Privacy Terms

Privacy Policy

TouchTap Ltd ·

This Privacy Policy explains how Notifier for Codex handles your data. Notifier for Codex is made up of the phone apps for iOS and Android, codex-notifier (a command line tool for macOS, Linux and Windows), our relay server, and this website. Together we call them "the Apps". They are provided by TouchTap Ltd ("we", "us", "our"). We want to be clear about what data is collected, how it is used, and who it may be shared with.

summary There are no accounts. When Codex finishes or needs you, codex-notifier sends a notification through our relay server to the phones you have paired. A notification can include the project's name and folder path, Codex's message or the question it is asking, and, for an approval, the command or files involved. The server deletes notifications within 48 hours. We do not sell your data or use it for advertising. Nothing goes to OpenAI from us.

01Overview of the Apps

Notifier for Codex consists of:

PartWhat it does
Phone apps (iOS, Android)Receive notifications from your computers and let you answer Codex from your phone. Listed on the App Store and Google Play as Notifier for Codex CLI.
codex-notifier (macOS, Linux, Windows)A small program that Codex runs through its hooks. It sends notifications to your phone and waits for your answers. Windows support is in beta.
Relay serverPasses notifications and your answers between your computers and your phones, and keeps each computer's settings so you can change them from the phone. It is the same server that runs Claude Code Notifier, our app for Claude Code; each phone and computer is marked with the product it belongs to.

02Data We Collect

2.1 codex-notifier (Command Line Tool)

Codex runs codex-notifier at six points in a session (session start, each prompt you submit, before each tool use, approval requests, when Codex stops, and session end) and hands it details of that moment: the session ID, the working folder, the tool Codex wants to use and its input (such as a shell command or a patch), the prompt you typed, Codex's last message, and any question Codex is asking. codex-notifier keeps the following on your computer, in ~/.config/codex-notifier/ (%APPDATA%\codex-notifier\ on Windows):

Data TypeDescription and purpose
ConfigurationServer address, this computer's ID, its name, a copy of its settings, and whether notifications on the computer itself are on (config.toml). Used to remember the pairing and your preferences
CredentialsA random token that identifies this computer to our server. On macOS it is kept in the Keychain and on Windows in Credential Manager; on Linux, in a file only your user account can read (credentials). You can choose either place with credential_store. Used to authenticate with the relay server
Session FilesOne small file per Codex session: the working folder, your latest prompt (up to 4,000 characters), the latest tool call, terminal identifiers (such as the terminal program and tmux pane), what the current turn has done (files and lines changed, plan step), and the last notification sent. Deleted when the session ends, or after 7 days without use. Used to build notifications and spot repeats
LogErrors and timings, without prompts, commands or messages (codex-notifier.log, kept under 1 MB). Used for troubleshooting
Codex SettingsSix hook entries added to ~/.codex/hooks.json and a trust entry for each in ~/.codex/config.toml, plus a one-time backup of each file. Used to let Codex run codex-notifier

codex-notifier sends our relay server: when it registers, this computer's random ID, its token, its name (by default the computer's hostname; you can choose another name), its operating system, the codex-notifier version and the features it supports; and, for each notification, the data listed in 2.3. To decide whether to wait for your phone, codex-notifier checks how long the keyboard and mouse have been idle and, on macOS, which app is in front. That check happens on your computer and the result is never sent. codex-notifier pair sends the anonymous setup events described in 2.4; its hooks send no analytics.

When codex-notifier sends a notification to your phone, it can also show it on the computer itself. If our server stops recognising the computer (for example, after you erase it from the phone), the hooks show a reminder to pair again, at most once a day, and send nothing about your sessions.

