Privacy Policy

Effective date: October 31, 2026

This Privacy Policy explains how Timo handles your information when you use the Timo mobile app, the Timo desktop app and command-line tool, and the Timo sync service (together, "Timo").

Timo is operated by Feiyu Liu, an independent developer ("we", "us"). For the purposes of the EU and UK General Data Protection Regulation (GDPR), we are the controller of the personal data described here. You can reach us at liufeiyu135@gmail.com.

The English version of this policy is the authoritative version. A Chinese translation is provided for convenience.

1. The short version

• Timo lets you follow and control AI coding agents (such as Claude Code or Codex) that run on your own computer. Your agents talk to their AI providers directly from your computer, under your own accounts. Timo does not run AI models and does not relay your prompts to AI providers.
• Your sessions, messages, files and device details are encrypted on your device before they are synchronized through our server.
• To let you sign in on a new phone without a recovery key, our server keeps an encrypted copy of your account's master key (key escrow). This means Timo is not end-to-end encrypted: we are technically able to decrypt your synchronized content. We restrict this capability and do not use it to read, analyze or monetize your content.
• When notifications are on, a session title and a short reply preview pass through our server to Apple in readable form.
• The mobile app sends anonymous usage analytics to our own, self-hosted Matomo server. It is not linked to your account, not used for advertising, and you can turn it off in Me → About Timo → Help improve Timo. We use no advertising or tracking SDKs, and we do not sell or share your personal information.
• You can delete your account and its synchronized data at any time in the app.

2. Information we process

2.1 Account information

When you create an account or sign in, we process:

• Email address, and whether it has been verified.
• Password, stored only as a one-way hash. Email verification codes are also stored as hashes and expire.
• Sign in with Apple: your Apple user identifier, and the email address and name if you choose to share them. Apple may give us a private relay email address.
• Sign in with Google: your Google account identifier, email address, name and profile picture.
• The authentication tokens these providers return, used to keep you signed in and, for Apple, to revoke access when you delete your account.

2.2 Sign-in sessions and security

For each signed-in session we store the IP address and device user agent at sign-in, a session token and its expiry. We also use your IP address to rate-limit sign-in attempts and protect the service from abuse.

2.3 Synchronized content (encrypted before upload)

To show your agents' work on your phone, the Timo apps synchronize:

• conversation content: your messages, the agent's replies, tool calls and their results, approvals and questions;
• session and project details, such as session titles, project names and folder paths;
• information about your connected computers, such as computer name and operating system;
• images and files you attach, and session or project avatars.

This content is encrypted on your device with keys derived from your account's master key before it is uploaded. Our server stores it as ciphertext. Attachments are stored as encrypted files.

2.4 Key escrow

When you create an account, the app generates your account's master key on your device and uploads it to our server over an encrypted connection. We store it encrypted and release it to you after you sign in, so a new device can read your synchronized content. Each release is logged with a device identifier, a client label and the time.

Because we hold this key, we are technically able to decrypt your synchronized content. Only the key-escrow component of our server may use it. It is not used for search, summaries, notifications, analytics or any other server feature, and we do not access your decrypted content unless we are legally required to do so.

2.5 Service metadata (not encrypted)

To synchronize reliably, our server sees and stores some information in readable form:

• identifiers for your account, devices, computers, sessions, projects and messages;
• creation and update times, sequence numbers, whether a session or computer is active, and when it was last active or archived;
• usage reports your agents produce, such as token counts and estimated cost per session.

2.6 Notifications

If you allow notifications, we store your device's push token, together with the app identifier, environment and language, so that Apple Push Notification service (APNs) can deliver alerts to you.

When an agent finishes or needs your input, the Timo tool on your computer sends us the session title (up to 100 characters) and, for completed replies, a preview of the reply (up to 120 characters). Our server forwards these to Apple. Approval and question alerts show the session title and a fixed prompt, without the tool's arguments or the question text.

Our server does not store notification titles or previews and does not write them to logs, but both our server and Apple can read them in transit. A title or preview may contain code, file paths or other information from your conversation. You can turn notifications off, or hide previews on the lock screen, in iOS Settings. Hiding previews changes what iOS displays, not what Apple receives.

2.7 Server logs

Our server records technical logs of requests, which can include your IP address, the requested address, the time and the result, and records delivery outcomes for notifications with account and session identifiers. Logs do not contain the content of your conversations or notifications. They are rotated automatically and kept only as long as needed for security and troubleshooting, generally no longer than 30 days.

2.8 Device permissions

The app asks for permissions only when a feature needs them:

• Camera: to scan the pairing code shown by Timo on your computer, and to take photos you choose to send.
• Photos: to pick images you choose to send.
• Notifications: to alert you when an agent finishes or needs you.
• Local network: to find and connect to Timo on computers on your network.

