Privacy for the apps

1. Your contact

The provider responsible for this service is:

2. From a Codex event to a face

On your Mac, you choose the projects you want to connect to blinu. blinu link processes their local Codex events and also reads data from the local Codex connection and local Codex databases to display status. This lets blinu recognise ongoing work, questions, approvals, sub-agents and completed responses.

Conversation content, such as prompts, responses or tool data, may also be briefly processed in your Mac’s memory. blinu link reduces it to the information needed for status. It does not create its own conversation archive.

The paired iPhone receives status data: task, event and project identifiers, project display names, timestamps, status and reasons for status, tool names, active sub-agent counts, relationships between tasks, and indicators of open questions, voice activity and connection state. This also includes the Mac’s display name and a Mac identifier generated by blinu. Prompts, responses, tool arguments and results, and conversation files are not transferred to the iPhone over this status connection.

The project identifier is calculated from the local project path. The full path is not sent to the iPhone. Identifiers and display names may still reveal information about a project or person; they are not automatically anonymous.

3. Pairing and the local connection

Status is transferred directly between your Mac and paired iPhones over Wi-Fi. The connection is encrypted with a shared pairing key. This local status service requires no blinu user account. No status data is sent to a blinu server as part of this connection.

blinu uses the local Bonjour network service to find your Mac. This involves processing technical network addresses and changing discovery identifiers. Other devices on the network can generally detect that a network service exists; the Mac network name supplied by the operating system may be visible there.

The pairing invitation contains the Mac identifier, display name and secret connection key. The QR code is created on the Mac. When you scan it with your iPhone, blinu uses the camera only to recognise this code. The app does not save photos or videos or upload camera images. You can also enter the complete invitation yourself or use the paste function.

Copying and pasting happen at your request. Copied invitations and diagnostics may then remain in your system clipboard, which is managed according to your operating system and settings. An invitation does not expire automatically. Using “Reset pairing” on the Mac replaces the shared key and invalidates previous invitations and connections for all paired iPhones.

4. What is stored on your devices

• On your Mac: connected project paths and names, setup and cleanup information, and the local Mac identifier. Status events are temporarily stored in files and removed after processing. During setup, blinu link may back up existing Codex hook configurations; these backups may also contain pre-existing entries.
• On your iPhone: the Mac identifier and name, your project and task names, filters, pinned or hidden tasks, and settings for appearance, sounds, haptics and focus. The current task status received is held in memory.
• Pairing: both apps use the local keychain. Entries are not configured for iCloud Keychain synchronisation. On the iPhone, an additional key tied to the installation protects the stored pairing. The app marks this key file for exclusion from device backups.

The language initially follows the app language selected by the operating system. You can change it per app in system settings. Your language preference stays on each device and is not synchronised between Mac, iPhone and website.

Settings, pairing data and configuration backups have no fixed automatic expiry. They remain until changed or cleaned up. Event files may remain longer when blinu link is paused or closed. Invalid files are set aside and currently have no automatic deletion period either.

5. Focus time, notifications and voice

The Pomodoro timer stores your work and break durations, timer state including its end time, and sound and reminder preferences on your iPhone. If you enable reminders, the app schedules a local iOS notification with fixed timer text and an optional sound. No task content is sent to a notification server for this purpose.

The voice display uses local Codex activity data to detect an active voice session. blinu does not record microphone audio or transmit voice recordings. Mouth movements are generated as an animation. Voice processing within Codex is a separate process carried out by OpenAI.

5a. Optional push notifications

In app versions that support push, you can enable and individually select notifications for questions, required approvals, completed responses and errors under “Push notifications”. Push is off initially. The local status display and timer reminders work independently. blinu link must be running to send notifications, and both your Mac and iPhone need internet access.

Once you enable push, your iPhone registers a random device association, an Apple-issued push token, the delivery environment and your selected event types with our service at push.blinu.app. Random credentials protect registration and sending. Your Mac sends only an event type, a random event identifier and a timestamp to this association. Project and task names, project and task identifiers, conversation content and the Wi-Fi pairing key are not sent to the push service. Project filtering takes place locally on your Mac.

We operate the push service on our infrastructure hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. Connections technically involve processing IP addresses and connection data. For delivery, the service sends the push token, app identifier, a random notification identifier and a fixed, neutral event notice to the Apple Push Notification service (APNs). Apple associates the token with your device and delivers the notification. These identifiers are pseudonymous, not anonymous. We do not use this push data for advertising or usage analytics.

