Your work is personal.
It should stay that way.

Privacy at a glance.

This policy describes TapCue for iPhone and Mac, its managed relay service, and this website. It covers the default end-to-end encrypted relay connection, the optional TLS-only relay mode, and direct local or VPN connections. TapCue is developed and operated by LunarTear Studio LLC (“we”, “us”, or “our”).

• Relay encryption is on by default.

  With end-to-end encryption enabled, only your paired devices decrypt session content. In TLS-only mode the relay can read it; local connections have different protections, explained below.

• Your Mac remains the workspace.

  Codex runs on your Mac. Messages, outputs, and changes you view travel to your iPhone; your configured AI services may also process task content.

• No advertising. No tracking.

  We do not sell personal data, use it for targeted advertising, or track you across other companies’ apps and websites.

01 / The connection

Know how your
connection is protected.

Default relay mode: end-to-end encryption (E2EE). The diagram shows this mode. Session content is encrypted on the sending device and decrypted on your paired device. The relay forwards ciphertext and does not receive the keys needed to read it.

In E2EE mode, the encrypted channel covers transmitted session messages, instructions, attachments, outputs, file changes, and approvals. TLS also protects the network connections to the relay. TapCue does not automatically fall back to TLS-only mode if E2EE fails.

Optional relay mode: TLS-only. You can explicitly turn off end-to-end encryption in a paired Mac’s security settings on iPhone. HTTPS/WSS still encrypts the network connections, but the relay and any infrastructure that terminates TLS can read session content while forwarding it. Turning E2EE back on protects subsequent traffic; it cannot undo exposure of content already sent.

Direct local or VPN connections. These bypass the relay and do not use TapCue’s relay E2EE channel. A ws:// connection has no application-layer or transport encryption, so content and connection credentials can be exposed to someone with access to the network traffic. A wss:// connection relies on TLS and its configured termination point. A VPN provides separate protection only for traffic routed through that VPN; it does not add TapCue E2EE. Use a trusted network and check the connection you have configured.

Connection metadata remains visible. Even with E2EE, the relay and its infrastructure can see routing identifiers, IP addresses, connection mode, timing, and traffic sizes, along with registration and service information described below.

The managed relay is located in Singapore. If you connect from another country, traffic and connection metadata are transferred there; the content is E2EE ciphertext or readable by the relay depending on your selected mode. A self-hosted relay uses the location and infrastructure selected by its operator. Direct connections do not pass through our managed relay.

These protections apply to traffic between your paired devices. They do not extend to direct image-preview requests from your iPhone, content stored on an unlocked or compromised device, content shared with support or exported, or content sent from your Mac to Codex, a model provider, or a connected tool.

02 / Data collection & use

What is processed, and why.

TapCue processes only the information needed to connect your devices, show your sessions, carry out your requests, maintain the service, and respond when you contact us.

We do not include advertising SDKs or third-party behavioral analytics in TapCue. We do not use your session content to train our own AI models. Your chosen AI provider’s processing and training settings are governed separately by that provider.

03 / Permissions

You choose what to allow.

Camera

Used when you scan a Mac’s pairing code. TapCue does not upload the camera feed to our relay or keep it as a recording.

Local network

Used to connect to a Mac on your local network. Denying it can prevent local pairing and sessions.

Microphone & speech

Optional voice input turns speech into an editable draft on supported devices. Recording begins when you choose voice input, and you decide when to send the text. Apple’s speech and keyboard dictation services follow your system settings and Apple’s policies.

Attachments & image links

Items you choose to attach are shared with your Mac and, as needed for your task, its configured AI services when you send a message. If you open an image-link preview, your iPhone directly requests the image from its source before the message is sent. The image host can therefore receive request information even if you never send the message.

Change camera, microphone, and local network permissions in iPhone Settings → Apps → TapCue. Turning off an optional permission does not prevent you from using unrelated features. Pairing credentials are stored in the iPhone Keychain.

04 / Third parties

The services involved.

Your Codex and AI setup. TapCue sends your instructions to Codex on your Mac. Codex, your selected model provider, and tools or integrations you enable may process prompts, code, attachments, outputs, and other task context. This is separate from the TapCue relay. Review those services and their permissions before sending confidential information. You can review the privacy and AI data-sharing disclosure from the pairing screen or Macs tab on iPhone.

Image-link previews. Opening or reloading an image preview on iPhone contacts the image host directly to retrieve the image. This request does not go through your Mac or the TapCue relay E2EE channel, and can happen before you send a message. The image host and its delivery infrastructure receive your IP address, requested URL, and normal request metadata; their own privacy and retention practices apply. Sending the image link in a message is a separate step.

Service providers. We use infrastructure and email/support providers to run the relay, deliver this website, and respond to you. They may process the connection metadata or support information needed for those services. In TLS-only relay mode, the relay and infrastructure that terminates TLS can also access session content while forwarding it. We require providers acting on our behalf to protect personal data to the same or an equivalent standard described in this policy, restrict use to the contracted purpose, and maintain appropriate security.