Images leave your device only when you send them, and are encrypted as described in section 2.3. Timo does not use your microphone or location.

2.9 Anonymous usage analytics

The mobile app uses a small first-party client to send anonymous usage analytics to Matomo running on our own server. This includes a randomly generated visitor ID stored on your device, allowlisted usage events and screen names (without the identifiers of actual sessions or projects), app version, iOS version, device type, system language, app language, screen size, event time and free/Pro plan status. Our analytics server sees the IP address of the request, but anonymizes it entirely before storing a visit.

Analytics is not linked to your Timo account, is not used for advertising and is not shared with third parties. It never includes account identifiers, email addresses, session titles, message content, project paths, computer names or raw errors.

Analytics is on by default. You can turn it off in Me → About Timo → Help improve Timo. The choice is stored on that device, independently of your account. Turning it off clears events not yet sent and stops further collection; it does not retract events we have already received.

We do not use crash-reporting, advertising or tracking SDKs. We do not track you across other companies' apps or websites, and we do not build advertising profiles.

2.10 Information processed by your AI providers

The agents you run (for example Claude Code by Anthropic or Codex by OpenAI) send your prompts, code and files to their providers directly from your computer, under your own accounts and those providers' terms and privacy policies. Timo does not send your content to these providers and does not control how they process it.

3. How and why we use information

We do not use your information for advertising, and we do not use your content to train AI models.

4. Who we share information with

We do not sell or rent your personal information, and we do not share it for cross-context behavioral advertising. We share information only with service providers that help us run Timo, and only as needed for that purpose:

• Apple: Sign in with Apple, push notification delivery through APNs (including notification titles and previews), and revoking Sign in with Apple access when you delete your account. If paid features are offered, payments are handled by Apple; we never receive your payment card details.
• Google: Sign in with Google, if you choose it.
• Hosting and network providers: the infrastructure providers that host our server and protect it from attacks. They process data on our behalf and receive encrypted synchronized content as ciphertext.
• Email delivery provider: to send verification and password-reset emails to your address.

We may also disclose information if required by law, or where reasonably necessary to protect the rights, safety or property of our users, the public or us. If Timo is transferred to another operator, your information may be transferred as part of that transaction, and this policy will continue to apply to it unless you are notified otherwise.

5. International transfers

Our server and service providers may be located in countries other than the one where you live, which may have different data protection laws. Where the law requires it, we rely on appropriate safeguards for these transfers, such as the European Commission's Standard Contractual Clauses. We will update this policy to name the country where our server is hosted.

6. How long we keep information

• Account information and synchronized content: for as long as your account exists, or until you delete the specific content.
• Account deletion: when you delete your account in the app, we immediately delete your account, sign-in sessions, linked sign-in providers, synchronized sessions, messages, projects, computers, push tokens, usage reports, escrowed key and key-release records from our database. Encrypted files are removed by a background job, normally within minutes. If you used Sign in with Apple, we also revoke Timo's access with Apple.
• Logs: generally no longer than 30 days (section 2.7).
• Usage analytics: individual visit records are deleted automatically after 180 days; only aggregated statistics are kept after that (section 2.9).
• Backups: if we keep backups, deleted data is removed from them as they expire, within 30 days.

Data already on your devices and computers, including content your agents keep on your computer, is not deleted by deleting your Timo account.

7. Security

We protect your information with encryption in transit (HTTPS/TLS), encryption of synchronized content before upload, encrypted storage of escrowed keys, access controls and the principle of least privilege. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Timo is not an end-to-end encrypted or zero-knowledge service, for the reasons explained in section 2.4.

8. Your rights

Depending on where you live, you may have the right to:

• access the personal information we hold about you, and receive a copy in a portable format;
• correct inaccurate information;
• delete your information, which you can do yourself by deleting your account in the app;
• restrict or object to certain processing, including processing based on our legitimate interests;
• withdraw consent at any time, without affecting earlier processing;
• lodge a complaint with your local data protection authority.

California residents have the right to know what personal information we collect, use and disclose; to request deletion and correction; and not to be discriminated against for exercising these rights. We do not sell or share personal information, and we do not use or disclose sensitive personal information for purposes that would require offering a right to limit it.

To exercise your rights, email liufeiyu135@gmail.com from the address linked to your account. We may need to verify your identity, and we will respond within the time required by applicable law, normally within one month.

9. Children

Timo is a tool for software development and is not directed to children. You must be at least 13 years old, or the minimum age of digital consent in your country if higher, to use Timo. We do not knowingly collect information from children below that age. If you believe a child has given us personal information, contact us and we will delete it.

10. Changes to this policy

We may update this policy as Timo changes or as the law requires. We will post the updated version on this page with a new effective date, and notify you in the app or by email of material changes before they take effect.

11. Contact

Feiyu Liu

Email: liufeiyu135@gmail.com