Apple processes data under its Privacy Policy, which may involve processing outside the European Economic Area, particularly in the United States. Apple’s policy explains international processing and the safeguards used. The retention periods below apply to our push service, not to a guaranteed deletion period at Apple.

Our service stores the push token encrypted, credentials as hashes, and the random device association, delivery environment, event selection and last update time. Registrations expire 30 days after the iPhone app last updates them. Event identifiers used to prevent duplicate notifications expire after 10 minutes. After revocation, the random association and revocation time are kept as a blocking record for 30 days to prevent delayed requests from restoring the registration. Cleanup runs during API use and additionally every hour while the service is running. There is no conversation archive or persistent notification queue. Push preferences remain stored locally; device credentials are held in the device-bound keychain.

You can deselect individual events or turn push off entirely in blinu. Turning push off, forgetting the Mac and cleaning up app data revoke the associated registration over the internet; the token and delivery association are then deleted from the active database. If the connection fails, the app shows an error and retains the pending revocation for another attempt. Resetting Mac pairing also revokes known push associations. Simply uninstalling the app or withdrawing iOS notification permission does not guarantee immediate deletion on the server; turn push off in blinu first. Without another update, the expiry period above applies.

Processing required for the push function you enable is based on providing that requested function under Article 6(1)(b) GDPR. Push is optional and can be turned off at any time. Technical iOS notification permission allows the operating system to display notifications; it does not replace separate consent under data protection law.

6. Diagnostics and third-party services

The native apps contain no dedicated analytics, advertising or tracking SDKs and send no automatic telemetry to blinu. At your request, blinu link can display and copy a local status report. It may contain the app version, task identifiers, status and event timestamps, but no conversation content or pairing keys. We receive a locally generated status report only if you send it to us yourself to help resolve your enquiry.

Local system logs may contain technical errors, process identifiers and version information relating to setup and cleanup. Checking running Codex processes also involves reading local process names and executable paths. System logs are managed by the operating system.

If you use a beta through TestFlight, Apple automatically collects crash and usage data and shares it with us as the app provider. This may include app and operating system versions, device model and identifier, device language, installations, sessions and crashes. For an email invitation, your name and email address may also be included. Feedback you send may contain comments and screenshots. We use this information to investigate errors and reliably provide the beta; we retain our own diagnostic copies only as long as needed to handle the matter. Details of Apple’s processing are available in TestFlight & Privacy.

Use of Apple services and Codex is also governed by the respective providers’ notices: the Apple Privacy Policy and the OpenAI Privacy Policy.

7. Deleting your data

On your iPhone, forgetting the Mac removes the local pairing and the associated Mac assignment. To clear the full local setup, use data cleanup in the app settings: this also removes your names, filters, pins, personal settings and timer together with its notifications. Other devices remain set up. You can then delete the app through iOS. Simply offloading it preserves its setup.

On your Mac, the remove or reset function guides you through cleanup. It removes the associated pairing data and settings, blinu hook entries, verified backups created by the app, and known local status files. Modified, third-party or ambiguous files are not deleted indiscriminately. Invalid event files that were set aside may also require manual review. Follow the cleanup notices and any errors shown.

App cleanup does not delete your Codex conversations, project files, diagnostics you exported yourself, downloads, external backups, clipboard contents or operating system permissions. For system logs and data held by Apple or OpenAI, use the deletion options provided by those providers.

8. Legal bases and your rights

Using blinu and choosing connected projects are voluntary. Without the status and connection data described, blinu cannot display the relevant tasks.

Where we process personal data for the app functions you request, the legal basis is performance of a contract under Article 6(1)(b) GDPR. If voluntary consent is obtained for additional processing, Article 6(1)(a) GDPR applies. A technical iOS permission for the camera, network or notifications does not by itself constitute separate consent under data protection law. Without the respective permission, the function that depends on it is unavailable. Without camera access, you can enter the pairing invitation manually.

We rely on Article 6(1)(f) GDPR to analyse usage data, crash reports and beta feedback provided through TestFlight for troubleshooting. Our legitimate interest is to identify errors and provide a secure, functioning beta.

blinu does not make automated decisions about you that produce legal or similarly significant effects.

You can withdraw consent at any time with effect for the future. Subject to the statutory conditions, you have rights of access, rectification, erasure, restriction, portability and objection, and the right to complain to a supervisory authority. For details, see Your privacy rights. To exercise them, contact support@blinu.app.