heaviest apps) so the server can push it to that phone.

The phone app can ask this computer to quit one of the listed apps, to empty one kind of cleanable folders, or to pause a runner for an hour and start it again. Quitting works as in Monitor's own panel: an app is asked to quit as ⌘Q would, so it can ask to save first; a development server is ended right away; terminals, editors and claude sessions are never offered. Only a phone signed in with the same account can ask; the server marks who sent each request, and Monitor takes requests only from phones, never from another computer. If a newer Monitor connection takes over this computer's place, this one stops instead of retrying, and says so under 'Phone…'. The phone asks you before sending; the computer then does it without asking again. Choosing 'Sign Out' stops all of it.

What Remote collects

Only the details of the RUNNERS account you sign in with, described under Office connection below. Remote has no ads and no analytics, and it sends nothing else about you or your computer to Runners or anyone else.

What Remote reads on your computer

Remote takes pictures of this computer's screen only when asked. Two kinds of requesters can ask: other computers and phones on the same account, while 'Let Other Computers See This' is on, and Claude connected through Remote's MCP server (see Claude below). It takes them even while the Remote window is closed. Screens sent to another device go straight to that device (as video of up to 15 frames a second, or one picture at a time), and stop when the other side disconnects, when you turn that switch off, or when you choose 'Disconnect Now'. The pictures stay in memory only and are not saved to disk.

Remote also reads the list of displays and whether it has the Screen Recording and Accessibility permissions.

When you watch another computer's screen in the Remote window and turn on 'Send Clicks', clicks, scrolls and keystrokes on that picture go to that computer, not to this one. Remote clicks and types on this computer only for input sent by other devices on the same account while 'Let Other Computers Click and Type' is on, and for Claude's input after the approval described in the README. Remote does nothing else with your mouse or keyboard.

Network

Remote connects to the internet for two things: updates, and the office connection below. A minute after it starts and once a day after that, it reads the list of releases and the update files (latest-mac.yml, latest.yml, latest-linux.yml) from Remote's GitHub release page to see whether there is a newer version; if there is, it downloads it first, then asks you, and only installs it when you choose 'Install Now'. Choosing 'Later' means it does not ask again that day. The requests carry nothing about you or your computer; like any download, GitHub sees the computer's IP address. Turning off 'Check for Updates Automatically' stops the daily check, and choosing 'Check for Updates…' does the same check right away. Choosing 'Help & Feedback' opens Remote's GitHub issue page in your web browser.

Office connection

Computers and phones are connected through the RUNNERS account you sign in to in the Remote window. When you sign in, Remote sends the account's email and password to the RUNNERS system server (server.system.runners.im). The password is sent only over an encrypted connection (HTTPS), and the server stores only a value converted with bcrypt. The two tokens the server returns are kept in Remote's own folder, encrypted by the operating system, and nothing else about you is kept.

While you are signed in, Remote keeps one connection open to the server's relay. The relay tells it which computers and phones on the same account are on (a name and a random device ID for each device) and passes on the short messages two devices need to set up a connection with each other. Screens, clicks and keys don't pass through the server; they go directly between the two devices over WebRTC, encrypted (DTLS-SRTP). To find a direct path, each device asks a public STUN server (stun.l.google.com) for its own internet address, and sends nothing else.

Other computers and phones on the same account see this computer only while 'Let Other Computers See This' is on, and can click and type only while 'Let Other Computers Click and Type' is also on. 'Disconnect Now' turns seeing off at once. Remote answers only devices that the relay reports as being on the same account, and it does not wait for connections on any port of this computer. 'Sign Out' in the window ends both the relay connection and all connections with other devices.

The connection log (who viewed, clicked or typed, and when; never the text typed) stays only in this computer's memory and is gone when Remote quits. Screens sent to another computer are not saved on either computer.

Claude

When you add Remote's MCP server to Claude, Claude can see the list of computers and their screens and, after the approval described in the README, click and type. Screenshots Claude takes go to Claude like anything else you show it, under Anthropic's terms. Remote itself sends nothing to Anthropic or Runners.