2.2 iOS and Android Apps

The phone apps collect and store:

Data TypeDescription and purpose
Device IdentifierA random ID created on first launch. On iOS it is kept in the Keychain; on Android, in the app's encrypted storage. Used to identify your phone for pairing, notifications and purchases
Push TokenAn Apple Push Notification service (APNs) or Firebase Cloud Messaging (FCM) token. The app requests it when it opens, before asking for notification permission, so the server can send silent updates (for example, that pairing has finished) even if you have not allowed notifications
Device DetailsThe device name your phone gives apps (on Android, the model name), model, operating system version, app version, App Store or region country, preferred language, whether notifications are allowed, and your access state (trial, subscribed, lifetime or none). Used to show your phone by name on your computers, send visible notifications only where they are allowed, and for support
Notification HistoryNotifications you have received, including titles, messages, project names and your answers, kept on the phone to show history and allow offline access
Pairings and Computer SettingsThe computers you have paired, their names, and the settings you change for each one
Pairing CodeA 6-digit code the phone shows so that a computer can pair with it
Subscription StatusWhether you have an active subscription or a lifetime purchase, and how many answers you have sent
Reminders and CountsReminders the app sets on the phone itself (a trial ending, connecting a computer, or one you ask for when you say you do not use Codex yet), and a few counts kept on the phone, such as when you answered requests. None of this is sent to us
Install Link (Android)When you install the Android app from a link that a computer showed, Google Play gives the app a single-use pairing token. The app reads it once, on first launch, and ignores it after 30 minutes
Lock-Screen Cards (iOS)If you use lock-screen cards (Live Activities): the token Apple gives the app to start and update them, whether they are on, and whether details are hidden while the phone is locked

The phone apps can use the camera to scan the QR code that codex-notifier pair shows. The image is processed on the phone and is neither stored nor sent.

2.3 Relay Server

Our relay server stores:

Data TypeDescription and retention
NotificationsNotification type, title, message, prompt text (which can be Codex's last message, up to 1,500 characters; the start of your prompt, up to 300 characters; a plan; or a question and its options), project name, project folder path, tool name, a summary of the tool's input (such as the shell command or the files a patch changes, up to 200 characters), session ID, and terminal context (terminal type, session identifiers and working folder). Deleted within 48 hours
Your AnswersWhat you send from the phone (an approval or rejection, a choice, or a follow-up instruction for Codex), when, and whether it came from the phone or the computer. Deleted with the notification, within 48 hours
Computer RecordsEach computer's random ID and token, name, operating system, kind, version, the features it supports, and when it was registered and last seen. Deleted, with the computer's settings and pairings, when the computer has not connected for 60 days
Computer SettingsSettings you choose for a computer, from the phone or with codex-notifier config set: which notifications to send, quiet hours, sound, and how long to wait for the phone. Kept until changed, with the computer record
Phone RecordsThe device identifier, push token, platform, and the device details listed in 2.2. Deleted, with the phone's pairings, when the phone has not used the app for 60 days and is not paired with a computer that has connected in that time; also deleted when Apple or Google report the push token is no longer valid, for example after the app is deleted
Pairing RecordsWhich phones are paired with which computers (up to three phones per computer), and whether each pairing is active or revoked. Marked revoked when you unpair, then deleted 60 days later
Pairing Codes6-digit codes shown by a phone, and the links behind the QR codes codex-notifier shows. Can be used for 24 hours; cleared when used
Product AnalyticsAnonymous events from the phone apps, and setup events from codex-notifier and the install scripts, described in 2.4. Kept 60 days
Crash and Hang ReportsAnonymous reports of crashes and hangs in the iOS app, described in 2.4. Kept 60 days
FeedbackWhat you send in the feedback form, or when you say what held you back as you leave the purchase sheet: the reason you chose, any words you add (up to 1,000 characters), platform, app version and language, linked to the device identifier. Kept 60 days
Usage CountsFor each phone and day, how many requests reached it from a paired computer and how many it answered. Deleted within 60 days
Billing and Trial NoticesOnce your phone has held a store subscription: its push token, platform, language and time zone, so we can tell you if a payment fails, linked to the device identifier; and which notices a subscription has had. The push token is deleted 60 days after the app last refreshed it, and all of it when you use Delete my data
Pairing FailuresWhen a pairing code is rejected: the reason, platform, app version, country, how many digits differ from the closest live code, whether it matches an older code, and a salted one-way hash of the device identifier, never the identifier itself. Kept 60 days
Lock-Screen CardsFor iOS lock-screen cards: the phone's start and update tokens, whether cards are on, and each card's content (project name and a short summary of the request or of what Codex is doing, which can include a command or file name unless the phone hides details while locked). For a computer's working and finished sessions: project name, a short title and summary, and counts of steps, files, approvals and time. Cards are deleted a week after they end; sessions with the computer's record
Purchase RecordsNotices about your purchase from Apple and Google: product, transaction IDs or purchase token, dates, price, currency, storefront country, and renewal, cancellation and refund status, linked to the device identifier. Kept as financial records for 6 years from the date of each purchase, renewal or notice, then deleted, even if the phone's record is deleted sooner
Pricing TestsWhich version of a pricing test your install saw when it started a purchase, linked to the device identifier. Deleted with the phone's record, or 60 days after the purchase started if the phone was never paired
Refund ConsentWhether you turned on "Help with refund requests" in the iOS app, linked to the device identifier. Deleted 60 days after you last changed it, once no purchase record is linked to it

