Mac and iPhone apps
Privacy policy
Last updated: 9 November 2026
StillRun is a macOS menu bar app that keeps local jobs running while it locks the screen, plus an iPhone app that talks to it. This page says what the apps can see, what they store, and where that data goes.
The short version: there are no accounts, no ads and no tracking. What the app handles on your Mac (passcode, photos, status, agent activity) stays on your devices. The only data that leaves them is purchase data for StillRun Pro, which goes to Apple and to our purchase-analytics provider RevenueCat, linked only to an anonymous ID (plus a daily update check in the Mac build downloaded from the website).
What the app asks permission for
Camera (Mac): only for wrong-passcode photos, off by default. The Mac app uses the camera only if you switch on Settings › Lock Screen › Privacy › Take a photo after a wrong passcode. With it on, the Mac takes one photo after every wrong passcode or PIN typed on the lock screen. The photo is saved as a JPEG in the app's own folder on your Mac and is not uploaded anywhere. You choose how many to keep (1 to 100, default 20); older ones are deleted past that number. Photos are not encrypted by the app itself; they have the protection your Mac gives that folder (for example FileVault).
Camera (iPhone): only to scan the pairing QR code your Mac shows. It takes no photos and keeps nothing.
Accessibility (Mac). While the Mac is locked, StillRun watches the keyboard only to drop shortcuts such as the app switcher, Spotlight and launcher hotkeys. The keys are dropped, not recorded, and nothing leaves the Mac. If you use the iPhone's Trackpad tab (Pro), it posts the mouse and keyboard events your phone sends. In the Direct download only, it also checks which kind of text field is focused and which app is in front, so the phone can offer a Type button. It reads the kind of field and the app name, never what is in the field, and it never logs what you type.
Screen Recording: not requested. StillRun does not capture or record your screen. When the lock background matches your wallpaper, the app reads the wallpaper file to pick light or dark controls.
Bluetooth and local network. Both apps use them to talk to your own paired device. The iPhone finds the Mac on the same Wi-Fi network through Bonjour; unlocking is accepted only over Bluetooth. These connections do not use cellular data and there is no internet relay.
Face ID and Touch ID. Face ID on the iPhone confirms an unlock or an agent approval; Touch ID on the Mac can unlock the lock screen. The system tells the app only whether the check passed. The app never receives biometric data.
Notifications (iPhone). Asked for on the last pairing screen. They carry alerts such as "Mac locked", "agent needs approval" and wrong-passcode notices, built on the phone from data your Mac sent it.
What data goes where
| Data | Where it comes from | Where it goes | How long it is kept |
|---|---|---|---|
| Passcode or PIN, recovery code | Your Mac | Stays on the Mac (settings and Keychain) | Until you change it or delete the app's data |
| Wrong-passcode photo | Your Mac's camera, only if you turned it on | Saved on the Mac. With Pro and a paired iPhone, a smaller copy without metadata is also sent to that iPhone, encrypted | On the Mac: up to your "photos to keep" limit. On the iPhone: in the recent events list (last 50) and attached to a notification, which iOS stores like any notification attachment |
| Status: lock state, CPU, GPU, memory, temperature, free disk space, running agents | Your Mac | Only to your paired iPhone, encrypted | Not stored beyond the current session |
| Agent activity: session names, state, usage windows, the text of a permission request | Claude Code and Codex on your Mac, only after you press Connect in Settings › Agents | Only to your paired iPhone (approvals need Pro and Face ID) | Not stored beyond the current session |
| Alerts (for example low disk) | Your Mac (Pro) | Only to your paired iPhone | Held up to an hour if the phone is out of reach, then dropped |
| Trackpad and keyboard events, Open on Mac, websites, Shortcuts, brightness | Your iPhone (Pro) | Only to your paired Mac, encrypted | Not stored; typed text is not logged by either side |
| Purchase and trial data | Apple's App Store | Apple (StoreKit) and RevenueCat, see below | See Apple's and RevenueCat's policies |
"Encrypted" means the app's own link between your two devices: a Noise KK handshake (X25519) with ChaCha20-Poly1305 records, built on Apple's CryptoKit. Pairing needs you to confirm a six-digit code on both screens.
Purchases and RevenueCat
Apple processes StillRun Pro purchases, the free trial and restores through StoreKit. We never see your payment details or your Apple Account.
