Privacy policy

Workflies has no accounts, no analytics and no advertising. Your tickets live in your own git repository, and the phone app talks to your own computer. The only personal data we handle is the little our relay and website need to work: network addresses, random device IDs and connection records, kept for a short time. We never sell it.

Effective 11 October 2026. Applies to the Workflies phone app, the wflies program for your computer, the relay at relay.wflies.com and this website.

Who we are

Workflies is made by Aharon Louzon, an individual developer based in Israel ("we"). He decides how the personal data described here is used (the "controller"). Contact: [email protected].

What stays with you

Your projects, tickets, comments and settings are stored in your repository on your computer, and in the phone app's own storage when you use a project offline. They never pass through a Workflies server in readable form. There is no Workflies account, so we hold no name, email address or password for you.

AI agents and git hosts

When you start an AI coding agent from Workflies, Workflies hands it instructions and your ticket text on your computer. The agent sends that, plus the code and files it reads, to its provider (for example Anthropic, OpenAI or Cursor) under your own account and that provider's terms and privacy policy. Pushes go to the git host you set up. None of this passes through us, and we never receive it. Check your providers' terms before letting an agent read anything confidential.

The phone app

The app connects straight to the computer you pair it with. The connection is encrypted end to end with keys made during pairing. Neither we nor anyone in between can read it. The app contains no analytics or advertising code.

The app asks for these permissions, and uses each one only for the reason shown:

• Camera: to scan the pairing code on your computer's screen. No photo is saved or sent anywhere.
• Local network: to reach your computer on your own network.
• Face ID: to confirm it is you (or your passcode) before an AI agent starts on your computer. Face data never leaves your phone, and Workflies never sees it.
• Notifications: if you turn them on, Apple gives the app a notification address. The app hands it to your paired computer, not to us.

The relay ("Connect from anywhere")

The relay is used only if you turn on Connect from anywhere on your computer. It forwards encrypted traffic between your phone and your computer, cannot open it and never records it. To run the relay and keep it safe, it keeps:

• A connection log. One line when a computer or phone connects, disconnects or is refused, and one line per finished connection. Each line holds the time, a shortened ID of the computer and the phone, their IP addresses, the result, and for finished connections how much data passed and how long it lasted. Kept for up to 7 days, then deleted.
• Phone slots. To enforce the limit on phones, the relay records which computer is paired with which phone: their full random IDs (fingerprints of keys made on your devices), when the slot was created and when it was last used. No IP address, name or email. A slot is deleted after 30 days without use.
• Rate limits. Short-lived counters per IP address, held in memory only and never written to disk.

Notifications

Your computer locks the text of each notification with a key only your phone holds, then sends it through our relay to Apple. The relay sees your computer's random ID, the phone's notification address and the locked text, which it cannot open. It passes the notification address to Apple for that one notification and neither stores nor logs it. The lock screen only ever shows "Workflies / New activity", and the app unlocks the real text on your phone. The relay logs one line per notification: a shortened computer ID, the sending IP address and the result.

This website

wflies.com uses no cookies, trackers or third-party scripts, and its fonts and icons are served from this site. Requests to the website and the relay pass through Cloudflare, which sees your IP address and standard request details in order to deliver the page and block attacks. Cloudflare handles them under its own privacy policy. Our server keeps no log of website visits. Downloads, including Homebrew installs, come from GitHub under GitHub's privacy policy.

When you contact us

If you email us, we receive your address and what you write, through Google's Gmail. We keep it while we help you, and delete it within two years. Issues on GitHub are public, so do not post anything private there.

Why we use it

• To run the relay you turned on and deliver your notifications. This is needed to provide the service you asked for (GDPR Article 6(1)(b)).
• To keep the relay and website secure, enforce limits and stop abuse. This is our legitimate interest in running a safe, free service (Article 6(1)(f)).
• To answer you when you write to us (Article 6(1)(f)).
• To comply with the law when we must (Article 6(1)(c)).

We do not use your data for advertising, profiling or training AI models, we do not sell it, and we do not track you across other apps or websites.

Who else handles it

• Hetzner Online GmbH hosts the relay and website server in Germany.
• Cloudflare, Inc. provides the network and security in front of the relay and website.
• Apple delivers push notifications to iPhones.
• Google hosts our support email.
• GitHub hosts downloads and our public issue tracker.

We may also disclose data when the law requires it, or to protect our rights or someone's safety. If Workflies moves to a company or a new owner, this policy and the data it covers move with it.

International transfers

We are based in Israel, which the European Commission recognises as protecting personal data adequately. The relay server is in the European Union. Cloudflare, Apple, Google and GitHub may process data in the United States and other countries. Where they do, they rely on safeguards such as the EU-U.S. Data Privacy Framework or the European Commission's standard contractual clauses.

How long we keep it

• Relay connection and notification log: up to 7 days.
• Phone slots: until 30 days after the slot was last used.
• Rate-limit counters: minutes, in memory only.
• Notification addresses and notification text: not stored.
• Support email: while we help you, at most two years.

Your rights and choices

Depending on where you live, including under the GDPR, the UK GDPR and Israel's Privacy Protection Law, you may have the right to see, correct or delete your personal data, to object to or limit how we use it, and to get a copy of it. Write to [email protected]. The relay holds no names or emails, so we may need details to find your records, such as roughly when you connected and from which IP address. You can also complain to your local data protection authority, or in Israel to the Privacy Protection Authority.

You do not need to ask us to stop it. Turn off Connect from anywhere on your computer (Settings → Phones, or wflies mobile relay off) and the relay receives nothing more from you. Its log lines about you are gone within 7 days, and your phone slot within 30 days. Turning off notifications on your phone stops push. Deleting the app removes everything it stored on your phone. There is no account to delete.

Security

Phone connections are encrypted end to end, and the relay accepts connections only through Cloudflare. No system is perfectly secure, so we cannot promise that data will never be accessed without permission.

Children

Workflies is a tool for software developers and is not meant for children under 16. We do not knowingly collect personal data from children. If you think a child has used it, contact us and we will delete what we can find.

Changes and contact

If this policy changes, we will update this page and its effective date. Questions: [email protected], or open an issue at github.com/AharonDL/workflies-releases/issues. See also our terms of use.

SupportTerms