Privacy Policy.

1. Scope and publisher

RS Application (“we”, “us”, “our”) publishes CmdPalm and operates cmdpalm.app. This policy covers this website, our official CmdPalm Mac app and its browser-based remote, and information you choose to send us about CmdPalm. For personal information we receive through the website or correspondence, RS Application is the responsible controller where that term applies under privacy law.

Data processed locally by the app stays under your control; we do not receive it simply because you use CmdPalm. Independently modified versions and services run by others may have different practices. RS Application’s main website has a separate Privacy Policy.

2. What the app handles on your devices

The Mac app serves the remote interface directly to your phone, tablet or other browser. It does not require registration and does not send usage analytics, advertising identifiers or automatic crash reports to us. To provide its features, it handles:

• Controls and text: pointer movements, gestures, key presses, text you send, clipboard requests, media and volume controls, and actions you trigger. CmdPalm does not keep a history of typed text, clipboard contents or voice recordings. Text deliberately saved in a deck button or custom keyboard is part of that saved configuration.
• Pairing: a randomly generated browser device ID, device name and model, pairing and last-seen times, network address, and an authentication token. A remembered token is stored in the browser; the Mac stores a SHA-256 hash of it with the trusted-device record.
• Settings: preferences, gestures, custom keyboards, deck layouts and actions, and any app folders you add. Browser settings are stored locally and, for remembered devices, saved on the Mac. Remembered devices can copy saved settings from another device; the deck is shared across connected devices.
• Mac information: the remote interface uses app names, identifiers and icons, running/active/hidden app status, keyboard layout and input timing, volume, and host/version information. The connection information endpoint exposes your Mac’s name and app version to devices able to reach the local server; control requires pairing.
• Local files and diagnostics: preferences, trusted devices, device settings, the deck, local TLS certificates and private keys, and logs. Logs record connection details, device names and addresses, errors and diagnostics, and can include file paths. They do not record typed text, dictation, clipboard contents or deck button contents.

Clipboard text is returned to a remote only when requested. CmdPalm skips clipboard items marked as concealed or transient by the source app; this depends on that app marking them correctly. Pasting may temporarily put text on the Mac clipboard and then restore its previous contents. Receiving apps, clipboard managers, backups and other software you use may retain information independently.

3. Voice typing and permissions

Built-in voice typing starts when you activate it and permit microphone access in your remote browser over a secure connection. Audio streams to your Mac for Apple’s on-device speech recognition. CmdPalm checks that on-device recognition is supported and requires it for every recognition request. If it is unavailable for your language, the feature is unavailable; CmdPalm does not fall back to server transcription. Audio and partial transcripts are handled in memory, and recognized text is returned to the remote for typing.

macOS Accessibility permission lets CmdPalm generate keyboard and pointer events. Speech Recognition permission enables dictation on the Mac. macOS may also request local network, automation or folder access for features you use. You can revoke permissions in your device’s system or browser settings and turn off voice typing in CmdPalm’s Mac settings. Dictation supplied by your phone’s own keyboard is a separate operating-system feature governed by its provider’s privacy practices.

4. Pairing and connection security

Devices pair using the QR code, the PIN shown on your Mac, or your approval on the Mac. Pairing attempts are rate limited. You can disable PIN or approval pairing, pause control, or remove a trusted device in CmdPalm’s settings.

HTTP is the default and is not encrypted. Someone able to observe that network traffic could read controls, text and pairing tokens. Use a network you trust, and set up the optional HTTPS connection in Settings → Phone Setup → Encrypted Connection. CmdPalm creates the certificate authority and keys on your Mac; its private keys are not uploaded to us. Protect those files and review certificates you install on your devices.

A VPN, reverse proxy or custom address you configure may change who can reach the server and how traffic is protected. Those services have their own practices. No connection or storage method is completely secure. See CmdPalm’s security documentation for the controls and their limits.

5. This website

cmdpalm.app is a static website hosted through Cloudflare. Hosting and security infrastructure may process standard request information such as IP address, browser/user-agent details, requested URL, referring page, response status and request time to deliver the site, diagnose problems and prevent abuse.

The website has no account, payment, contact or newsletter form, and no advertising or third-party analytics scripts. Its interactive phone-and-Mac playground is a simulation in your browser: inputs are not sent to a real Mac or submitted to us. Fonts, images and videos are served with the site. The copy-install-command button writes that command to your clipboard only when you activate it.

