Privacy

Applies to the waterplane Android app, the waterplane web app, the waterplane host and this website. Effective 15 October 2026, last updated 3 November 2026.

We collect nothing. waterplane has no server, no account, no analytics, no crash reporting and no advertising. The app talks to one machine: the desktop you run the host on, at the address you give it, normally over your own Tailscale network. We, the people who make waterplane, never receive your data, because nothing is sent to us. Only this website counts its visits, without cookies; see Visitor statistics.

What the phone stores

On the phone, in the app's own storage (the browser's for the web app, the WebView's for the Android app):

• Your settings, and the list of desktops you added with their addresses.
• A device token for each desktop, which is how the host knows this phone is paired.
• Prompts you have not sent yet: drafts, the prompt pad, and the offline queue of prompts waiting for the desktop. They stay until they are delivered or you discard them.
• Copies of what you looked at, so the app works offline: terminal output, transcripts, the file tree, gallery pictures and thumbnails, files you downloaded, and token and context readings.
• Recorded dictation waiting to be transcribed, until it is.
• Counts of which features you used and network statistics. These are sent to your own host, never anywhere else.

Clearing the app's storage, or uninstalling the app, deletes all of it. If Android backup is on for your device, Android may include the app's storage in your device backup, under your backup provider's terms.

What the host stores

On your desktop, under ~/.local/state/waterplane (or WATERPLANE_STATE_DIR), ~/.config/waterplane and a .waterplane/ folder in each repo:

• Paired devices, with their tokens hashed, and the LAN password as a salted hash if you set one.
• Push subscriptions for the browsers you allowed to notify, and the host's own key pair for them.
• Session state: open and closed sessions, the queue and its delivery receipts, a log of what was sent, schedules, the backlog, stars, reviews and settings.
• Usage and cost readings, limit events, install logs and terminal scrollback.
• Files you send from the phone, in that repo's .claude/inbox/.

The host reads Claude Code's own logs under ~/.claude/projects to show transcripts, the archive and token figures. All of this stays on your desktop; delete the folders above to remove it.

Permissions the Android app asks for

• Network: to reach your desktop.
• Notifications, a foreground service and start at boot: an optional background link, one connection to your own desktop, so it can tell you a session needs you. There is no push service behind it. Start at boot does nothing unless you turned the link on.
• Microphone: push-to-talk dictation, only while you hold the button.
• Location and Wi-Fi state: only if you turn on switching to a desktop's LAN address at home. Android requires location permission to read the Wi-Fi name; the app compares it on the phone and sends it nowhere.
• Biometrics: to unlock values kept in the Android Keystore.
• Install apps and storage (Android 9 and older): to install or save an APK or file you downloaded from your desktop.

When something does leave your desktop

Only through a feature you use, and only to the service it names:

• Claude Code itself talks to Anthropic under your own account. That is the CLI you installed and signed in to; waterplane adds nothing to what it sends.
• Browser notifications in the web app are delivered through your browser maker's push service, as every web push is. The message is encrypted for your browser and holds the notice's title and text and which session or file it is about. The Android app does not use this.
• Dictation is transcribed on your desktop when it has whisper.cpp. Without it, the phone's own speech recogniser is used, which may send audio to the phone or browser maker.
• Another model provider receives prompts only if you configure one for the host's own small tasks.
• Update checks: the host asks npm or Homebrew whether a newer Claude Code is out, and waterplane update downloads releases from GitHub. Android build tools are downloaded from Google and Adoptium only when you ask for them.

The demo at waterplane.dev/demo runs entirely in your browser and makes no network requests. This website sets no cookies, stores nothing on your device and runs no third-party scripts. GitHub Pages, which hosts it, keeps standard server logs.

Visitor statistics

The start page of waterplane.dev loads one invisible image from a small counting service we run ourselves on Google Cloud, so we know how many times a day it is opened and by how many people. Loading it sends what any web request sends: your IP address, your browser's User-Agent header and that the page was waterplane.dev. No script runs for it, and nothing is stored on or read from your device (no cookies, no local storage, no fingerprinting).

• What is kept: two numbers per day: how many times the start page was opened, and by how many different visitors. The IP address and User-Agent are used only in memory, for that one request, to leave out bots and requests from other sites, and are never written anywhere, not to a database and not to a log.
• How visitors are told apart: the IP address and User-Agent are combined with a random value made new each day (a salt) and turned into a one-way hash (SHA-256). Only the hash is kept, so a second visit on the same day is not counted again. The salt and the day's hashes are deleted automatically once the day is over, usually within 24 hours after it ends. Without the salt a hash cannot be traced back to an address, and the same visitor gets a different hash the next day, so nobody is followed from one day to the next.
• Who processes it: Google Cloud (Google Cloud EMEA Ltd, Ireland) runs the service for us as our processor under its Cloud Data Processing Addendum, in Frankfurt (region europe-west3). Google is part of a US group; any access from outside the EU is covered by the EU-U.S. Data Privacy Framework and the EU standard contractual clauses included in that addendum.
• Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in knowing whether anyone reads this site, in the least intrusive way we found. Because nothing is stored on or read from your device, no consent is needed under § 25 TDDDG.
• Objecting: blocking images from run.app (any content blocker can) stops it entirely, and the site works the same. You may also object under Art. 21 GDPR by email.

Children

waterplane is a developer tool and is not directed at children.

Data protection rights (GDPR)

The waterplane app, host and this website (apart from the server logs GitHub Pages keeps and the visitor count, both above) do not process any personal data about you (Art. 4(1) GDPR). If you email me, your address and your message are processed to reply, on the basis of Art. 6(1)(f) GDPR (legitimate interest in answering enquiries), and deleted when no longer needed. You have the rights of access, rectification, erasure, restriction of processing, data portability and objection under Art. 15 to 21 GDPR. You may complain to a supervisory authority, for example the Landesbeauftragte für Datenschutz und Informationsfreiheit Baden-Württemberg. Controller and provider: Johannes Hohenbichler, Ganswiesenweg 21, 73728 Gerlingen, Germany; see the Impressum.

Changes and contact

Changes to this page are made in public, in this site's repository. Controller: Johannes Hohenbichler, Ganswiesenweg 21, 73728 Gerlingen, Germany, johanneshohenbichler@googlemail.com (see the Impressum), for questions about this page and any request about your data. General questions: open an issue. Anything security-related: report it privately.