Apple. App distribution, device permissions, Keychain, and optional system speech features involve Apple services. Apple processes information under its own policies and your settings.

Legal and security requests. We may disclose information we hold when legally required, to protect users and the service, or to establish or defend legal rights. In E2EE relay mode, we do not hold the keys needed to decrypt session content. That limitation does not apply to TLS-only content visible during forwarding or information you separately share with us.

You choose your AI providers and integrations. Read the OpenAI Privacy Policy and Apple Privacy Policy where those services apply. TapCue is independent of OpenAI.

05 / Retention & deletion

Keep what you need.
Remove what you don’t.

iPhone diagnostics and voluntary reports. Local diagnostic logs record connection states, error categories, timing and sizes, not conversation text, images or credentials. They are capped at 3 MiB and kept for up to 7 days, with cleanup when the app next runs. In Settings → Diagnostics & Feedback, you can export or clear local logs. Where online submission is enabled, reports are sent only when you tap Upload; an optional contact email and the description you enter are included. Our support service can read submitted reports, which use HTTPS and are separate from device-to-device E2EE. The email is used only to contact you about that report. Reports, descriptions and email addresses are deleted after 30 days and are not included in relay backups; contact support with the receipt code to request earlier deletion. Pending reports stay on your device for at most 7 days and are never retried automatically. Clearing local logs does not delete reports already submitted. Do not put secrets or private code in the description.

Relayed content. Session payloads in both relay modes are forwarded in real time and are not stored as a conversation archive on the relay. E2EE payloads remain encrypted; TLS-only payloads are readable during forwarding. Temporary transmission buffers are released when they are no longer needed for delivery. Your devices manage session history and reconnection. Content sent to your configured AI providers and tools is subject to their retention and deletion practices.

Device and connection records. Relay registrations and authentication records are retained while needed to route and secure your connection. Revoking access disables the connection; it does not automatically erase all registration or security records. Contact us to request removal of managed-relay records. We delete or de-identify records when they are no longer needed for service operation, security investigations, or legal obligations.

On your devices. Local configuration, cached summaries, and drafts remain until you remove them or the app clears or replaces them. Removing a paired Mac on iPhone clears the local data and credentials for that connection. It does not erase the Mac’s Codex history, project files, or device backups. On your Mac, revoke a paired device to terminate access and manage session history and files using your local tools. Archiving a session is not permanent deletion.

Support requests. We retain your correspondence and voluntarily supplied attachments while handling the request and any necessary follow-up, then delete or de-identify information no longer needed. You may request earlier deletion. We may retain limited records where required to resolve a dispute, prevent abuse, or meet legal obligations, and will explain any applicable limitation.

Logs and backups. Operational logs are retained only as needed to maintain security and troubleshoot service issues, then deleted or rotated. Backups may retain removed records until they expire under the operator’s backup cycle and are not used for ordinary processing. Self-hosted relay records and backups are controlled by their operator; contact that operator for deletion.

06 / Your choices

You remain in control.

Review data use in the app. The iPhone app’s pairing screen and Macs tab keep the privacy policy and AI data-sharing disclosure available. Stop running tasks or revoke access on your Mac if needed, and use the relevant deletion options for existing data. Opening an external policy or support link is a separate action you choose.

• Choose which Macs and projects to connect and which content to send. Keep relay E2EE enabled to prevent the relay from reading session content.
• Decline a requested action, stop a task, or revoke a paired device from your Mac.
• Turn off optional permissions in system settings or stop using the relay.
• Ask us to access, correct, delete, or provide a copy of personal information we hold about you.
• Where applicable, object to or restrict processing, withdraw consent, or complain to your local data protection authority.

Send requests to support@lunartear.studio. Describe your request without including secrets or private code. We may ask for limited information to verify that you are entitled to the data. We respond within the period required by applicable law and explain any records we must retain. Withdrawing consent does not undo processing already carried out lawfully.

TapCue’s device-pairing flow does not create a TapCue account. You can disconnect devices and request removal of service records without an account-deletion flow. We cannot remotely erase data held exclusively on your Mac, iPhone, backups, or independently chosen third-party services.

Where a legal basis is required, we process information to provide the service you request, with your consent for optional submissions and permissions, for legitimate interests in service security and support, or to meet legal obligations, as applicable.

07 / This website

A simple website.

This website uses no advertising or analytics cookies, tracking pixels, third-party font requests, or browser-based profiling. Its navigation does not require an account, and it does not store your browsing history in local storage.

The hosting infrastructure necessarily processes your IP address, requested URL, browser information, request time, and response status to deliver pages and protect the service. Any operational access logs are used for those purposes and handled under the retention principles above. Following a support link or sending an email takes you to the relevant service, whose own data practices also apply.

TapCue is a developer tool and is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has sent us personal information, contact us so we can address it.

08 / Contact & updates

Questions are welcome.

For questions about this policy, a privacy concern, or a data request, contact:

We update this policy when our practices change and revise the date above. For material changes, we provide appropriate notice and obtain consent where required before new processing begins.