Runner Mobile ("the app") is a remote control for your own computer that runs Unicore Runner. It talks to that computer, through the Runner Bridge you install on it, over an end-to-end encrypted connection.
In short: what you see in the app comes from your computer and goes back only to your computer, encrypted so that no one in between can read it. There are no accounts, no analytics, no ads and no tracking. Besides Apple's or Google's notification service and two public address servers (below), the only server involved is a small relay, named in the pairing code your computer shows, that helps your phone find your computer and passes on notifications. It is run by whoever set it up: you, on your own Cloudflare account, or the app's developer. It never sees what your phone and your computer say to each other.
Your inbox, tasks, runs, plans, chats and host status come from your computer over a connection encrypted end to end (the Noise protocol with ChaCha20-Poly1305). Only your phone and your computer can read it. Photos and files you attach to a task or a comment go the same way, to your computer only. When you approve something, your phone signs the request with a key that never leaves it.
When you pair, the phone tells your computer its device name, its public keys and, if you allow notifications, its push token (see below). Your computer keeps them in a file only its user can read. You can remove a phone at any time with runner-bridge revoke on the computer; the computer then forgets it and deletes its push token from the relay.
On iPhone, the app asks whether you want notifications once you have paired a computer. Only if you allow them does iOS give the app a push token from the Apple Push Notification service (APNs), which the app sends to your computer; your computer registers it with the relay named in your pairing code. Your computer encrypts each notification for your phone and hands it to the relay; the relay passes it to Apple, which delivers it, and the app decrypts and shows it on your iPhone. The relay keeps your phone's push token while the phone is paired. The relay's operator, Cloudflare and Apple see the token, the encrypted message and when it was sent, never what it says. The iPhone app contains no third-party code or services.
On Android, when the app starts, Firebase Cloud Messaging, Google's service that delivers notifications to Android phones, registers this installation of the app with Google and gives it a push token. If you allow notifications, the app sends that token to your computer, which registers it with the relay named in your pairing code. Your computer encrypts each notification for your phone and hands it to the relay; the relay passes it to Firebase, which delivers it, and your phone decrypts and shows it. The relay keeps your phone's push token while the phone is paired. The relay's operator, Cloudflare and Google see the token, the encrypted message and when it was sent, never what it says.
Firebase Cloud Messaging is the only third-party service built into the Android app, and Firebase Analytics is switched off. To register and deliver messages, Firebase sends Google an installation ID and basic information about the app and device, as described in Firebase's privacy information. If you do not allow notifications, the app does not send the token to your computer, and no notification is sent to your phone.
On your Wi-Fi the app finds your computer on the local network (which is why your phone asks for local network access). From elsewhere, it asks two public STUN servers (stun.l.google.com and stun.cloudflare.com) for its public internet address, and meets your computer through the relay, which passes on addresses encrypted for your computer. Like any server you connect to, the relay and the STUN servers see your IP address and when you connect, but nothing of what you and your computer say to each other.
Android checks your fingerprint or face; on iPhone, Face ID checks your face. The app never receives biometric data: the system only tells it that you confirmed, and unlocks the key that signs your approvals (on iPhone, a key in the Secure Enclave).
The camera is used only to scan the pairing code your computer shows. The app keeps no picture from the camera and sends none.
The app keeps its keys in the Android Keystore and a recent copy of what it showed, encrypted, so you can look at it while your computer is away. None of this is included in cloud backups or device transfers. Uninstalling the app, or clearing its storage in Android's settings, deletes all of it.
On iPhone, the app keeps its keys in the iOS Keychain and the Secure Enclave, on this phone only, and the same encrypted copy. None of this is included in iCloud backups or device transfers. Uninstalling the app deletes the copy; iOS may keep the app's Keychain items on the phone after an uninstall. They are useless without your computer's record of the phone, which runner-bridge revoke deletes, and erasing the iPhone removes them.
The Demo computer ("Try without a computer") runs entirely on your phone. Nothing you do in it is sent anywhere.
The app is a developer tool and is not directed at children.
If this policy changes, the new version appears on this page with a new date.
Questions about privacy: write to the developer at the e-mail address shown on the app's App Store or Google Play page.