Last updated: October 8, 2026
REM:Code ("the Service") is operated from Spain. For the purposes of the EU General Data Protection Regulation (GDPR), the data controller is the operator of REM:Code. You can reach us at hello@remcode.app for any privacy-related questions.
We collect different categories of data depending on how you interact with the Service:
When you sign in via Google, GitHub, or Apple, your OAuth provider shares:
We do not receive or store your password. OAuth access tokens are used once to fetch your profile and are not stored.
When you link your device or agent, a bearer token (rmt_...) is generated. We store only the SHA-256 hash of this token — the plaintext token exists only on your device.
When your agent connects to the relay, we process:
If you use the iOS or Android app, your push notification device token (Apple Push Notification service on iOS, Firebase Cloud Messaging on Android) is stored so we can deliver notifications when your agent needs attention. You can disable notifications in your device settings at any time.
If you use the voice input feature, audio is transmitted through our relay to OpenAI's Whisper API for transcription. We do not store your audio. It is forwarded in real time and discarded after transcription. You are not required to use voice input — text input is always available.
If you or your agent share an app build to install on your phone (rem-code share), the file is stored on our servers encrypted, with a key that exists only in the share link. It is decrypted in memory only while someone with the link downloads it, and deleted when the link expires (24 hours at most).
The agent on your computer reports technical data about each turn: how it ended, the backend, model and CLI version used, an error class, and timings (time to the first response, duration). It contains no text, file paths, or project or session names. It is linked to your account and kept for 30 days. You can turn it off with "telemetry": false in the agent configuration or REM_TELEMETRY=0.
Our public website pages use Google Analytics to understand how visitors find and use the site. Google Analytics uses cookies and collects anonymized usage data (pages visited, referral source, device type). Analytics is not used inside the authenticated application or native apps.
Traffic between your phone and your agent passes through the relay over TLS. The relay processes it in memory only to forward it. We do not read, inspect, or store:
This data exists only on your machine and is displayed ephemerally on your phone. See our Security page for technical details.
| Data | Legal basis |
|---|---|
| Account data (email, name, OAuth ID) | Contract — necessary to provide the Service (Art. 6(1)(b)) |
| Authentication tokens | Contract — necessary for secure access (Art. 6(1)(b)) |
| Connection metadata (IP, timestamps) | Legitimate interest — security, abuse prevention, debugging (Art. 6(1)(f)) |
| Approximate location (city) | Legitimate interest — understanding where the Service is used, abuse prevention (Art. 6(1)(f)) |
| Agent telemetry | Legitimate interest — reliability of the Service (Art. 6(1)(f)); can be turned off |
| Push notification tokens | Consent — you opt in via device settings (Art. 6(1)(a)) |
| Audio for transcription | Consent — you choose to use voice input (Art. 6(1)(a)) |
| Google Analytics cookies | Consent — see cookie section below (Art. 6(1)(a)) |
We share data with the following third parties only as necessary to operate the Service:
| Provider | Purpose | Data shared | Location |
|---|---|---|---|
| Amazon Web Services (AWS) | Infrastructure hosting | All relay data (encrypted in transit) | EU (primary), US (planned) |
| MongoDB Atlas | Database | Account data, token hashes, device tokens | EU |
| Cloudflare | DDoS protection, CDN | IP addresses, request metadata | Global (edge network) |
| OpenAI | Whisper transcription | Audio data (only when voice input is used) | US |
| Apple (APNs) | Push notifications (iOS) | Device tokens, notification payloads | US |
| Google (Firebase Cloud Messaging) | Push notifications (Android) | Device tokens, notification payloads | US |
| Google Analytics | Website analytics | Anonymized browsing data (public site only) | US |
| Google, GitHub, Apple | OAuth authentication | OAuth tokens (one-time profile fetch) | US |
Our primary infrastructure is hosted in the EU (AWS). Some sub-processors (OpenAI, Apple, Google) are based in the US. These transfers are protected by:
| Data | Retention period |
|---|---|
| Account data | Until you delete your account or request erasure |
| Authentication token hashes | Until token is revoked or account is deleted |
| Connection metadata (IP, timestamps) | 90 days (for security and debugging) |
| Approximate location (city) | Until you delete your account (replaced on each connection) |
| Agent telemetry | 30 days |
| Shared builds | Until the share link expires (24 hours at most) |
| Push notification device tokens | Until you uninstall the app or disable notifications |
| Audio data | Not stored — forwarded in real time and discarded |
| Google Analytics data | 26 months (Google's default retention) |
Under the GDPR and applicable Spanish law (LOPDGDD), you have the right to:
To exercise any of these rights, contact us at hello@remcode.app. We will respond within 30 days.
To delete your account and the data associated with it, follow the steps on remcode.app/delete-account.
You also have the right to lodge a complaint with the Spanish Data Protection Authority: Agencia Española de Protección de Datos (AEPD) — www.aepd.es.
rem_session — HTTP-only authentication cookie, 7-day sliding window. Strictly necessary to keep you signed in. No consent required.
Google Analytics cookies (_ga, _ga_*) are used on public website pages only. These cookies are set only with your consent. You can withdraw consent at any time by clearing cookies or using browser privacy settings.
REM:Code is not directed at children. You must be at least 16 years old to use the Service. We do not knowingly collect data from anyone under 16. If you believe a child has provided us with personal data, please contact us and we will delete it.
We protect your data through:
For a detailed technical overview, see our Security page.
We may update this Privacy Policy from time to time. If we make material changes that affect how we handle your personal data, we will notify you via email or in-app notification before the changes take effect. The "Last updated" date at the top reflects the most recent revision.
For privacy questions, data requests, or concerns: