# RemoteCommander — Privacy Policy

Effective: 2026-09-25
Publisher: Vu Minh Quang (individual) — contact: vu.minh.quang@outlook.com

## 1. Summary

RemoteCommander runs on your own computer. The publisher operates no server
for it and receives none of your data: no files, commands, outputs, chats,
accounts or usage statistics. Data moves only between your computer and the
AI client you connect.

## 2. What RemoteCommander processes

To do what an AI client asks, RemoteCommander processes on your computer:

- tool requests: file paths and contents, commands, arguments, working
  directories, environment variable names you pass, process input;
- tool results: file contents, directory listings, search matches, command
  and process output.

These results are sent back to the AI client that made the request. From that
point they are handled by that client's operator (for example OpenAI or
Anthropic) under its own privacy policy, which may include using connected-app
data in chat memory.

## 3. What RemoteCommander stores on your computer

In its state directory (default `~/.remote-commander`):

- `grants.json` — the approval scopes you chose to "always allow";
- `oauth.json` — registered AI clients (id, name, redirect addresses) and
  SHA-256 hashes of refresh tokens; access tokens are kept in memory only;
- `memory/<principal>.jsonl` — notes the AI client chose to keep for later
  conversations through the `memory` tool (they may include content the
  client read from your files), a one-line record of each command run and
  file change, and your standing approval decisions. Behind OAuth the
  principal is the end-user identifier the AI client asserts (for ChatGPT,
  `openai/subject`), so each user of the same machine has their own file.

It also writes to its console (standard error), which you control:

- an audit line per tool call: tool, operation, outcome, duration and caller
  identity — never arguments, file contents or output;
- pairing codes when a client asks to connect;
- with `--log-protocol` only: protocol metadata (versions, client name,
  capabilities) — never arguments.

Nothing else is written, and nothing is sent anywhere except the tool
results returned to the requesting client.

## 4. Cookies and tracking

RemoteCommander's pages (consent, terms, privacy) set no cookies, load no
external resources and contain no analytics or tracking.

## 5. Your control

- Choose what RemoteCommander can reach with workspace roots, the command
  policy and approval settings.
- Disconnect a client by deleting `oauth.json` or stopping RemoteCommander;
  revoke standing approvals by editing or deleting `grants.json`.
- Manage what AI clients keep (chat history, memory) in those clients' own
  settings.

## 6. Children

RemoteCommander is a developer tool and is not directed at children.

## 7. Changes

This policy may be updated; the effective date above changes with each
revision.

## 8. Contact

Privacy questions: vu.minh.quang@outlook.com