Privacy Policy

Rakumux is a product of Human Unsupervised Pty Ltd (“we”, “us”). This policy explains what information we collect through rakumux.com and Rakumux accounts, how the Rakumux app handles your data, and the choices you have. If you have a question, email tony@humanunsupervised.com.

The short version

• The Rakumux app runs on your computer, and your sessions and history stay there.
• If you sign in to the app, AI session titles are on: once for each coding agent chat, and again whenever you ask, a short excerpt of your message to the agent and its messages since (or, for other programs when you ask, of the recent terminal output) is sent to write a short title for the session, with a one-line description that older versions of Rakumux show. You can turn this off on the Features page.
• The agent feed is off unless you turn it on. When it’s on, your coding agents’ chats (your messages to them, their replies, reasoning and tool calls, and the tools’ output) and the replies you write back to them are stored on our servers for 7 days (90 days while you have Rakumux Pro), so Rakumux can show them on each computer you sign in on and type your replies into the agent’s session; files you attach to a reply are kept only until your computer fetches them, an hour at most; and each computer’s list of its Rakumux sessions (their names, folder names, branches, agents, what they’re doing, and the names of the folders where their agents changed files) is kept while the feed is on, so rakumux.com can show them.
• The website counts visits to its public pages itself, without cookies and without storing your IP address. It has no advertising or tracking cookies.
• Accounts are optional. If you create one, Clerk handles sign-in for us and stores your email address and basic profile.
• We don’t sell your information or use it for advertising.

The Rakumux app

Rakumux is open-source software that you install and run yourself. Your sessions, folders, terminal output, saved scrollback, command history and settings are stored on your computer, in ~/.rakumux. Apart from AI session titles and, if you turn it on, the agent feed, both described below, they are not sent to us.

Some features contact other services directly from your computer:

• Installing and updating. The installer is downloaded from rakumux.com and fetches releases from GitHub. Checking for updates asks GitHub for the latest release. Like any download, these services see your IP address and the request.
• AI session naming. If you add your own Anthropic or OpenAI API key, Rakumux sends a short excerpt of a session’s recent commands and screen to that provider to suggest a name. This happens under your account with that provider and their terms apply. We don’t receive it.
• Phone access. Phone access connects your phone to your computer over your own Tailscale network. It doesn’t pass through our servers.

AI session titles

When you sign in to the Rakumux app, it names each session with a short AI-written title (older versions of Rakumux show a short AI-written description under each session instead). A name you give a session yourself is kept. This feature is on by default for signed-in users; turn it off at any time on the Features page.

• What is sent: the session’s state (for example working, waiting for you or idle), the agent’s own short status report if it gave one, and up to 8 KB of text: for a Claude Code, Codex or OpenCode session, your last message to the agent and the agent’s messages since (its reasoning, the tools it runs and its replies, never the tools’ output); for other programs, and in Rakumux before 0.1.16, the session’s most recent terminal output. Before sending, Rakumux removes text that looks like a password, token or key, on your computer; this is best-effort, so it can miss some.
• When: once for each coding agent chat, after the agent has written a few messages (5 by default) or when it finishes its reply, whichever comes first; after that, and for other programs, only when you ask for a new title. Earlier versions of Rakumux asked more often: at each of an agent’s turns (0.1.16), or when a session changed, at most about once a minute per session (before 0.1.16).
• Never sent: sessions marked private, and anything while you are signed out or have the feature turned off.
• What comes back: a title of a few words, which becomes the session’s name on your computer, and a one-line description of what the session is doing, which older versions of Rakumux show. Like any session name, it is sent with your session list and feed if you turn on the agent feed.
• Where it goes: to our service at rakumux.com, which passes it through Vercel’s AI Gateway to Anthropic’s Claude model to write the title and the description, then returns them. We don’t store what is sent, the title or the description; they are kept on your computer. To limit how many an account can ask for, we count requests per account, per hour and per day, and delete the counts after two days.

Agent feed

The agent feed shows, in the Rakumux app and on rakumux.com when you’re signed in, what your coding agents said when they finished a turn and the chat that led to it, on every computer you sign in on, and lets you write back to an agent from rakumux.com or another of your computers. With it on, the Status, Folders and App pages at rakumux.com list your Rakumux sessions on each computer and show each one’s chat. It is off unless you turn it on, on the Features page.

