AtControl
Join the beta

Privacy Policy

Effective 30 September 2026. This policy covers AtControl for Mac and AtControl Mobile (for iPhone and iPad), together “AtControl” or “the apps”, published by Tomasz Klocek, Wrocław, Poland, support@atcontrol.app. It also covers this website, atcontrol.app.

The short version

AtControl is built local-first. Your settings and your activity journal stay on your Mac. If you pair an iPhone or iPad, the two devices exchange status and commands through the private part of your own iCloud account, which we do not operate and cannot read. The apps contain no analytics, no advertising identifiers and no third-party tracking. We do not run a server that receives your data, and we do not sell or share anything.

1. Who is responsible

Tomasz Klocek publishes the apps and this website. Because the apps do not send data to us, we hold none of it; where the law nonetheless treats us as responsible for how the apps process data on your devices, we are the controller and you can reach us at support@atcontrol.app.

2. What the apps store on your devices

On your Mac (AtControl for Mac)

  • Settings and preferences.
  • The activity journal: a record of what AtControl did — blocking turned on or off, timers, agent sessions, remote connections observed, commands received from a paired phone, the reason blocking ended, app launches and sleep or shutdown requests — with timestamps. When remote-access monitoring is on, the journal also records the local port, the remote IP address and the process name of a connection it observed. The remote IP address stays on the Mac; it is never part of what is synced (section 3).
  • If you pair a phone: this Mac’s identity key and the keys of the phones you trusted, in the macOS Keychain (they never sync to iCloud Keychain), and a short-lived record of pairing windows and received commands.
  • If you protect agent deeplinks (atcontrol:// links) with a capability token: that token, in the Keychain.
  • If you tip through the Support page: a local record of the tip, so the app can thank you. Apple handles the payment; we never receive your name, address or payment details.
  • A diagnostic log of state changes and errors (at most 30 days and 10 MB), with the Mac’s model, processor and AtControl’s settings. It never contains network addresses, tokens, pairing secrets, agent task names or device names, and it leaves the Mac only if you export it (Settings ▸ Advanced ▸ Diagnostics) and send it yourself.

On your iPhone or iPad (AtControl Mobile)

  • Settings, notification preferences, nicknames you gave your Macs.
  • A local copy of each paired Mac’s status and journal, so the app can show statistics offline.
  • This device’s identity key and the keys of the Macs you paired, in the Keychain.
  • A record of the commands this device sent and their outcomes.

All of this stays on the device. It is removed when you delete the app (the Mac’s journal is in the app’s own container). The journal on the Mac is also pruned by the retention rules you choose in Settings ▸ Activity, and you can clear it at any time. Erase All Data in the Mac app’s Settings ▸ Advanced deletes everything the Mac app keeps, together with its data in iCloud and on every paired device.

A phone or iPad keeps a Mac’s data only while it is paired with that Mac. When a pairing ends — from either side — the device deletes that Mac’s status, journal copy, keys, commands and notifications; once no Mac is paired it deletes everything above except the record of tips.

3. What goes through iCloud, and when

Nothing goes anywhere until you turn on iPhone sync in the Mac app and pair a device. From then on, the apps use CloudKit, Apple’s iCloud service, in the private database of the iCloud account both devices are signed in to. Data written there:

  • the Mac’s device record (hardware name, model, macOS version, app version, user account name and full name — so two accounts on one machine can be told apart);
  • the Mac’s latest status (whether it is awake or idle, why it is being kept awake, a timer deadline, the name of an agent task, when input was last seen, when the Mac was last seen, whether it is asleep, and — when remote-access monitoring is on — which remote sessions are under way: the tool, the port and when each began, never the remote address);
  • a mirror of the Mac’s activity journal, in which a remote connection carries the tool and the port but not the remote IP address;
  • pairing records, commands you send from the phone and their results;
  • alert records that become push notifications on your phone.

Every command is signed by your phone and checked by your Mac, and every status and journal record is signed by your Mac and checked by your phone; anything unsigned or wrongly signed is refused. The records themselves are not end-to-end encrypted by AtControl. They are stored and transported under Apple’s iCloud security, in your account, and Apple’s iCloud terms and privacy policy govern that service. We do not operate iCloud and have no access to your iCloud data.

Push notifications for alerts are delivered by Apple’s notification service. The text of an alert (“Someone is using your Mac.”, “The timer on your Mac changed.”, and so on) is composed on your phone; the push carries the alert record’s fields, including the Mac’s name.

Data stays in your iCloud database only while a device is paired and syncing. Unpairing from either side revokes the other side’s access immediately and deletes what that device left there; when the last device is unpaired, or iPhone sync is turned off in the Mac app, the Mac deletes all of its data from your iCloud database. While a pairing lasts, commands are deleted a day after they were answered, alerts after two days and pairing requests after an hour; the journal mirror stays for as long as the pairing does. Unpairing does not erase the Mac’s own journal.

4. What the apps never do

  • No analytics, usage statistics or crash reports are sent to us or to anyone. The apps contain no advertising identifiers and no third-party tracking or advertising SDKs.
  • No account with us, no sign-in, no email address collected.
  • The Mac app is sandboxed and makes no network connections of its own; iCloud, notifications and App Store purchases are handled by macOS system services. It carries macOS’s outgoing-connections permission only because the system tool it runs to read the Mac’s connection list for remote-access monitoring (nettop) requires one; neither opens a connection.
  • The tip jar collects no message from you. Apple’s App Store processes the purchase.

5. AI agents (agent mode)

If you connect an AI coding agent, the agent talks to AtControl through macOS Shortcuts or an atcontrol:// link on the same Mac. AtControl runs no service on the internet for this. Be aware that the setup message you copy from AtControl (“Copy for Your Agent”) contains your capability token only if you have switched on agent deeplinks and set them to require it, and that a cloud-based agent sends its conversation to its provider — so that token, and the task names your agent registers, are seen by that provider under its privacy terms, not ours. AtControl never writes into your agent’s files; the agent sets itself up and tells you what it did.

6. Permissions the apps ask for

  • Notifications (Mac): only when you turn on remote-access monitoring, to tell you about a connection. (Phone): for alerts you choose.
  • Camera (phone): only while scanning a pairing QR code. No image is stored or sent.
  • Apple Events to the login window (Mac): only to shut the Mac down when you or an agent asked for it.
  • Each permission is used only for the feature you enabled, and you can withdraw it in System Settings or iOS Settings at any time.

7. This website

atcontrol.app is a static site. It sets no cookies and runs no analytics. It is hosted on Cloudflare Pages: to deliver and protect the site, Cloudflare processes the technical data of each request, such as the IP address and browser type, under Cloudflare’s privacy policy. We do not use that data to identify or follow visitors. TestFlight sign-up happens on Apple’s site under Apple’s terms.

8. Children

The apps are utilities for Mac owners and are not directed at children. We collect no data from anyone.

9. Your rights

Where data-protection law (for example the GDPR) gives you rights of access, correction, deletion, portability or objection, those rights apply to data we hold — and we hold none. The data the apps process is on your own devices and in your own iCloud account, where you can inspect, export (Settings ▸ Activity ▸ Export on the Mac) and delete it yourself. If you believe we have processed your personal data, write to support@atcontrol.app; you may also complain to your data-protection authority.

10. Changes

We will update this page when the apps’ data handling changes — for example if a relay service is ever introduced — and change the date at the top. The apps link here from their About screens.

11. Contact

Tomasz Klocek · Wrocław, Poland · support@atcontrol.app