Privacy and security
Privacy and security
RepoGo is built so you don't have to trust us with your work.
Your data stays on your computer#
- No account. RepoGo doesn't ask you to sign up or sign in.
- Chats and code live on your computer. The host keeps them there. RepoGo's servers don't store chat or code content.
- Your agents run as you. The host runs the Claude Code and Codex you already have, with your own sign-in. Any charges from them stay between you and Anthropic or OpenAI.
End-to-end encryption#
Your phone and your computer talk through RepoGo's relay, and everything between them is end-to-end encrypted. The relay forwards bytes it can't read. You can also run your own relay.
- When you pair, your phone and your computer exchange identities by scanning the code.
- Every connection then runs a fresh handshake, and each side checks the other is the device it paired with before anything is sent.
- The key exchange includes a post-quantum step (ML-KEM-1024), and messages are sealed with AES-GCM.
The host never listens on your network. It only accepts connections from the same machine (127.0.0.1) and reaches the relay by dialing out.
Credentials stay on your devices#
Keys you give the app, your OpenAI API key for voice and your Vercel credentials, are kept in your Keychain and sync with iCloud Keychain. Your phone uses them to call OpenAI and Vercel directly; they never reach RepoGo's servers.
You choose what goes to AI providers#
The first time you send a chat to Claude or Codex, or start voice, RepoGo asks whether to allow that company to receive your data, and lists what's sent. Review or withdraw those permissions any time in Settings → Profile → AI & Privacy.
You decide who can connect#
Every paired device is listed by npx @repogo/host devices. Revoke one with npx @repogo/host devices revoke <id> and it can no longer reach your computer.
A few actions, such as starting a new pairing, only work from the computer itself. They're refused over the relay, so a paired phone can't add more devices on its own.
Read the code#
The host is source-available at github.com/repogoapp/host, so you can read exactly what runs on your machine.