• What is stored: the chats of the coding agents (Claude Code, Codex and OpenCode) in your Rakumux sessions: your messages to the agent, the agent’s replies and its visible reasoning, the tools it runs with their input, and the tools’ output, each piece up to 64 KB; and, when the agent finishes a turn, its reply (up to 32 KB). With them: the session’s name, the name of its folder (never the folder’s path), the git branch the agent worked on, the agent, your computer’s name, the agent’s own conversation id, and when each message was written and arrived. Tools’ output and your messages can include whatever the agent read or ran, such as parts of files and the output of commands. Before sending, Rakumux removes text that looks like a password, token or key, on your computer; this is best-effort, so it can miss some. Rakumux 0.1.17 sends only the replies.
• Your session list: each computer’s list of its Rakumux sessions, sent by Rakumux 0.1.20 or later when it changes and every minute: for each session, its name, the name of its folder (never the folder’s path), the git branch its agent works on, the agent (or, without one, the name of the program it runs, never a shell), whether it’s running or has ended and what its agent is doing, the agent’s conversation id, whether you pinned it, and when you last used it; newer versions of Rakumux also send where it has changed files: up to 8 git working folders (a repository’s checkout or worktree), each by its name or its path inside the session’s folder (never the full path), with its git branch and when the session last worked there, never the files or what changed in them; and when the computer last sent its list. Each list replaces the one before it. Sessions marked private are never listed. If you move sessions in the list on rakumux.com, the order you give them is kept too: for each part of the list (a folder with its computer’s and folder’s names, an app, a status, or your pinned sessions), its sessions’ ids and computers’ names in that order.
• Replies you write: when you reply to an agent or write to one of your sessions, we store what you wrote (up to 8 KB), the turn it answers (if any), the computer, session, agent and conversation it is for, the computer you wrote it on (none when you wrote it on rakumux.com), when you wrote it, and whether it was typed into the session or why not.
• Files you attach: on rakumux.com you can attach up to 5 files (images or any other file, up to 4 MB each) to a reply or a message to a session. We store each file’s contents, name, type and size only until the computer the message is for fetches it: the contents are deleted as soon as the message has been typed into the session, couldn’t be, or after an hour if it never is, and a file you attach but don’t send is deleted after an hour (if none of your computers is running Rakumux then, by our daily clean-up the next day at the latest). The file’s name, type and size stay with your reply, so the conversation can show what you sent, and are deleted with it. Your computer saves the file in ~/.rakumux/uploads, types its path after your message so the agent can open it, and deletes it there after 7 days. Files are sent only to computers running a version of Rakumux that fetches them.
• When you last used the website: while you have the Feed, Status, Folders or App page at rakumux.com open, we note the time, at most every 30 seconds. Your computers check for your replies every second while you’re using these pages and for a minute after. Otherwise they check every second just after one of your replies is written or typed in (from the times stored with your replies), then less often as your replies go quiet, down to every 15 seconds.
• Your Sprite: if you connect your own Fly.io Sprite to Rakumux while signed in, the computer you connect it from enrols it, so the Sprite sends its own replies, chats and session list, and gets the replies you write to its sessions, without your sign-in. We store the name and id the Sprite goes by, a one-way hash of the secret it was given (never the secret itself), its web address and when it last asked for access; each access we give it lasts 15 minutes. When you write to one of its sessions, we send a request with no data to that address to wake it. You can revoke it on the Features page at rakumux.com or with rakumux sprite disconnect; a revoked Sprite’s record is deleted 30 days later, and all of them when your account is deleted.
• Never stored: your terminal’s screen and history, sessions marked private, and anything while you are signed out or have the feed turned off.
• Where it goes: to our service at rakumux.com, which stores it in our database (PlanetScale, in Sydney, Australia), under your account only, sends it back to the Rakumux app on your computers, and shows it to you on the Feed, Status, Folders and App pages at rakumux.com while you’re signed in and the feed is on. A reply you write is sent to the computer that ran the agent’s session, which types it into that session only while the session still shows that chat and the agent is waiting for you; a reply written on rakumux.com or another computer only if you turned on Replies from rakumux.com in Rakumux’s Settings on that computer. A file you attach goes only to the computer the message is for.
• How long: each reply and each chat message is deleted 7 days after it arrives (a message the agent changes is sent again, and kept 7 days from then), each reply you write 7 days after you write it, and all of them when your account is deleted. While you have Rakumux Pro, each is kept 90 days instead of 7; once your subscription ends, those older than 7 days are deleted. Files you attach are kept only until your computer fetches them, as above. Turning the feed off stops new replies and chats from being sent. A computer’s session list is kept until its next list replaces it, and deleted when you turn the feed off, 30 days after that computer last sent one, or when your account is deleted. The order you give your sessions is kept until you turn the feed off or your account is deleted; a session leaves it once no computer lists it. When you last used the website is deleted a day later, when you turn the feed off, or when your account is deleted.

