Privacy

harlo, its iPhone app, its relay and this website · Last updated October 16, 2026

harlo is a desktop app for running coding agents on your own computer, with an iPhone app to follow and answer them from your phone. In short: harlo has no accounts, collects no analytics, and sends nothing about you to me. What you do in harlo stays on your computer and your phone, and between them it is end-to-end encrypted.

The iPhone app

• No account, no tracking. The app has no sign-up, no analytics, no advertising, and no third-party SDKs.
• Pairing. You pair the app with harlo on your computer by scanning a QR code. The app keeps the keys for that pairing in the iPhone's Keychain. Everything between the app and your computer (sessions, messages, files, photos, answers) is end-to-end encrypted with those keys.
• Camera. Used only to scan the pairing QR code, and to take a photo when you choose to send one to an agent.
• Photos. Only the photos you pick are read, and they go to harlo on your computer, for the agent you send them to.
• Local network. Used to reach harlo on your computer when both are on the same network.
• Microphone and speech recognition. Only while you dictate a message (you tap the mic). Your words are turned into text on the iPhone itself when it supports the language; otherwise Apple's speech recognition does it, under Apple's privacy policy. The audio isn't kept, and never comes to me.
• On the phone only. The name you can enter for the greeting, and which sessions you marked unread, stay on the phone.
• The demo shows sample sessions; it connects to nothing and saves nothing.

Notifications and Live Activities

If you allow notifications, harlo on your computer sends them (and Live Activity updates) through harlo's relay to Apple's Push Notification service. What a notification says (the session and its question) is encrypted for your phone before it leaves your computer: the relay and Apple only carry a sealed message and see your phone's notification token, the time and the size.

The relay

harlo's relay (relay.harlo.run) lets your phone reach your computer away from home, and passes notifications on. It forwards encrypted messages it cannot read, and it does not store them. Like any server on the internet, it sees IP addresses, when connections happen and how much data passes; it uses them only to run the service and limit abuse, and keeps no record of what you do. You can also use harlo without the relay, on your own network, Tailscale or a VPN.

harlo on your computer

• harlo keeps its data (settings, projects, notes, the session list) on your computer.
• The coding agents you run in harlo (Claude Code, OpenCode, pi, Oh My Pi) send your prompts and code to the AI providers you sign them in to, under those providers' own terms and privacy policies. harlo doesn't see or keep their credentials.
• harlo checks GitHub for its own new versions (and downloads them from there when you update), checks the npm registry for newer versions of the agents, and downloads speech models for dictation from Hugging Face when you first use it. These requests carry no information about you beyond what any download does.
• Signing git in to GitHub, GitLab or Forgejo uses those services' own tools and git's credential store; harlo keeps no token.

This website

harlo.run has no cookies, no analytics and no trackers, and its fonts come from the site itself. It is hosted by Cloudflare Pages, which, like any web host, sees the IP addresses of visitors and keeps short-lived logs to run and protect the service. The download page asks GitHub's API for the latest release's files, from your browser.

Children

harlo is a developer tool and is not directed at children.

Changes and contact

If this policy changes, this page will say so, with a new date. Questions: hello@harlo.run. Help with the app: support.