Sealed on your device, before it syncs.

Houston for Mac runs your AI coding agents, Claude Code and Codex, on your Mac. Houston for iPhone, iPad and Apple Watch is its companion: it shows your Mac's board, and carries what you ask its agents back to the Mac. A Houston account syncs them through Houston's own service.

This policy covers the companion apps and the account service. Sec. 14 covers Houston for Mac.

There is no advertising, no tracking and no analytics. Nothing is sold, or shared for advertising. What Houston keeps about you, it keeps to sign you in and to sync your devices, and for nothing else.

You make a Houston account by signing in with Apple, with Google, or with a six-digit code we email you. Houston asks Google only for its id for you and your email address. It asks Apple for your email too, and Apple lets you hide it behind an address Apple relays. A second way of signing in joins the account whose email address it shares, once Apple, Google or your inbox has confirmed the address is yours.

The service keeps

• Each way you sign in: Apple, Google or email, that provider's id for you, and the email address it gives01
• Each signed-in device: the name and kind it reports (Mac, iPhone, iPad), Houston's id for it, its public key, the way it signed in, and when it was added and last seen02
• An iPhone's or iPad's push token, so the service can tell it something changed03
• A hash of each device's sign-in token, never the token itself04
• Your account's key, only as wrapped to each device's own key, which only that device can open05
• While a new device waits for that key, the Apple or Google sign-in it arrived with, so your other devices can check it's you, until it gets the key or signs out06
• What your devices sync, sealed (Sec. 04)07

To send a sign-in code, the service keeps your address with a hash of the code, which works for ten minutes, and counts of codes sent and wrong tries, which it needs for an hour, or a day after a wrong try. To stop anyone mailing the world through Houston, it counts the codes asked for from each network for an hour, by a hash of the network's address. It clears both once they're that old, the next time it sends a code.

When you sign in on the web, the service holds Apple's or Google's answer until your device collects it, which it must do within five minutes.

The service runs at houston-service.vercel.app.

Everything your devices sync through your account — the board, your chats, missions and knowledge, what you ask the Mac's agents, and alerts — is sealed on the device with your account's key (AES-256-GCM) before it is sent. The service stores it sealed and cannot open it, and neither can Decima Labs.

Your first device makes the key. A device you sign in later gets it from one of your devices that has it, wrapped to that new device's own key, so the service only passes it along and never has it. Your devices check that the new one signed in as you, with Apple or Google, before they hand the key over; a device signed in with an emailed code waits until you allow it on one of them. There is no copy of the key anywhere else: if you lose every device, your account starts a new key, and your Macs sync their work again.

Of each sealed record, the service sees only

• Which part of Houston it belongs to: boards, requests, missions, knowledge, alerts, or your devices and settings01
• Its name and type02
• Its size03
• When it changed04
• Which of your devices wrote it05

One thing goes unsealed: an alert you get on the lock screen. Its title and body travel to Apple's push service as words, so the phone can show them; the service passes them on and doesn't keep them.

Decima LLC runs the service, in the United States, with these companies acting for it:

• Vercel runs the service, in its Washington, D.C. (US East) region01
• Neon hosts its database, on Amazon Web Services in US East (N. Virginia)02
• Resend sends sign-in codes: it gets your address and the code03
• Apple: Sign in with Apple, and the Apple Push Notification service, which gets push tokens and an alert's title and body04
• Google: Sign in with Google, which Houston asks only for its id for you and your email address05

Like any server, the service and Vercel see the IP address each request comes from. Sign in with Apple and Sign in with Google work under Apple's privacy policy and Google's.

The service keeps your account until you delete it. A device stays signed in for 180 days from the last time it is used. Signing a device out, from itself or from another of your devices, deletes its sign-in and its copy of the key. When a device deletes a record, the service keeps the record's name, type and time, but not its contents, so your other devices hear that it's gone.

Deleting your account deletes everything the service keeps under it at once: the account, the ways you sign in, your devices and their sign-ins, your key's wraps, and every record. When you confirm it with Apple, the service also revokes the sign-in Apple gave Houston. It deletes an account only with a fresh sign-in, so a lost device alone can't. You can also write to us (Sec. 17) and we will delete it.

