Lathe Companion Privacy Policy

Effective date: October 22, 2026

Lathe Companion is operated by Chris Paterson ("we," "us," or "our"). This policy explains how information is handled by the Lathe Companion mobile app, its companion relay service, and this privacy website. Contact us at support@fl0-dev.com.

At a glance

• Your phone connects to a desktop Lathe installation that you choose and approve.
• Conversation messages and development content are encrypted between your phone and desktop. The relay routes encrypted messages and does not have the keys needed to read them.
• The relay processes connection and device metadata. Optional notifications use Expo and your platform's push notification service.
• The app does not include advertising or cross-app tracking. RevenueCat processes subscription information for billing, access management, and subscription analytics. We do not sell personal information or share it for targeted advertising.

Information the app handles

Pairing and settings. The app generates an installation identifier and cryptographic keys. It stores pairing records, desktop identifiers and names, relay addresses, keys, notification preferences, and appearance preferences using the operating system's secure storage. Your device name or model name is sent during pairing to identify the phone to your desktop.

Conversations and development content. To display and continue your threads, the app receives workspace names and paths, thread titles and identifiers, messages, tool activity, code change previews, and requests for approval or input. It sends messages, approval decisions, and other actions you choose back to your desktop. This content is held in app memory for the current session rather than saved as a transcript database by the mobile app. Desktop Lathe and your agents may retain their own history.

Relay metadata. Our Cloudflare-hosted relay handles desktop and device identifiers, device names, public authentication keys, connection status, routing information, encrypted message payloads, and operational counters used for security and rate limits. When you enable notifications, it stores your push token and notification preferences. Conversation payloads are forwarded rather than stored as a relay transcript archive.

Network and support information. Hosting and network providers process IP addresses, request times, and other technical connection information to deliver and protect the service. If you contact support, we receive your email address and any information you choose to send. Please avoid sending passwords, API keys, or confidential source code.

Subscriptions and RevenueCat billing

RevenueCat helps us process and validate subscriptions purchased through Apple App Store or Google Play, restore purchases, and determine access to paid features. The app sends RevenueCat an installation-based app user identifier, purchase receipts or purchase tokens, product and transaction identifiers, purchase and renewal dates, subscription status, store, price and currency information, and technical information needed to operate its SDK, such as app and operating system versions. We use this information for app functionality, subscription support, fraud prevention, and subscription analytics. Our relay checks subscription entitlement status with RevenueCat and receives subscription events through its webhook.

Apple or Google handles payment details. We do not receive your full payment card number through the app. We do not send your conversations or source code to RevenueCat or set your name or email address as RevenueCat customer attributes. RevenueCat's privacy practices are described at RevenueCat Privacy Policy.

Subscription records are retained as needed to provide and restore purchases, handle refunds and disputes, and satisfy legal or accounting obligations. Unpairing or uninstalling does not automatically delete billing records or cancel a subscription. Manage or cancel subscriptions in your Apple App Store or Google Play account. To request deletion of the app identifier and associated subscription data we control, email support@fl0-dev.com; we will help identify your records and process the request, including records in RevenueCat, subject to applicable retention requirements. Apple and Google handle deletion requests for information they control under their own policies.

Camera and notifications

Camera access is used to scan the pairing QR code displayed by Lathe. The app does not record or upload camera images or video. The pairing information decoded from the QR code is used to connect to your selected desktop.

Push notifications are optional. If enabled, the relay sends your push token, generic activity text, desktop and thread identifiers, and an event type to Expo's push service for delivery through Apple Push Notification service or Firebase Cloud Messaging, as applicable. Notifications do not contain conversation text or code. Notification identifiers and event types are metadata and are not covered by conversation encryption.

You can manage notification types in the app and revoke camera or notification permission in your device settings. Core pairing and thread features do not require notification permission.

Why we process information and who receives it

We use information to pair and authenticate devices, deliver messages and notifications, display your threads, apply your choices, prevent abuse, maintain the service, and respond to support requests.

Cloudflare provides relay and website hosting. Expo and platform push services deliver optional notifications. Our email service handles support correspondence. These providers process the information necessary for their functions under their own terms and privacy practices. Information may also be disclosed when required by law or reasonably necessary to address fraud, abuse, or threats to security.

Lathe Companion does not directly send your conversations to an AI model provider. Actions sent to desktop Lathe may cause your configured agents, tools, or AI providers to process prompts, files, or other content. Their policies, settings, retention rules, and age requirements apply separately. This policy does not describe all data handling by the desktop editor, its update service, extensions, or third-party agents.

Retention and deletion

Local pairing records and preferences remain until removed through the app or applicable device storage controls. Secure storage may persist across reinstallations on some platforms. Removing the app alone should not be relied on to revoke a paired device.

Use the app's unpair option while connected, or revoke the phone from desktop Lathe, to remove the relay's paired-device record, including its stored push token. If you unpair while the desktop is unreachable, revoke that phone from the desktop when available. These actions do not delete your desktop conversation history or records held by AI providers.

Other relay state, such as desktop identifiers and rate-limit counters, may remain after a device is revoked. Hosting providers may retain operational records under their own retention practices. We retain support correspondence as needed to handle your request and meet applicable obligations. Contact support@fl0-dev.com to request deletion of information we control; we may need information sufficient to verify and locate the relevant records. We do not have the keys needed to retrieve or delete content held only on your own devices.

Your choices and rights

You choose which desktops to pair and which messages and actions to send. You can revoke pairings, change notification preferences, and manage operating system permissions. Depending on where you live, you may have rights to access, correct, delete, restrict, or obtain a copy of personal information, object to certain processing, or complain to a data protection authority. Contact us to exercise applicable rights.

Security and international processing

We use encrypted transport, message encryption between paired endpoints, and operating system secure storage to protect information. Encryption does not protect content on a compromised phone or desktop, or content processed by an agent or tool after delivery. No system can guarantee absolute security.

Our infrastructure and service providers may process information in countries other than your own. Applicable privacy protections may differ by location.

Children

Lathe Companion is a general-purpose developer tool and is not designed specifically for children. An App Store content rating does not override the minimum age or parental permission requirements of connected AI services. If you believe a child has provided personal information to us inappropriately, contact support@fl0-dev.com so we can investigate and address it.

This website and policy updates

This privacy page does not use advertising, analytics scripts, cookies, or external fonts. Cloudflare processes the technical request information needed to serve and secure it. This statement covers this privacy website, not other websites on the lathe-ide.com domain.

We may update this policy as the service changes. We will publish the revised policy here and update its effective date. For material changes, we will provide additional notice where required.

Contact

Chris Paterson — Lathe Companion

Email: support@fl0-dev.com