REM:Code connects your phone to the machine running your coding agent through an outbound WebSocket tunnel. The agent on your machine initiates the connection to the relay — no inbound ports need to be opened, no firewall rules changed.
Connections from your phone and your machine to the relay at remcode.app are protected in transit with TLS. The relay terminates those connections to authenticate and route traffic, so interactive session traffic is not currently end-to-end encrypted between the phone and the agent. The relay is designed to forward that traffic without persisting its content.
During normal operation, this content passes through the relay in memory only and is not written to persistent storage or conversation logs.
.sessions/The agent runs on 127.0.0.1 only — it is not accessible from your local network. Remote access is handled exclusively through the encrypted tunnel.
When you ask REM:Code to share an installable build, the artifact is uploaded separately from interactive session traffic and stored encrypted for delivery. Anyone with a valid install link may be able to download the build, so treat those links as secrets and revoke or remove them when they are no longer needed.
REM:Code supports Google, GitHub, and Apple sign-in. After authentication, a bearer token is generated and stored as a SHA-256 hash on the server. The plaintext token is only stored on your device.
Browser sessions use HTTP-only cookies with a 7-day sliding window. Mobile apps use bearer tokens stored in secure device storage.
The agent is open-source software under the MIT License. You can inspect the code, verify the security claims, and build from source.