Privacy Policy · Moru

This policy explains what the Moru account, the Moru Mac app, the Moru phone app, Spill and getmoru.com keep on your devices, what they send, and how you delete it.

• Moru, the Moru phone app, Spill and getmoru.com are run by Taehwan Kwon. Questions and requests can be sent to taehwan@thdev.net.

• You sign in with Apple or Google. We receive an account identifier, your email address (with Sign in with Apple this can be a private relay address) and a name from that provider, and we keep the display name you choose and which sign-in methods are linked to the account.
• Accounts are stored with Supabase. On getmoru.com your session is kept in secure, HttpOnly cookies; on the phone it is kept in the iOS Keychain or the Android Keystore.

• Projects, Tasks, terminal sessions and results stay on your Mac. The coding agents you run send what they send to their own model providers under those providers' terms; Moru does not send that content to us.

• The phone app reaches your computers through relay.getmoru.com. Your phone and computer agree on keys when you scan the pairing code, and everything between them is end-to-end encrypted, so the relay cannot read prompts, answers, terminal output, files or photos. It forwards encrypted messages and keeps no copy; when the other device is offline the message is not delivered.
• To route messages the relay keeps, for each device, a random device id, whether it is a computer or a phone, the device name shown in the app, the devices it is paired with, and for a few minutes a hash of a pairing code. For phones it also keeps the Apple (APNs) or Google (FCM) push token. The relay does not keep your email or account id; it links your phones by a hash of the account id. Like any network service it can see device ids, timing and message sizes.
• Notifications are sealed on your computer for your phone. Apple and Google deliver only the encrypted bytes, and the phone opens them with a key that never leaves it.
• The phone keeps its keys and pairings in the iOS Keychain or the Android Keystore. It uses the camera only to scan the pairing code your computer shows, and Face ID or your fingerprint only on the phone, to unlock the app. The usage view reads the Spill summaries of your own account.

• To count tokens accurately, Spill's local adapter reads your AI tool's own local log or transcript file on your Mac (for example, Claude Code's transcript JSONL). This file never leaves your Mac through Spill.
• Spill opens that file only to find the exact token counts for the latest turn. The numeric token counts, model id, and a safe workflow label are kept; the raw prompt text, generated response content, file paths, and everything else in that file are discarded immediately and are never written to disk, queued, or sent anywhere by Spill.

• Moru, the phone app and Spill do not send us prompt text, generated response content, commands, file paths, logs, diffs, source content, environment values, or secrets.
• Spill's usage summaries contain aggregate counts and safe workflow labels only when those exact values are reported by the local app or AI tool.

• Raw usage collection starts on the Mac. Syncing is optional: a connected Mac uploads daily usage summaries and device metadata to your account. The detailed usage buckets are encrypted with a key held in your browser; the summaries the dashboard and the phone show carry totals per tool, model, task type and stage, and daily limit percentages, never prompts, commands, paths or source.
• The web dashboard checks a lightweight revision marker before downloading encrypted summaries, so unchanged data can stay in the browser cache.

• Supabase (account, sign-in and Spill sync storage), Cloudflare (the relay), Vercel (getmoru.com), Apple (Sign in with Apple and push notifications) and Google (Google sign-in and push notifications). They process data only to provide these parts of the service.

• Product analytics, when enabled, are limited to product events such as sign-in, dashboard opening, device connection, refresh, and deletion flows.
• Analytics, diagnostics and logs on every side record kinds of actions and their results, never prompts, responses, commands, file paths, logs, source content, environment values, secrets, terminal output, attachments, or raw encrypted payloads.

• You can delete your account yourself on getmoru.com under Account, or in the phone app's settings. Deletion removes your account and its linked sign-ins, your Spill devices and summaries, and your relay devices. The phone app then removes its pairings and keys, and your computers drop the phone the next time it tries to reach them. If you own a team that still has members, remove them first.
• Removing a device stops it at once: the relay refuses its next request. Data kept only on your Mac stays there until you delete it or the app. You can also ask for deletion at taehwan@thdev.net.

• We will update this policy as the products change and show the date above. Material changes will be announced in the apps or on getmoru.com before they take effect.