Privacy and security

This page explains how Coral handles your data in practice. The privacy policy is the full, binding version.

What stays on your MacCopy Anchor Link

• Your code, terminals and agent transcripts. Coral reads your agents' sessions where they are and doesn't copy them anywhere else.
• What Coral keeps: Briefs, history (with a search index on your Mac, built from what Coral already logs: your prompts, short turn summaries, file paths and commands, never full transcripts), approval rules, your companion pick (a local setting), your iPhone chats with agents, a fingerprint of each hook it wrote (so it can tell your changes from its own), and the ids of the sessions open when your Mac last shut down (so it can offer them back).
• Hand off. A small file, ~/Library/Application Support/Coral/handoffs.json, links an old session to its new one (the newest 200, kept 30 days). The note goes to the agent's new session on this Mac through a private temp file, never a command line. If you hand off from your iPhone, the note is shown there too, end-to-end encrypted like everything else between your devices.
• Time saved. A small file, ~/Library/Application Support/Coral/time-saved.json, with only dates, durations and counts: no session ids, tools, paths, commands or text. Events are kept for 30 days, and two usual-wait numbers (one for permissions, one for questions) stay after that. It's computed on your Mac and never sent to the relay, your iPhone or any server. See Features.
• The editor helper. If you add it, Coral puts a small extension in VS Code, Cursor or Windsurf so Show terminal can open the exact terminal tab. It only matches terminals to processes, never uses the network, and writes one small file per editor window in ~/.coral/editors. Remove it in Settings → Agents or in the editor's Extensions list.
• Plan limits. To show what's left of each plan, Coral asks the agent's own tool. For Grok, it starts Grok's agent on your Mac at most every 15 minutes and asks for your allowance. Grok uses its own login for that; Coral never reads or stores it.
• Model lists. To show which models you can start an agent with, Coral asks each agent's own tool on your Mac: Claude Code starts for a moment without a prompt, your hooks or your MCP servers, Codex's saved model list is read, and OpenCode lists its models. No prompt is sent and none of your plan is used.
• Your voice. Speech is turned into text on your Mac with Apple's on-device recognition. Audio isn't sent anywhere.

There's no Coral account and no Coral server that sees your code.

What goes to an AI modelCopy Anchor Link

Some features need a model: Briefs, routing what you say to the right agent, the Watchdog check, and Your Mac turns. Coral uses your own Claude Code login for these, so the requests go to Anthropic under your account, the same place your agent already sends your code. They don't pass through our servers.

The Watchdog check runs only for prompts you chose to watch. It sends your prompt, the agent's last message and the list of changed files.

During a Your Mac turn, screenshots of the apps Coral works in go to Claude this way too. Your iPhone gets screenshots only at milestones: an approval, the end of a turn, a stop, and when you tap Show screen.

Ask can look things upCopy Anchor Link

This is off by default. Turn it on with Ask can look things up on your Mac, in Coral's iPhone window, after a screen that explains it. Turn it off the same way.

When it's on and you Ask about a Claude Code agent, Coral opens a read-only copy of that agent's session on your Mac. The copy can read files in the agent's project folder and that project's Claude memory. It can't run commands, edit files, browse the web or use MCP tools, and nothing is saved. The agent never sees your question.

What the copy reads goes to Anthropic through your Claude Code login, the same way your agent's own reads do, and each question uses some of your Claude plan. Codex and other agents keep the quick answer.

Anyone holding your unlocked, paired iPhone could read what's in those folders by asking. Turn the setting off if that worries you.

What the relay carriesCopy Anchor Link

Messages between your iPhone and your Mac go through our relay, which runs on Supabase. The relay passes messages along but can't read them.