If a phone or computer is not used for 60 days, the server deletes its records and its pairings. To use it again, you will need to pair it again.

The relay server does not store your IP address. Our hosting provider, Cloudflare, processes it to deliver each request and tells us which country a request comes from. We record that country when a pairing code is rejected, to spot misuse, and with analytics events and crash reports (see 2.4), and delete those records after 60 days.

2.4 Analytics

The phone apps send anonymous product events to our own server. Events carry no device identifier, and the server does not store IP addresses with them. Each batch includes only the platform, app version and build, operating system version, device model, country, language, access state, and build type. Events describe how the app is used: for example, that the app was opened, the paywall was viewed or a plan was chosen, the outcome of a purchase, onboarding steps, whether notification permission was granted, which kind of computer you chose to set up (macOS, Linux or Windows), that a pairing code was shown or an install command was copied, that pairing finished, and that you answered a notification (with the kind of prompt only). Events never contain project names, commands, prompts, or Codex's messages.

The iOS app sends anonymous crash and hang reports to our own server, supplied by Apple's MetricKit framework. A report holds the app version and build, the operating system version, the device model, the country, and technical details of the fault. It holds no name, account, device identifier, IP address or notification content. Reports are deleted after 60 days. The phone apps use no third-party analytics or crash-reporting service.

codex-notifier pair and the install scripts on this website send a few anonymous setup events to our own server, so we can see where installing or pairing fails: that an install started, finished or failed (and at which step), that pairing started, finished or failed (with a short reason, such as an expired code), how codex-notifier was installed (install script, Homebrew or npm), its version, and the operating system and processor type. They carry no identifier, no computer name and nothing from your Codex sessions. Set CODEX_NOTIFIER_NO_ANALYTICS=1 or DO_NOT_TRACK=1 to turn them off.

This website uses Umami, a privacy-focused analytics service that does not use cookies. It counts page views and clicks on download and install buttons, including which operating system's install command was shown or copied.

03How We Use Your Data

Your data is used only to provide and improve the Apps:

  • Notification Delivery: To alert you when Codex finishes or needs your attention
  • Remote Response: To pass your answers from the phone back to Codex on your computer
  • Pairing: To connect your computers and phones with a short-lived code
  • Computer Settings: To let you change a computer's settings from your phone
  • In-App Purchase Verification: To confirm subscriptions and lifetime purchases, and to keep financial records
  • Product Improvement: To count, in aggregate, how the apps are used and how pricing tests perform
  • Security: To detect misuse of pairing codes and the relay server
  • Crash Fixing: To find and fix crashes and hangs in the iOS app
  • Reminders and Notices: To remind you to finish setup, to tell you if a payment fails or a trial is cancelled, and to show lock-screen cards
  • Feedback: To read what you tell us and improve the apps

We do not use your data for advertising or marketing, sell or rent it to third parties, profile individual users, or train machine learning models.

