Privacy policy

This policy describes how N.N. LLC (合同会社N.N., “we”) handles information in the cmds Mac app and iPhone/iPad app (“the apps”) and on this website (cmds.n-n.tokyo). If the English and Japanese versions differ, the Japanese version prevails.

1. What the apps collect

The apps send no usage or other information about you to us or to any other third party. There is no telemetry, usage analytics, automatic crash reporting, advertising or account.

To check for updates, the Mac app fetches the update feed from this website (cmds.n-n.tokyo) once a day (also at launch when the last check is more than a day old) and, when there is a new version, downloads it from GitHub and installs it when cmds quits. Like any web request, this sends your IP address and a user agent with the app and Sparkle versions. Turn the automatic check or the automatic download off in cmds › Settings… › Updates.

2. What is stored on your devices

• Workspace layout, each pane's directory, URL, previewed file and SSH host, and agent session ids for resuming are stored on your Mac in ~/Library/Application Support/cmds/.
• The key and certificate used for syncing with your iPhone/iPad are stored in the Mac's keychain; paired devices (token hashes only) in the folder above.
• Settings (language, keep-awake and so on) are stored in the standard macOS / iOS preferences.

You can remove all of this at any time by deleting the app and the data above.

3. AI coding agent information

On your Mac, the app reads what Claude Code passes to its hooks and status line (event name, notification text, model, context, cost, account limits and similar) and, from Codex's session files, the session id, directory, usage and model, and shows them on screen. It never reads your prompts, and uses no conversation content except the first line of Claude's last reply, shown as the notification text. For subagents it reads only the latest tool name with a short target and the token count from the end of their transcript files. None of this leaves your Mac except when it is synced to an iPhone/iPad you paired.

4. Sync with iPhone/iPad

Sync runs directly between your Mac and the iPhone/iPad you paired, over a TLS 1.3 connection pinned to your Mac's certificate, through your local network, Bluetooth LE, or an SSH server you configure. No server of ours is involved. An SSH server used as a relay only passes encrypted data and cannot read it.

5. In-app browser

Websites you open in the in-app browser receive your IP address and other request data like in any browser, and their own policies apply. Text typed into the address bar that is not a URL is sent to Google Search.

6. This website

This website is served by Google's Firebase Hosting. To deliver it, Google may process access records (IP address, user agent, time and similar).

To understand and improve how the website is used, it uses Google Analytics by Google LLC (USA), except on this privacy policy page.

• Information sent: the URL and title of pages viewed, the referrer, actions such as link clicks (download, App Store, GitHub and others) and scrolling, browser, OS and device type, language, screen size, approximate region derived from the IP address, time, and an identifier stored in a cookie.
• Recipient and purpose: it is sent to Google LLC. We use it to understand usage and improve the website. For Google's own use, see how Google uses this data.
• Cookies: the cookies (expiring after 13 months) belong to this website only and are not shared with our other sites.
• Visitors from the European Economic Area, the UK and Switzerland: no cookies are used, and the information above is sent without an identifier. The legal basis is our legitimate interest in understanding and improving the website; the transfer to Google LLC relies on the EU-U.S. Data Privacy Framework (including its UK and Swiss counterparts). You have the right to access, erasure and objection (the setting below stops it) and may lodge a complaint with a supervisory authority. Contact us as in section 7.
• Retention: event-level data is deleted after 2 months and user-level data 14 months after the last visit; aggregated reports remain.
• Google signals and advertising features are off, and the website shows no ads. We do not handle names, email addresses or similar in Google Analytics.

You can stop it with the setting below, the opt-out add-on or your browser settings.

Measure visits from this browser
When off, Google Analytics is not loaded and its cookies are deleted. The choice is saved in this browser for a year (a cookie and localStorage).

7. Contact

Questions about this policy: N.N. LLC, info@n-n.tokyo.

8. Changes

Changes to this policy will be announced on this page.

Effective: October 30, 2026
Updated: November 1, 2026