Privacy policy.

The short version

Matadoor runs no servers and collects no data.

No analytics. No telemetry. No account. No usage metrics. No crash reporting SDK. No advertising IDs. Matadoor pairs your iPhone or iPad with the free Matadoor Host app on your own Mac and drives terminals and coding agents over one end-to-end encrypted connection between your devices. Silo Systems operates nothing in that path. Unless you turn relays off on the Mac, a relay helps the two devices find each other and forwards the encrypted traffic until a direct path opens, or for the whole session when none can. By default that is n0's public relay, and the Mac also publishes its address to n0's discovery service; you decide on the Mac whose relay it is. The sections below say exactly what a relay can see.

How your devices connect

A Matadoor session is one QUIC connection (TLS 1.3) between your phone and your Mac, built on the open-source iroh networking library. Each side is identified by an iroh endpoint id, and the connection is authenticated against it. After pairing, Matadoor seals every message again with its own X25519 and ChaCha20-Poly1305 session key.

• Direct. When the devices can reach each other, on the same network or after punching through NATs, the encrypted bytes go device to device. On the same network this uses the optional local network permission.
• Relayed. Unless you choose Direct only (below), both devices also connect to a relay, n0's by default, to set up each session. It carries the connection whenever no direct path is working, including while one is still being found. A relay passes along packets that are already encrypted. It sees your endpoint id and IP address, never your terminal input, output or files, and it holds no app data at rest.
• Discovery. In the default mode, n0's discovery service maps an endpoint id to the addresses where it can be reached. It sees your endpoint id and IP address, nothing else.

You choose the relay (a Matadoor Host setting)

• n0 relays (the default). n0's public relays carry the fallback path and n0's discovery service helps the devices find each other. Both see your endpoint id and IP address, never decrypted data.
• Self-host. Pin a relay you run. Matadoor then uses no n0 relay and no n0 discovery, so the only server in the path is yours. The pairing QR carries the host's address and your relay (plus an optional relay auth token), so the paired phone uses the same relay and contacts no n0 infrastructure either.
• Direct only. No relay at all. No third party is contacted, but connections must find a direct path, so pairing or reconnecting across restrictive networks may not work.

What pairing exchanges

Pairing is a QR scan plus an explicit approval on your Mac. The QR shown by Matadoor Host carries the host's endpoint identity, its address and relay setting, and an X25519 public key. The phone answers with its own key, and the Mac must approve the device, shown as Matadoor on iPhone or Matadoor on iPad, before any session starts. The pairing is stored in the Keychain on your iPhone or iPad so Matadoor can reconnect to the same Mac; Forget this Mac in the app erases it.

The camera is used only to read the pairing QR code; images are never stored or uploaded. Local network access is optional and is used only to connect directly to Matadoor Host when both devices are on the same network.

Notifications and the Lock Screen

Banners about an agent that needs input or has finished are local notifications, raised on the device while Matadoor is open and connected. On iPhone, the Lock Screen and Dynamic Island status is a Live Activity the app updates on the device; when you leave the app it is marked Paused. Matadoor uses no push service, so nothing about your sessions passes through a notification server. On the Mac, Matadoor Host shows its own local notifications.

Agents and terminals run on your Mac

The terminals and coding agents run on your Mac, as your user, exactly as they would if you were sitting at the keyboard. Matadoor makes no model API calls of its own and ships no cloud component. What an agent you launch does, including any service it contacts, is governed by that tool's own behavior and policies. Matadoor simply relays your input and its output over the encrypted link.

Matadoor Host is not sandboxed, so it can start your shell and your agent programs. It is distributed outside the Mac App Store, signed with a Developer ID and notarized by Apple.

What we never see

Because Silo Systems runs no Matadoor server, none of the following reaches any infrastructure we operate:

• Your name, email, phone, IP address, or device identifiers.
• Your terminal input or output, the commands you run, the files on your Mac, or anything an agent reads or writes.
• Session timing, feature usage, taps, or any behavioural data.
• Crash reports. Matadoor implements no crash-reporting SDK.

Purchase

Matadoor is a one-time purchase on the App Store, with no in-app purchases. Apple handles the transaction under Apple's privacy policy, and Matadoor never sees your payment details. Matadoor Host is free.

Children's privacy

Matadoor collects no personal data from anyone, so the same policy applies regardless of age: nothing collected.

Changes

If we ever materially change how Matadoor handles data, we will publish an updated version of this page and announce it in the release notes. The effective date at the top reflects the current policy. The current policy is: nothing is collected.

Contact

Questions about this policy: admin@ohmslaw.net