04Data Storage and Security

4.1 Local Storage (codex-notifier)

  • Files: Kept in ~/.config/codex-notifier/ (%APPDATA%\codex-notifier\ on Windows). On Linux the credentials file can be read only by your user account
  • Credentials: Stored in the macOS Keychain or Windows Credential Manager, or in a private file on Linux, unless you choose otherwise with credential_store
  • Data Retention: Session files are deleted when a session ends, or after 7 days without use. codex-notifier uninstall deletes everything codex-notifier keeps and removes its entries from Codex's files

4.2 Local Storage (iOS/Android)

  • Notification History: Stored in the app's private storage on your phone
  • Device Identifier: Stored in the iOS Keychain, or in encrypted storage on Android. iOS can keep Keychain items after an app is deleted, so reinstalling may reuse the same identifier
  • Preferences: Stored in UserDefaults (iOS) or DataStore (Android)
  • Data Retention: Notification history stays until you clear it or delete the app

4.3 Cloud Storage

  • Infrastructure: The relay server runs on Cloudflare Workers, with data stored in Cloudflare D1 (SQLite) and Durable Objects
  • Encryption: All communication with the server uses TLS encryption (HTTPS/WSS)
  • Geographic Location: Data may be processed in Cloudflare data centres worldwide
  • Notification Expiry: A cleanup job runs every day and deletes notifications, with your answers to them, that are more than 24 hours old, so none is kept longer than 48 hours. While a computer is waiting for your answer, a copy of the answer is also held for up to 1 hour
  • Inactive Records: The same daily job deletes phones and computers that have not been used for 60 days, with their pairings and settings, and revoked pairings 60 days after they were revoked. Purchase records are deleted 6 years after their date

05Third-Party Services

The Apps use the following third-party services:

ServiceWhat it does and what it receives
Apple App StoreProcesses iOS subscriptions and one-time purchases and sends us notices about them. It receives the purchase, with the device identifier as its account token. If you turn on "Help with refund requests" in the app and then ask Apple for a refund, we also tell Apple that the purchase was delivered, whether you set up and used the app, and whether we think the refund should be granted; we do this only with your consent, which you can withdraw in Settings at any time. Payment details are handled entirely by Apple. Privacy Policy
Google PlayProcesses Android subscriptions and one-time purchases and sends us notices about them. It receives the purchase, with the device identifier as its obfuscated account ID; for a link that a computer showed, the single-use pairing token passes through Google Play as the install referrer. Payment details are handled entirely by Google. Privacy Policy
Apple Push Notification serviceDelivers notifications and silent updates to iPhones and iPads. It receives the push token; notification title and text (up to 200 characters); project name; prompt text (up to 500 characters); tool name and input summary; answer options; notification IDs; and, for lock-screen cards, the card's content. Project folder paths are not sent. Privacy Policy
Firebase Cloud Messaging (Google)Delivers notifications and silent updates to Android phones. It receives the push token, the same notification data as Apple, and a Firebase installation ID. Privacy and Security
CloudflareHosts the relay server and this website and stores the server data described in 2.3. It processes all data sent to the relay server and standard request data such as IP addresses. Privacy Policy
GitHub, Homebrew and npmHost codex-notifier's release files. The install scripts on this website download it from GitHub and check its checksum; you can also install with Homebrew or npm. The service you download from sees standard request data (IP address, user agent), and Homebrew and npm have their own analytics and policies. GitHub Privacy Statement
UmamiCounts page views and button clicks on this website, without cookies. It processes the page address, referrer, browser, device type and country. Privacy Policy

Codex itself is OpenAI's product and its own terms and privacy policy apply to it. The Apps do not send anything to OpenAI.

