Privacy Policy
Last updated 16 September 2026
Introduction
Warshall is a desktop workspace for building software with coding agents. It is operated by an individual, not a company. This policy explains what the desktop app, the website at warshall.dev, a Warshall account and the mobile remote handle, what they keep, and what never leaves your machine. It is written to be read in full, and it is short because there is not much to say.
1. What the desktop app stores
Everything the app works with is stored in a data folder on your disk. That folder holds your project list, terminals, the conversations each terminal has had with a coding agent, the WorkMaps and their history, git worktrees, build scripts, prompts, skills, attachments, settings, and the sign in files of the coding agent accounts you link. The app reads your project folders in place and never copies them anywhere else.
Removing the app’s data folder removes everything the app knows. Uninstalling the app does not delete your project folders.
2. What leaves your machine
There is no Warshall server that receives your code, your prompts, your conversations or your maps. The app works fully without a Warshall account and without a network connection to Warshall. The traffic the app makes on your behalf falls into four kinds, and each is described in its own section below.
- Requests to the coding agent providers you have signed in to, carrying what you asked those agents to do.
- Requests to the account service, only when you use a Warshall account.
- Encrypted frames to the mobile relay, only while the mobile remote is on.
- Usage and error counts, which you can switch off.
3. The website
warshall.dev sets no analytics cookies and runs no third party trackers. The theme you pick is remembered in your browser’s local storage. When you sign in to a Warshall account the site sets one session cookie so the account pages know who you are. The server logs of the host that serves the site record request paths, response codes and truncated network addresses for a short window so the site can be kept running, and they are used for nothing else.
4. A Warshall account
An account is optional. You create one only if you want the features that involve another person. Those are sharing a WorkMap with someone and opening a review to a teammate. The mobile remote does not use an account.
An account stores your email address, a salted hash of your password, the sessions you have open, and the devices you have signed in from with the name each device reports. It also stores the things you deliberately share through it. A shared WorkMap is stored so the people you shared it with can open it. A review you open to someone else is stored with its comments so they can read and answer them. Nothing is shared unless you share it, and a project that you never share never leaves your machine, account or not.
Signing out of a device removes its session. Deleting your account deletes the account record, its sessions and devices, and everything shared through it.
5. The mobile remote
The phone app shows what your desktop is doing and lets you prompt it from wherever you are. To reach a desktop behind a home network, both sides connect outward to a relay run by Warshall, and the relay forwards frames between the two connections.
Every frame is encrypted between the desktop and the phone with a key the relay never holds, so the relay forwards bytes it cannot read. A phone links to a desktop by scanning a code the desktop shows, with no account involved. For each linked phone the relay keeps the two device identifiers and public keys, the phone’s model, system and app version, and the network address and approximate place it last connected from, so the desktop can list its linked phones. It keeps them until the phone is removed or disconnected, or for thirty days after the phone last connected. It does not write transcripts, screenshots, maps or prompts anywhere. Push notifications carry only an event type and an opaque identifier, never content.
The phone holds what the desktop has sent it only while the remote is on. When you turn the remote off on the desktop or close the desktop app, there is nothing new for it to read. When you remove the phone on the desktop or disconnect it on the phone, the phone’s sections empty and it keeps nothing from the desktop.
6. Usage and error counts
The desktop app sends a small set of counts so that broken releases get noticed. These are counts of app starts, runs started and finished, run failures, build queue outcomes and app errors, together with the app version, the operating system, and a random installation identifier that is generated on the first run and is not tied to your account. They never include prompts, code, file names, paths, project names, branch names, email addresses, tokens or conversation text. Free text such as an error message is scrubbed before it is sent. The switch under Settings turns this off, and off means nothing is recorded or sent.
7. Coding agent providers
Warshall runs the coding agent command line tools you already use, with the accounts you sign in to yourself. Your prompts and your code go to those providers under their own terms and their own privacy policies, exactly as they would from a terminal. Warshall does not add itself to that path and does not receive a copy.
8. Retention and deletion
Local data stays until you delete it. Account data stays until you delete the account or the item. Relay session state lives until the phone is removed or disconnected, or thirty days after the phone last connected. Website server logs are kept for a short operational window. Usage and error counts are kept in aggregate and are not attached to a person.
9. Security
Passwords are stored only as salted hashes. Sessions are random tokens stored hashed on the server. All traffic between the site, the account service, the relay and your devices uses TLS. Coding agent credentials stay in the app’s data folder on your machine and are never sent to Warshall. To report a vulnerability, write to security@warshall.dev.
10. Your choices
- Turn usage and error counts off under Settings in the desktop app.
- Sign any device out of your account from the account page, or delete the account there.
- Remove a linked phone under Settings, Mobile Remote, which ends its session and empties it.
- Delete the app’s data folder to remove everything the app knows.
- Ask us to show or delete the account data we hold about you by writing to the address below.
11. Changes to this policy
When this policy changes, the date at the top changes with it. A change that affects what leaves your machine is announced on this page before it takes effect.
12. Contacting us
Questions about anything on this page go to privacy@warshall.dev. The Terms of Service sit beside this page.