PRIVACY POLICY

1. Scope and Privacy Commitment

This policy explains how the Otherside CLI, desktop client, companion app, Design experience, website, and backend service process information. Otherside is built to keep coding-session content confidential while collecting the operational metadata required to authenticate accounts, pair devices, synchronize sessions, prevent abuse, and operate the service.

2. End-to-End Encrypted Session Content

Supported current clients encrypt remote-session content on your device before it reaches the Otherside backend. This includes prompts, AI responses, tool and permission events, terminal data relayed to a companion, and encrypted session fields such as title, project, and branch. The backend stores and relays ciphertext so your paired devices can synchronize the current remote session and briefly recover its history after disconnection, but it does not hold the private keys needed to decrypt it.

The protocol uses X25519 key agreement, HKDF-SHA-256 key derivation, and XChaCha20-Poly1305 authenticated encryption with random 24-byte nonces and a per-sender symmetric ratchet. HMAC-SHA-256 protects local integrity records. Public keys and wrapped session keys are transmitted; private device keys remain on your devices.

3. Information We Process

• Account data: identity-provider subject, email address, account and authentication-session identifiers, and account lifecycle records.
• Device and pairing data: device or environment identifiers, device labels and kind, fingerprint hashes, public pairing material, pairing records, wrapped session keys, push tokens, and presence state.
• Session metadata: session, session-incarnation, and environment identifiers; provider, model, permission mode, status, event type and counter; creation, update, disconnection, and expiration timestamps; encrypted payloads; and encrypted title, project, and branch fields.
• Operational and security data: IP address, User-Agent, referrer, requested URL and query data, request ID, service logs, rate-limit and audit records, crash or error details, and feedback you choose to submit.
• Website and Design analytics: page URL and path, referrer, filtered query parameters, approximate region, and device, browser, and operating-system dimensions. A website analytics service does not use third-party cookies for this measurement.

Otherside does not intentionally send plaintext source code or coding-session content to the broker. Content is sent to an LLM provider or tool only when you select or invoke that provider or tool from a client.

4. Desktop Client

The Otherside desktop client runs on your computer and does not require an Otherside account. Its agent is the Otherside CLI, which runs on your computer. Neither the desktop client nor its agent connects to the Otherside backend, even if you have signed in to an Otherside account in the CLI: the account, companion-app, remote-session, and Design features described in this policy work only when you run the CLI in a terminal. The desktop client includes no analytics or crash-reporting service.

Stored on your computer

• Conversations, including your prompts, agent responses, tool activity, and attachments, together with project folder paths, settings, scheduled tasks, and terminal history, are stored in the desktop client's data folder, by default ~/.otherside/desktop.
• The agent keeps its session transcripts and provider sign-ins in the same local folder the CLI uses, by default ~/.otherside (%APPDATA%\Otherside on Windows).
• Logs of the app's and the agent's activity are written to your computer. The desktop client sends logs to a collector only when you set up OpenTelemetry export.
• Provider sign-ins, source-control tokens, and the keys that protect paired sessions are stored in local files. Saved connections to other computers are encrypted with your operating system's credential storage and are not saved when that storage is unavailable.
• Checkpoints that let you review and undo the agent's changes are stored as hidden Git references inside your project's repository.

Network connections

The desktop client and its agent connect to these destinations:

• The LLM providers you sign in to or select, as described in section 6.
• The desktop release feed, to check for updates 15 seconds after the app starts and every 4 minutes after that. An update downloads only when you choose to download it. An administrator policy can turn update checks off.
• Your project's Git remotes, which the desktop client fetches every 30 seconds by default using your own Git credentials.
• Your source-control host, using the credentials you provide, when you use pull-request features. Pull requests you link or watch are checked again every one to two minutes.
• Google's favicon service, which receives the host name of each public website linked in your conversations so the link can show the website's icon. Images and icons in conversations may also load directly from the websites that host them.
• Websites and search engines the agent reaches with its web tools, and websites you or the agent open in the built-in preview browser.
• The official download location of a headless browser, the first time a preview or rendering feature needs it; a public model-price list, when you open the Usage page; and a public extension registry, when you search for themes.
• MCP servers, hooks, and device tools, only when you configure or turn them on.
• An OpenTelemetry collector, only when you enter its address in the desktop client's settings. The collector then receives the app's traces, metrics, and logs, including your computer's host name.

