What Cody stores

An account here is a random id and a token. We don’t ask who you are, and we built the rest so that we never learn it by accident.

This page describes the code as of October 1, 2026 (private beta). It lists everything, area by area — including the parts that aren’t as private as we want yet.

What we never store

Your name, email, address, phoneNo form of ours asks for them. When a payment notice from Stripe includes them, we don’t keep them.
Card detailsYou pay on Stripe’s page or through Apple. A card number never touches our servers.
IP addressesTo limit abuse we count requests under a keyed hash of your address that changes every day; the count is deleted within four hours. The address itself is never written to our database or our logs.
Names of your Macs and devicesWe keep “Mac” and “Safari on iPhone”, never “Joshua’s MacBook Air”. See the note on pairing below.
Your browser’s full user agentOnly its family — the browser and the kind of device.
What you do with CodyTerminals, prompts, files and screen streams go between your devices and your Mac. None of it is in our database.
Analytics, ad trackers, telemetryNone — not on the site, not in the apps.

The website www.codymccodeface.com

What	Why	Kept
Your invite code, and a signed copy of it in a cookie	The door of the private beta. With the code we keep how often it was used and a short note the admin wrote when making it — which may say who it was for.	The cookie: 180 days. The code: until the admin removes it.
A row per browser or headset that came through your invite	So you can see your devices and forget one. A random id (also in a cookie), the family (“Safari on iPhone”), first and last seen.	Until you press Forget, or 181 days after it was last seen.
A row per Mac that joined with your invite	So the right devices reach the right Mac. A room id your Mac made, your invite, the word “Mac”, first and last seen.	181 days after the Mac was last seen.
Which device reached which Mac, and when last	Your list of Macs and devices.	181 days after last use.
Request counters	Rate limits. Counted under a keyed, daily-changing hash — not your address.	The hour counted and 2 more.
A board identity, if you make one	The roadmap board. A random id, the SHA-256 of your token (the token itself is shown once and never stored), your points, and what the board shows for you: “Voter 4821”, or an alias if you choose one.	Until you delete it.
Your stakes and the history of your points	The board’s arithmetic. Each purchase is recorded with the payment’s reference at Stripe or Apple.	With the identity.
Things you propose for the roadmap	They are public, and not tied to your identity.	They stay on the board.
Plan and relay settings; the admin’s note	What the relay allows you. If you subscribe: Stripe’s ids for the customer and the subscription. The admin can write a free-text note on an account.	With the identity.
Receipts	The id of a Stripe event or an Apple transaction and a number of points — so one purchase can’t be redeemed twice.	Kept. After you delete your identity they no longer say whose they were.
Dated events	The admin’s charts: “an invite was redeemed by Safari on iPhone”, “someone staked 40 points”. Ids and numbers, no names.	90 days; payments and plans 400.
Licenses	A refundable license is recorded with its purchase reference so it can be refunded. A private license is signed blind: the site cannot find it afterwards. An encrypted copy can be kept for you that only your passkey opens.	Refundable ones: kept. Private ones: nothing to keep.
Relay data: passes and relay tabs	Relay data comes as 1 GB passes, signed blind, so we cannot tell which passes went to whom — with a license, or as a gift. When your Mac needs Cody’s relay it pays passes into a tab: a random id only your Mac knows (we keep a hash of it), with a balance, when it was opened and last paid. Cloudflare’s reported use for the tab comes off the balance. For each pass paid in we keep a hash of its own random id, so it can’t be used twice. Nothing in these names your Mac, your devices, your invite, your license or your board identity. Of a gift we keep that one of so many GB was made and whether it was received.	A tab: until it is used up or 30 days old. Spent passes and gifts: kept (hashes and counts).

The app app.codymccodeface.com

The app’s server has no database. It hands out the web client, runs the rooms where your device and your Mac find each other, and issues relay credentials.