We do not set advertising or analytics cookies. Your browser may cache website assets, and Cloudflare may use cookies or similar mechanisms where necessary for security. The Mac-hosted remote has separate local storage and, where supported, a service worker that caches its interface; that storage belongs to the Mac’s address, rather than cmdpalm.app.

6. Updates and other services

Official release builds use Sparkle to check a GitHub-hosted update feed and download updates. Automatic checks are enabled in the release configuration and can be changed in the Mac app’s update settings; you can also check manually. These requests reveal ordinary connection information, including your IP address and request headers that may identify app or operating-system versions, to the download infrastructure. They do not include your typed text, clipboard or dictation. Locally built copies without an update feed and signing key do not run the updater.

GitHub also hosts source code, releases, issue reports and security advisories. Following an external link or downloading through a package manager involves that service. Apps, links, Shortcuts and shell commands you choose to run may contact other services independently of CmdPalm’s remote-control connection.

See Cloudflare’s Privacy Policy and GitHub’s Privacy Statement for their practices. These providers and our email providers may process information in countries other than yours, subject to applicable law and any required transfer safeguards. Using CmdPalm’s local controls does not itself send that local data to these providers.

7. Information you send us

If you email us, we receive your email address and whatever you include, such as your name, app version, troubleshooting details or attachments. Our email providers process the correspondence to deliver and store it. Logs are not automatically uploaded; review them before sharing. Do not send passwords, pairing tokens, certificate private keys or other sensitive information.

Public GitHub issues and comments are visible to others. Report security issues privately using GitHub security advisories.

8. How we use and disclose information

We use information we receive to deliver and protect the website, answer requests, investigate bugs and security reports, and meet applicable legal obligations. Where a legal basis is required, we rely on our legitimate interests in those activities, compliance with legal obligations, or consent where the law requires it. You can withdraw consent for future processing where consent is the basis.

We do not sell, rent or trade personal information or share it for cross-context behavioral advertising. Information may be handled by providers supporting the activities described here, or disclosed where legally required or necessary to establish or defend legal rights. We do not have remote access to your Mac’s locally stored data to disclose it.

9. Retention and deletion

• Remembered devices: records and settings stay on your Mac until removed. Removing a device in Settings → Devices revokes its token, disconnects it and deletes its saved device settings on the Mac. It does not erase that device’s browser storage, the shared deck, or data copied elsewhere.
• Mac data: app state and certificates are stored in ~/Library/Application Support/CmdPalm; preferences are stored in macOS UserDefaults. You can reset the deck in the app. Removing the app alone may leave these files and preferences behind. Quit the app before manually removing its local data; removing its certificates also means setting up HTTPS again. Remove any certificate you installed on a phone separately.
• Remote browser: clear site data for your Mac’s CmdPalm address to erase pairing tokens, preferences, custom keyboards and cached interface files. Removing a home-screen icon alone may not erase site data. Clear storage for each address/browser you used, and remove the device on the Mac too.
• Logs: kept in ~/Library/Logs/CmdPalm. The app rotates its log after it exceeds approximately 2 MB, keeping one previous log. This is size-based retention, not a fixed time limit. You can delete local logs after quitting CmdPalm.
• Website and correspondence: hosting logs follow the provider’s configured retention. Correspondence is kept as needed to resolve your request and maintain necessary business or legal records. You can request deletion sooner, subject to any lawful retention requirement.

Copies in backups, exports, receiving apps or third-party services are subject to their own deletion controls. We cannot erase data held only on your devices or remove a public report from copies made by other people.

10. Your privacy rights

Depending on where you live, you may have rights to access, correct, delete or receive a portable copy of personal information we hold, to object to or restrict processing, and to complain to your local data protection authority. Email contact@rsapplication.com to exercise your rights. We may need information to verify your request and will respond within applicable legal deadlines. We will not discriminate against you for exercising a privacy right.

Local app data is managed on your devices using the controls above. No account deletion request is needed to stop using CmdPalm. You can disable automatic update checks, revoke permissions, clear browser data and stop the Mac app’s server at any time.

11. Children

This website and our support channels are not directed at children under 16. We do not knowingly collect their personal information. If you believe a child has sent us personal information, contact us so we can address it and delete it as required. This statement does not add an age restriction to CmdPalm’s open source license.

12. Changes to this policy

We may update this policy when CmdPalm or our practices change. We will update the date at the top and provide any further notice or obtain consent required by law for a material change. A policy update does not by itself change the behavior of a version already installed on your devices.

13. Contact RS Application

For privacy questions or requests, contact RS Application at contact@rsapplication.com. For information about using the website and CmdPalm’s open source license, read our Terms of Service.