Paired devices and remote environments

• By default the desktop client accepts connections only from your own computer. When you turn on network access, other devices on your network can reach it, and the desktop client does not encrypt that connection itself. Use network access only on networks you trust.
• A device connects only after you pair it with a single-use link, which expires after five minutes by default. A paired device can read and operate your conversations, terminals, files, settings, and source-control actions, and its session lasts up to 30 days by default. The desktop client records each paired device's IP address and browser details, and a paired browser keeps its connection and cached conversation data in its own storage.
• When you turn on HTTPS sharing over a private network, the desktop client asks the private-network software on your computer to publish it over HTTPS to the devices on that network.
• When you add an SSH environment, the desktop client connects to that computer with your SSH setup, installs and starts the Otherside server there, and carries its traffic through the SSH connection. Conversations, terminals, and agent work for that environment run and are stored on that computer. A task you delegate to a linked environment is sent to, and runs on, that environment.

5. How We Use Information

We use this information to authenticate you, link trusted devices, route encrypted events, restore session state, deliver push notifications, provide requested AI and Design features, operate and secure the service, diagnose failures, enforce limits, respond to feedback, and meet legal obligations. We do not sell personal information or use coding sessions for advertising.

6. Service Providers and External Destinations

• Google and Apple process sign-in information when you choose their identity services.
• The LLM provider you select receives the prompts, context, files, tool results, or other content required for your request under that provider's terms and privacy policy.
• Network delivery and security are provided by a network-delivery provider, and the website and Design experience are hosted by a website host that also provides privacy-focused analytics.
• Apple Push Notification service and Firebase Cloud Messaging receive device tokens and generic event or session identifiers needed to deliver notifications, not decrypted session content.
• Infrastructure hosting and monitoring providers process operational data needed to run and protect the service.

7. Retention and Deletion

• Your local CLI transcript is the canonical session history. Remote synchronization is not an archival or backup service.
• The backend retains encrypted session events, wrapped session keys, and related session records while the remote session is connected and for one hour after it disconnects. Reconnecting within that hour cancels the pending expiration.
• After the one-hour window, an application-managed cascade deletes the remote session incarnation and its encrypted events, key wraps, device state, pending notifications, and related Design session records. Reconnecting later creates a new remote incarnation that the CLI may seed from its local transcript. Manual session deletion is permanent and is never reseeded.
• Account identity, pairing, environment, and device records remain until you explicitly remove them or request account deletion. Account deletion is scheduled 30 days after your request.
• The desktop client keeps its data on your computer. Its conversations stay in ~/.otherside/desktop, and its agent's transcripts stay in ~/.otherside, until you delete those folders; if you also run the CLI in a terminal, the CLI removes transcripts in ~/.otherside that have not changed for 30 days unless you change its cleanup setting. The desktop client's per-conversation agent activity logs are deleted after 14 days, its other logs rotate at fixed sizes, and terminal history is limited to 5,000 lines or 8 MiB per terminal.
• A website analytics service derives a request-based visitor session that is discarded after 24 hours. Push tokens remain until they are revoked, replaced, or the related account or device is removed.

8. Your Choices and Rights

You can unpair devices, delete remote sessions, sign out, revoke push access, and request account deletion from the product interfaces. In the desktop client you can also turn network access off, revoke paired devices and pairing links, and change or turn off the repeated automatic Git fetches with the Git fetch interval setting. Depending on where you live, you may also request access, correction, deletion, restriction, portability, or an explanation of the personal information associated with your account. We may need to verify your identity before fulfilling a request.

9. Security and Policy Changes

We use encryption in transit, end-to-end encryption for supported remote-session content, access controls, rate limits, restricted service networking, and security monitoring. No system is completely secure. We will update this page when our processing practices or legal obligations materially change and will revise the date above.

10. Contact

For privacy questions or requests, use Settings → Report an Issue in the authenticated companion app and identify the request as privacy-related. Do not include credentials, private keys, source code, or other sensitive session content in your report.