What	Why	Kept
A device cookie	Says which paired device this browser is (a random id).	180 days.
Per room: the public key of your Mac	Only that Mac can take the Mac’s seat in the room.	Kept with the room.
Connection setup messages	Your device and your Mac exchange them through the room to connect directly. They include network addresses, as WebRTC requires. The room passes them on; it does not store or log them.	Not kept.
Relay use	When a direct connection isn’t possible, traffic goes through Cody’s relay (Cloudflare TURN), encrypted between your device and your Mac. We count how many relay credentials were issued, per hour, under an id derived from your invite or your board id.	62 days.

About names and pairing. When you pair a device, your Mac and the device tell each other their names (and the passkey is labeled “Cody on <your Mac>”). Those messages pass through the room on their way and are not stored or logged — but they are not yet sealed from the server while in transit. A Mac app that hasn’t been updated yet also sends the Mac’s name when it joins its room; the server ignores it.

The Mac app on your Mac

What	Why	Kept
Your Devices list	Who may connect: each device’s name, its public keys, when it was paired and last used. This is where the real names live.	On your Mac, until you remove a device.
The Mac’s identity key, pairing keys, session tokens	Proving it is your Mac; keeping devices signed in.	On your Mac (the identity key in the Secure Enclave when there is one).
Your invite code	Checked with the site at launch and once a day; sent when the Mac joins its room.	On your Mac.
A log file	Troubleshooting. It mentions device names; it starts fresh at each launch and is not sent anywhere.	On your Mac.
Update checks	The app asks the update feed for the latest version. No id is sent.	Nothing.

The headset app and the web app on your device

What	Why	Kept
Your saved Macs, with their names	Your Home screen. Stored on the device (the headset’s settings; the browser’s local storage) — not on our servers.	On your device.
A device key and the keys of your Macs	Proving it is this device; refusing an impostor Mac. Only public keys leave the device.	Headset: Keychain. Browser: IndexedDB.
Your board token, if you have an identity	Signing in to the board.	Headset: Keychain. Browser: local storage.
Preferences	Layout, pins, favorites.	On your device.
The public list of revoked license ids, once licenses are in use	Checking a Mac’s license without asking us. It is the same list for everyone and says nothing about you; what your Mac shows for a license goes to your device directly and is not sent to us.	Browser: local storage.

Payments

Who	What they hold	What we keep
Stripe	Your card, an email address (Stripe’s checkout page asks for one), billing country, and the network details of your payment. Stripe also gets your board id from us, so the points land in the right place.	Stripe’s ids for the event, the checkout and — for a plan — the customer, the subscription and its invoices, with the amount paid. No email, name, address or card detail.
Apple	Purchases made in the headset app, under your Apple account.	The transaction id.

Cloudflare, and one more

Cloudflare runs our servers, so its network sees every request to them — address, URL, user agent — under its own retention. Our Workers’ configuration turns on no log storage.
Cloudflare’s relay (TURN) sees the network addresses of both ends of a relayed connection and keeps usage figures under the id we tag the credentials with (derived from your invite or your board id — not a name; for a Mac’s relay tab, a random tag that belongs to that tab alone). It cannot read the traffic.
Cloudflare Access signs the admin in to the admin screen. That is the admin’s email, not yours.
jsDelivr serves two open-source libraries to the web app, so it sees the requests for them.

Not there yet

Paying by card means giving Stripe an email address. We don’t receive or keep it, but Stripe has it next to your board id.
If you subscribe, Stripe’s customer id sits beside your board identity, so the two can be connected through Stripe.
The admin’s notes — on an invite, on an account — are free text.
Names pass through the pairing room unsealed (above).
The relay’s usage id at Cloudflare stays the same from month to month for an invited device (a Mac’s relay tab has its own, for at most 30 days).
An unused column named email still exists in the database. It is empty and nothing reads or writes it.

How to delete

A device: on the website, Your Macs → Forget. Or leave it: it goes 181 days after it was last seen.
Your board identity: Account → Delete this identity… — its row, stakes, history, settings and events are removed for good. If a plan is running, cancel it first (Manage billing).
Your alias: Account → save it empty.
A paired device on your Mac: the Mac app → Devices → Remove.
What your browser holds: clear site data for this site and for app.codymccodeface.com.
Stripe’s or Apple’s records, or an invite: write to josh@codymccodeface.com.