Decima Labs receives crash reports only while Settings › Share crash reports is on. It is off in copies from the App Store and TestFlight until you turn it on. Turning it off stops sending at once and deletes any reports not yet sent.

A report holds

• Crashes, and hangs: the main thread stuck for 2 seconds or more01
• A failed read of the board02
• How long launching, some board reads and each request to the Mac took, and whether each worked03
• Where in the code it happened04
• The app's version, build and commit05
• The device's model and family, memory size and processor count06
• The operating system's name and version07

A report never holds

• A user or device identifier01
• Screenshots, or the screen's views02
• Breadcrumbs: no trail of what you did03
• Any of the board's words: agent names, chats, mission titles or code04

Reports go through Sentry, a crash-reporting service run by Functional Software, Inc. in the United States, acting for Decima Labs. They are used only to find and fix crashes and slowness.

A device not signed in to a Houston account keeps the board, its chats and what you ask the Mac's agents between your own devices only, in one of two ways.

Through your iCloud: the private database Apple's CloudKit keeps for your Apple Account, which Decima Labs cannot read. Chats and the words of your replies go in CloudKit's encrypted fields. Apple's privacy policy covers iCloud.

Directly, on the same network: your iPhone or iPad and your Mac talk over a connection encrypted and authenticated with a key only those devices hold.

To connect across networks, a device asks a public STUN server — Cloudflare's, then Google's — what public IP address and port it is seen from. The request carries nothing else. Those servers see your address, as any server you connect to would.

If you add a Claude Code routine, its token is kept in your iCloud Keychain and sent only to Anthropic's API (api.anthropic.com), with the task you start, under your own Claude account and Anthropic's terms. Decima Labs receives neither the token nor the task.

The composer's microphone turns what you say into the words of a reply, with Apple's speech recognition. Where the device supports it, recognition happens on the device; where it doesn't, Apple's speech recognition service does it, under Apple's privacy policy. The words go nowhere until you send the reply, and Decima Labs never receives audio.

Notifications and Live Activities reach your device through Apple's push service: from your own iCloud and your own Mac, or, with a Houston account, from Houston's service. The service's quiet pushes say only which kinds of record changed, so the app can fetch them; an alert carries its title and body, as Sec. 04 says.

Your settings are kept in the app's own storage on the device, and deleting the app removes them. The keys that pair the device with your Mac are kept in the device's Keychain, never backed up to or synced with another device. iOS can keep an app's Keychain items after the app is deleted, so to end a pairing for good, unpair the device on the Mac: Settings › Devices › iPhone & iPad. A signed-in device keeps its sign-in in the Keychain too; signing out ends it on the service (Sec. 06).

What Houston keeps in your iCloud you can delete from your iCloud storage in the Settings app — at the time of writing, Settings › [your name] › iCloud › Manage Account Storage. Turning off sharing on the Mac stops it writing anything more; what is already in your iCloud stays until you delete it there.

Houston for Mac sends Decima Labs nothing it reads on your Mac, apart from what it syncs, sealed, through your Houston account (Sec. 04) and crash reports. Crash reports go through Sentry while its Share crash reports with Decima Labs setting is on. That setting is off in released copies until you turn it on, and on in copies built from source. Turning it off stops sending at once and deletes reports not yet sent.

Otherwise, what leaves the Mac goes where you send it: the board, to your own devices once you turn sharing on (Sec. 08); a team's missions, to the people you invite, through iCloud sharing, where members see each other's iCloud names; and, when you press ⌥Esc in its editor, the code around the cursor, to Anthropic's API with your own API key. The agents it runs, and the services you connect it to, work under their own terms.

It also asks GitHub for its latest release once an hour, and, while its Claude Code integration is on, checks every minute that api.anthropic.com and Apple's captive.apple.com answer. Those requests carry nothing of yours; those servers see your address, as any server would.

Houston is a tool for running AI coding agents. It is not directed at children.

If this policy changes, the new version is posted on this page, with a new date at the top.