06Data Sharing

We share your data only in the following circumstances:

  • Between Your Devices: Notifications pass between your computers and the phones paired with them through our relay server. A paired phone can see each computer's name, operating system and settings
  • With Push Notification Providers: Apple (APNs) and Google (FCM) receive notification content to deliver it to your phone
  • With App Stores for Purchases: Apple and Google process subscriptions and one-time purchases; they receive transaction data, and we do not receive your payment information
  • With Our Service Providers: Cloudflare hosts the relay server and this website, and Umami counts website visits
  • Legal Requirements: We may disclose data if required by law or to protect our legal rights

We do not sell, rent, or trade your personal data to third parties.

07Your Rights and Choices

7.1 Data Access and Deletion

  • View Your Data: Notification history is shown in the phone apps; codex-notifier config show shows a computer's settings
  • Unpair: Revoke a pairing from the phone or with codex-notifier devices revoke. The phone stops receiving that computer's notifications straight away. The server marks the pairing as revoked, deletes its notifications on the usual schedule, within 48 hours, and deletes the pairing 60 days later
  • Remove codex-notifier: codex-notifier uninstall removes its hooks and their trust entries from Codex's files, revokes every pairing, and deletes its credentials and local files
  • Delete Local Data: Deleting a phone app removes the data it stored on that device (except, on iOS, the device identifier in the Keychain; see 4.2)
  • Delete Server Data: Do it yourself whenever you like. In a phone app, open Settings and choose Delete my data; on a computer, run codex-notifier forget. Each removes that phone or computer, its pairings and its queued notifications from our server straight away, along with its feedback, usage counts, billing-notice records, lock-screen cards and pairing-failure records. Anything you leave is deleted automatically once it has not been used for 60 days

7.2 Opt-Out Options

  • Choose What Is Sent: For each computer, turn off notifications for finished turns, approval requests or questions, or set quiet hours, from the phone or with codex-notifier config set
  • Notification Permission: If you turn off notifications for the app on your phone, the server records that and stops sending it visible notifications. Silent updates, such as pairing confirmation, still arrive
  • Stop Using the Relay: Unpair every phone, or run codex-notifier uninstall, to stop sending data to the relay server

7.3 Your Legal Rights

TouchTap Ltd is the controller of the personal data described in this policy. Depending on where you live, including in the UK and the European Union, you may have the right to access, correct or delete your personal data, to object to or restrict how we use it, and to receive a copy of it. You can use most of these rights yourself, without asking us, as described in 7.1. To use them another way, email contact@touchtap.co.uk. Because there are no accounts, we may ask for details, such as the names of your computers and phones, to find your records. You also have the right to complain to a data protection authority; in the UK this is the Information Commissioner's Office (ico.org.uk).

7.4 Data Portability

The Apps do not currently offer a data export feature. Data stored on your devices can be seen in the Apps, and codex-notifier's files are plain text.

08Information About Project Paths and Commands

important Notifications from codex-notifier may include full file system paths to your projects (for example /Users/yourname/Projects/secret-project); tool names and summarised inputs, such as shell commands being run or the files a patch changes; Codex's last message, plans and questions, and the start of your prompt; and your computer's name, which is its hostname unless you choose another. This information is sent to our relay server, and a shorter version to Apple or Google to deliver the notification. If you work with sensitive or confidential projects, consider whether phone notifications are appropriate, and which kinds of notification to turn on for each computer. Questions Codex marks as secret are never sent to the phone.

09Children's Privacy

The Apps are not directed at children under 13 years of age. We do not knowingly collect personal information from children. If you believe we have inadvertently collected data from a child, please contact us to have it removed.

10International Data Transfers

Our relay server runs on Cloudflare's global network, and Apple and Google deliver notifications from their own infrastructure. Your data may be processed in data centres outside your country of residence. Where the law requires safeguards for these transfers, we rely on the ones those providers put in place, such as the EU–US Data Privacy Framework and standard contractual clauses.

11Changes to This Privacy Policy

We may update this Privacy Policy as the Apps evolve. Material changes will be communicated through the Apps or on this page. The "Last updated" date at the top indicates when the policy was last revised.

12Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or your data, please contact TouchTap Ltd at contact@touchtap.co.uk.