• Encrypted end to end. Each message is encrypted on the sending device for the other device's key (HPKE with P-256 and AES-256-GCM) and signed by the sender (ECDSA P-256). The relay sees only which paired devices a message is from and to, its size and when it was sent.
• Conversations only when you open them. Your iPhone gets short summaries of what your agents are doing and what's waiting on you, what's left of each plan's session and week and when they reset, how much of the week they used while you were away, and which companion you picked on your Mac. To group agents by project, each summary includes the project's folder on your Mac (for example ~/code/hawkins), the same kind of path the folders you can start agents in already carry. When you open an agent, your Mac sends that conversation. Your iPhone shows it but doesn't save it.
• Your iPhone signs what it sends. Answers, messages and Your Mac controls are signed with a key on your iPhone that Face ID protects. The Mac accepts them only from a paired phone, once, and within 2 minutes, so a copied or replayed message is rejected. On Coral Free, a checked answer waits on your Mac until you send it there.
• Only your devices use their IDs. Before a device pairs, it proves to the relay that it holds its own key. The relay keeps which account owns each device ID and its public key, so nobody else can pair as your Mac or iPhone or watch its messages arrive.
• Photos you send. Photos are scaled on your iPhone and encrypted like every message, so the relay holds only ciphertext until your Mac takes it, 24 hours at most. Your Mac saves each in the agent's project under .coral/attachments/, which git ignores.
• Talking stays on your iPhone. Speech is turned into text with Apple's on-device recognition. Audio never leaves your iPhone and is never saved. Only the text you send goes to your Mac.
• Short-lived storage. The relay deletes each message once it's delivered. If a device is offline, it holds that device's encrypted messages for 24 hours at most.
• Notifications. Pushes carry encrypted content that your iPhone decrypts. Apple and we see only a generic line like "An agent needs you". Live Activities carry only how many agents are waiting and since when. Your iPhone fills in the Mac's name itself, so the name never travels in plain text.
• Whether your Mac is awake. So your iPhone can say "Mac asleep since 10:42", your Mac tells the relay every 2 minutes that it's on, and when it sleeps or Coral quits. The relay keeps only the latest state and its time, never what your agents are doing.

On your iPhone, Coral saves the latest summaries from each Mac and your Your Mac chats, including their screenshots. Your project pins, names and hidden projects stay on your iPhone only. So do messages and photos you start but don't send: they wait in a protected folder that isn't backed up, until you send them or leave them for 7 days. Unpairing that Mac deletes all of these.

The iPhone app also reads usecoral.app/phone.json, a public file with what's new and the oldest version that still works. It sends no identifiers.

Crash reportsCopy Anchor Link

After a crash, Coral asks before it sends anything, and shows you exactly what the report holds: versions, your Mac's model and Coral's own stack frames. It has nothing from your agents and no paths with your user name. It goes to Coral's own Supabase project, and we delete it after 90 days. There's no analytics and no third-party SDK.

Download link by emailCopy Anchor Link

On your phone, Coral can email you the download link for later, at a time you pick. Resend sends that one email, and we don't keep your address unless you tick the box for news about new features.

Pairing and devicesCopy Anchor Link

Pairing uses a QR code that works once and expires after 5 minutes, and both devices show a 6-digit code for you to compare. If anyone substituted their own keys, the codes would differ. See Pair your iPhone.

Unpairing a phone on your Mac or iPhone deletes its keys and tells the relay to drop the link.

ServersCopy Anchor Link

With Servers, Coral keeps its own SSH connection to each server you add, and opens no ports. It changes only the files it lists before you connect, backing each one up first.

If you let a server reach your iPhone, the server gets its own keys and joins the relay like another paired device, after you confirm with Face ID. Your Mac's and iPhone's keys never leave them, and the relay can't read what the server sends. Answers to a server still need Face ID and follow the same rules as answers to your Mac.

Your Mac and Work while lockedCopy Anchor Link

Acting on your Mac from your iPhone is the most sensitive thing Coral does, so it has its own rules, enforced in Coral's code rather than left to the model. See What Coral never does, and for the locked Mac, Safeguards and Risks.

For security teamsCopy Anchor Link

Security covers what our servers can see, subprocessors, and where Coral stands on SOC 2, GDPR and HIPAA.

QuestionsCopy Anchor Link

Write to hello@usecoral.app.