Privacy Policy

Updated 2026-10-28

What we store

• Account: your email and, if you sign in with Apple, Google or GitHub, the account identifier, name and profile picture they share (one email is one NoMac account, whichever you use). We use the email to sign you in (email-code sign-in verifies access to your address), and to send account emails: at most one welcome reminder with an offer if you have not bought credit yet, and later notices about your purchases or credit. Every such email has an unsubscribe link, and unsubscribing stops them; sign-in codes and receipts still arrive when you ask for them. A keyed hash of the requesting IP limits how many sign-in codes can be sent.
• Early access: your email, request date and invitation/delivery status. A keyed hash of the request IP helps limit abuse; the waitlist does not store the raw IP. Joining authorizes an access invitation, not a marketing subscription.
• Cloud Mac sessions: session state, usage, billing records and the first observed successful managed command. Your files and command output live inside your session; stopping deletes the VM. Files on the account's drives (~/drive) are kept between sessions, encrypted, until a drive is reset, deleted unused (after 90 days, or 30 for a drive NoMac made) or replaced at the account's drive limit (earlier versions for up to a week). A copy of a drive is a drive of its own, kept after its source is reset. Output is bounded and older completed logs can expire. Session and billing records remain separate from guest files.
• NoMac Simulator phones: the project files you or your agent send to a phone and their build output are kept between sessions in a workspace of your account's on the Mac that ran it, an encrypted volume locked while none of your phones runs, so builds stay incremental. The phone states you save by name are kept in private object storage, each encrypted under a key of its own, so any of your phones can restore them. The phone itself is erased when its session ends. Each session's replay (a video of the phone's screen beside the calls made to it, without the text typed through them) is kept in private object storage for 7 days, then deleted. Anyone holding a phone's view or control link can watch or use it while the link lasts, and anyone holding a replay link can watch the replay. Requests from a phone through its tunnel to your own machine pass through NoMac and are not stored. Workspaces and saved states are deleted after 90 days without a phone. Delete a saved state at any time; email support@nomac.app to delete your workspaces sooner.
• File links: a file you or your agent moves through an upload or download link (for example a build product, a screenshot or a screen recording) is held in private object storage until the link expires, at most a day after it was made. A file uploaded to a Mac is deleted from storage as soon as it is on the Mac. Anyone holding a link can use it until it expires. Screenshots and recordings that are not shared by link stay inside your session, like any other file.
• Connected apps (ChatGPT, Claude and other MCP clients): when you approve an app, we store an API key for it (only its hash, a label and when it was last used) and an audit record of the approval. The app receives what its tools return for your account: credit balance, Mac session state, the output of commands it runs, and the build and App Store data it asks for. What you type in that app, and what it does with the results, is covered by its provider's own privacy policy. Revoke the key on the Keys page at any time.
• Product usage statistics: to improve NoMac we record, per account, how you found us on your first visit (the campaign tags in its link, referring website and landing page, kept in a first-party cookie until you sign up), which client you use (for example the CLI version and operating system, or the name an MCP app like Claude or Cursor reports), which tools and API calls you use and the error codes they return, and anonymous command categories on your Mac (for example “xcodebuild build” or “simulator”) with exit codes. We never record command arguments, file names, paths, file contents, command output or what you type over SSH. These statistics are internal, are not shared, and are deleted with your account.
• Support: the description and optional follow-up address you provide, plus relevant account-scoped build or Mac session context. We do not attach host credentials or private operational diagnostics to customer tickets.
• Contact form: the name, email, company and message you send us, and any estimates you add, to answer you. A keyed hash of the sending IP limits how many messages one network can send; the IP itself is not stored.
• Credentials you connect: your App Store Connect API key, the signing certificates and keys we create for you or you upload, and the provisioning profiles we make, AES-256-GCM envelope-encrypted with a per-organization key, itself protected by a separate key kept apart from our database. Every decryption writes an audit record. The App Store Connect key is used only by our server, with Apple, to sign, send builds and notarize for you; a Mac receives certificates and profiles, never that key, unless you store it there yourself as a secret. Removing a certificate never revokes it at Apple. We never ask for your Apple ID password.
• Secrets you store: the variables and files you enter in the browser, from your terminal or through a request link, encrypted the same way. No page, API or tool shows a value again. A Mac receives them when it starts (or when you install them) as environment variables and files inside the VM, which stopping deletes. Their values are hidden in command output returned to your tools, as a precaution: a command you run can still read them. We record when each was changed or delivered, never its value.
• Your Mac's login password: each Mac session gets its own, made by us, set on that Mac and given to you and your agent (also as an environment variable on the Mac). We keep it encrypted while the session runs, record each time it is shown, and erase it when the session ends.
• Your code: pushed snapshots live in a private mirror repository used only to run your builds, isolated per project. Secret-looking files (.env, keys, certificates) are excluded on your machine before upload.
• Build logs: stored trimmed and secret-redacted.

What we don't do

• We do not sell your data or use your code to train models.
• Your chosen agent or software controls what it sends to its own services. Installing an agent inside a Mac session is your choice.
• We use website analytics, operational counts and the product usage statistics above to understand visits, activation and failures. We do not use advertising trackers.

Processors

Vercel (hosting), Neon (database), GitHub (private build mirror), Codemagic (the Builder's macOS build machines: your code and a short-lived credential lease reach the ephemeral build VM), Apple (sign-in and publishing), Google and GitHub (sign-in), Polar (payments; we never see card numbers), Resend (sign-in codes and invitations), Cloudflare (file storage, including file links), dedicated Apple-silicon hosting for Mac sessions and phones, and a server host for the gateway that connects them. Operational notifications use Telegram. Vercel also provides website analytics.

Deletion

Deleting a connection shreds its encrypted credentials. Removing a certificate on the Apple page deletes its private key from NoMac; deleting a secret deletes its value. Neither reaches Macs started afterwards. Deleting a project deletes its mirror branch. Stop a Mac session to delete its guest files. Email support@nomac.app to remove a waitlist request or request an account export or erasure. Payment and security records may require separate retention.