The website

rakumux.com is hosted by Vercel. To deliver the site and protect it from abuse, Vercel processes request information such as your IP address, browser, the page requested and the time, and keeps server logs for a limited period.

We count visits to the home page and these information pages, so we know how people find Rakumux. We do this ourselves, without cookies and without third-party analytics. For each visit we store:

• the page and the time;
• the website that linked to it, by name only (such as google.com), never the full address;
• any campaign tag in the link (utm_source, utm_medium, utm_campaign);
• your country, worked out from your IP address;
• whether you use a desktop, tablet or phone, and your browser’s name.

To count how many different people visit in a day, we also store a code made from your IP address and browser with a secret that changes every day and is deleted after that day. We can’t use it to recognise you on another day, and we don’t store your IP address or your browser’s details. We also count clicks on the install command’s Copy button. We don’t count account pages. If your browser sends Do Not Track or Global Privacy Control, we don’t count your visits at all.

We don’t use advertising or tracking cookies. The home page and these information pages set no cookies.

Accounts

You don’t need an account to install or use Rakumux. If you create one, Clerk provides sign-up and sign-in on our behalf, and we process:

• your email address;
• your name and profile picture, if you sign in with Google or add them yourself;
• sign-in records, such as when you signed in, your IP address and your browser, used to keep you signed in and to protect your account;
• your password, if you set one, which Clerk stores in hashed form.

If you choose Sign in with Google, Google shares your name, email address and profile picture with us. We ask for nothing else from your Google account. Google’s privacy policy applies to your Google account.

Account pages use cookies set by Clerk that are needed to sign you in and keep you signed in. Clerk sends verification codes and account security emails for us. We don’t send marketing email without your consent.

How we use information

We use the information above to provide and secure your account, respond to your requests, understand how people find and use the website, prevent abuse and meet our legal obligations. We don’t sell it, and we don’t use it for advertising.

Who we share it with

We share information only with the service providers that run parts of Rakumux for us:

• Vercel, which hosts the website;
• PlanetScale, which hosts our database (website visit counts, request counts and, if you turn it on, your agent feed, its chats, files you attach until your computer fetches them, and your session list), in Sydney, Australia;
• Clerk, which provides accounts and sign-in;
• Vercel’s AI Gateway and Anthropic, which process AI session titles;
• Google, only if you choose to sign in with Google.

These providers may process information outside your country, including in the United States. We may also disclose information when the law requires it, or to a successor if Rakumux is transferred, in which case this policy continues to apply.

How long we keep it

We keep account information while your account exists. When you ask us to delete your account, we delete it, except for anything we must keep to meet a legal obligation; your agent feed (its replies and chats, the replies you write, the files you attach, your session list and the order you give it), your Sprites’ records and request counts are deleted with it. Website visit records are kept for 13 months, agent feed replies, chat messages and the replies you write for 7 days (90 days while you have Rakumux Pro), files you attach until your computer fetches them (an hour at most), a computer’s session list until it’s replaced, the feed is turned off, or 30 days after that computer last sent one, when you last used the website for a day, and request counts for two days. Hosting logs are kept for the period Vercel retains them.

Your choices and rights

You can ask us to give you a copy of your information, correct it or delete your account by emailing tony@humanunsupervised.com. Depending on where you live, for example in Australia, the European Union, the United Kingdom or California, you may have further rights, including the right to complain to a privacy regulator. In Australia that is the Office of the Australian Information Commissioner.

Children

Rakumux accounts are not intended for people under 16, and we don’t knowingly collect their information. If you believe a child has created an account, contact us and we will delete it.

Security

We collect as little as we can, use providers with established security programs, and encrypt connections to the website with HTTPS. No system is perfectly secure, so we can’t guarantee absolute security.

Changes to this policy

When we change this policy we will update it here and change the effective date. If a change is significant, we will say so on the website or email account holders before it takes effect.

Contact

Human Unsupervised Pty Ltd · tony@humanunsupervised.com