The App Store versions of StillRun use RevenueCat as a service provider to record purchases and trials, so we can tell whether they work and how many people buy Pro. RevenueCat receives:
- an anonymous app user ID that the app creates; it is not your name, e-mail or Apple Account
- purchase and transaction data from the App Store: product, price and currency, store country, transaction dates and IDs
- the app and system version its SDK reports, and, like any server, the IP address of the connection
RevenueCat processes this data on our behalf. We see purchase records in RevenueCat linked only to the anonymous ID. It is not used for advertising or to track you across other apps or websites. RevenueCat's privacy policy: revenuecat.com/privacy. Apple's privacy policy covers App Store transactions: apple.com/legal/privacy.
Remote access: what it can and cannot do
"Remote" here means your iPhone controlling and watching your own Mac over Bluetooth or the same local network. There is no account, no cloud relay, and no way for anyone else, including us, to connect.
- Only the one paired iPhone can talk to the Mac. Pairing needs Touch ID or the Mac's password at the Mac, a QR code that expires after five minutes, and a matching six-digit code on both screens.
- While the Mac is locked the phone can lock it, unlock it (Bluetooth only, with Face ID, only when the phone is close), change the volume, dim the display, answer agent approvals and cancel keep-awake. It cannot move the pointer, type, open apps or open websites.
- The Mac decides, not the phone. Pro, lock state and the list of apps you allowed are checked on the Mac for every request.
- Residual risks. Someone with a Bluetooth relay and physical access to the locked Mac might relay the link, but each unlock still needs your Face ID and expires in 30 seconds. A compromised, paired iPhone could report a false signal strength and keep the Mac from locking when you walk away, but it cannot unlock anything on its own.
What we do not do
- No advertising, crash-reporting or tracking SDKs. The only third-party analytics is RevenueCat, for purchases.
- No accounts and no sign-in.
- No tracking. The apps declare no tracking and no tracking domains in their privacy manifests.
- No sale of personal data.
Network requests the app makes
The App Store versions talk to Apple for purchases and to RevenueCat as described above. Updates come from the App Store.
The Direct download of the Mac app (from outside the Mac App Store) checks for updates once a day with the Sparkle framework. It requests a feed file hosted on GitHub; GitHub can see the request like any web server, including your IP address and the app version. The app does not turn on Sparkle's optional system profile, and it installs an update only after you agree.
Deleting your data
- Mac: Settings › General › Delete StillRun… erases the passcode, settings and stored photos, then quits. Accessibility and Camera access stay in System Settings › Privacy & Security until you switch them off there.
- iPhone: Unpair in Settings removes the pairing keys, and deleting the app removes its data. An unlock key also disappears if your Face ID enrollment changes.
- Agents: Disconnect in Settings › Agents removes only StillRun's own entries from the Claude Code and Codex settings files.
- Purchase records held by RevenueCat are linked only to the anonymous ID. To ask for their deletion, write to us from the address below and include the date of purchase; Apple keeps its own purchase history for your Apple Account.
What StillRun does not promise
StillRun is a convenience lock for shared desks where your jobs have to keep running. It is not a security product against someone who has full control of the computer:
- It runs as a normal app under your account, without root, a kernel extension or the macOS login window, and it cannot stop an administrator.
- A force quit (
kill -9,killall, Activity Monitor from another account) ends it at once and removes the lock window. The lock refuses a normal Quit, but no app can refuse a force quit. - It does not replace FileVault, the macOS login screen, MDM policy or physical security. Restarting the Mac, booting from another volume or Recovery, or removing the disk are outside its reach.
- macOS reserves some key combinations and recovery paths that third-party apps cannot override. Third-party global hotkeys can get past it unless Accessibility is granted.
- You always have a way out: your passcode, Touch ID, the recovery code, or locking and unlocking macOS itself (⌃⌘Q), after which StillRun lets go.
This website
This site has no analytics, cookies or contact form. It remembers your light or dark theme choice in your browser's localStorage under obaTheme. It is hosted on Vercel, which processes standard request logs (such as IP address) to serve the pages.
Changes and contact
When the app changes what it collects or sends, this page changes first. The date at the top says when.
StillRun is made by OBA Labs. Privacy questions: info@obalabs.app.