Privacy Policy
Connections and end-to-end encryption
Your phone connects through either a relay you run or the optional managed relay. Your own computer remains the source of truth for agents, terminals, files, and plugins.
With E2EE enabled—the normal mode—a relay can observe network addresses, routing metadata, machine and device identifiers, connection timing, and ciphertext sizes. It cannot read terminal text, prompts, responses, keystrokes, file contents, attachment plaintext, machine data keys, or pairing secrets. The explicit loopback development fixture is the only cleartext mode.
A paired native device is equivalent to access to your user shell. Protect and revoke devices accordingly. Third-party plugins run as your computer user and should be reviewed before installation.
Voice providers
Realtime voice is optional and implemented by a backend plugin. The bundled adapter uses xAI Grok Voice; it is off unless you configure and enable it, and its key stays in an owner-only file on your computer. When enabled, the configured provider receives microphone audio, its system prompt, tool schemas, requested tool arguments, and tool output required to continue the conversation. Tool output can include terminal excerpts you ask the agent to inspect. Provider billing, retention, and data controls apply.
Local dictation uses the bundled Whisper model and keeps audio on the phone.
Local usage reports
The bundled Usage plugin runs the exact pinned ccusage backend in offline/no-cost mode. ccusage reads local coding-agent logs on your computer. muxr renders only allowlisted agent names and rounded token totals for today and caches only the final bounded card text for one minute in the plugin's owner-only state directory; it does not render costs, prompts, model names, projects, or session details. Codex current-limit percentages come from Codex's local app-server. Other coding CLIs are detected by executable name and are never launched.
Retention and deletion
The muxr maintainers do not receive or retain your agent content. Pairing credentials and preferences remain on your device until you revoke the device, reset muxr, or uninstall the app. Your computer retains host state, attachments, and optional provider credentials until you remove them.
A self-hosted relay retains data according to your configuration. The managed relay retains credential hashes, machine and device enrollment records, and bounded E2EE replay ciphertext required to provide the service. Revoking a machine or device prevents it from minting new connections and removes its managed authorization. Removing muxr state does not delete your Herdr panes or source repositories.
Website
The website has no analytics, advertising scripts, service worker, account checkout, or client-side secrets. The hosting network may process ordinary request metadata such as IP address, timestamp, path, and user agent for delivery, abuse prevention, and operational logs.
Contact
muxr is maintained by the open-source muxr project. Ask privacy questions through the public issue tracker; report sensitive security or privacy issues through a private GitHub security advisory.