Privacy Policy — Postern · Varlextech Limited

This Privacy Policy applies to the mobile application Postern (Android package name / iOS bundle identifier com.varlextech.postern, the "App"), developed and published by Varlextech Limited ("Varlextech Limited", "we", "us", or "our"). It explains what information the App handles, how it is used, and the choices you have.

Postern is a companion client to the Postern desktop application. The App connects directly to your own computer — over your private network or your own tunnel (e.g., VPN, Tailscale) — so you can watch and control AI coding agents running on that machine. There is no cloud relay and no account.

By installing or using the App, you agree to the practices described in this policy. If you do not agree, please do not use the App.

1. Summary

The App connects directly from your phone to your own computer. Varlextech Limited operates no servers that the App contacts and does not itself collect, transmit, or store your personal data.
Pairing details (your computer's address and pairing code) are stored locally on your device only.
The App contains no advertising, no analytics, no tracking, no crash reporting, and no in-app purchases.
You can remove all data the App stores by using "Unpair", clearing the app's storage, or uninstalling it.

2. Information stored on your device

Postern saves the following data locally on your device (in app-private storage) so it can reconnect to your computer:

Paired computer details — the network address (host/IP and port) of each computer you have paired with, and the 8-digit pairing code or custom password you entered for it.
App preferences — such as your language and display preferences.

This data never leaves your device except to establish the connection to the computer you designated. It is not accessible to Varlextech Limited and is deleted when you tap "Unpair", clear the App's data, or uninstall the App.

3. Data that transits the connection

When connected, the App exchanges the following with your own computer over a direct WebSocket connection:

Session content displayed to you — agent conversations, thinking output, actions in progress, and files changed, streamed from your machine to your phone.
Commands you send — approvals, rejections, stop requests, queued commands, model and agent/session selections, and instructions you type.
Attachments you pick — images or files you explicitly choose via the photo or file picker are sent to your own computer to accompany your instructions.

All of this traffic flows only between your phone and the computer address you entered. The App refuses public internet addresses; it only connects to private (LAN) addresses or private addresses reachable through your own tunnel. Varlextech Limited is not a party to this connection and cannot see any of it.

Your responsibility: if you expose your computer's Postern service through your own tunnel or network configuration, the security of that path (encryption, access control) is under your control. The pairing code is the credential that protects your computer — keep it private and rotate it in the desktop app if it may have been shared.

4. Information Varlextech Limited does not collect

We do not ourselves collect, request, or have access to:

Your name, email address, phone number, or contacts
Account credentials (the App has no sign-up or login)
Precise location, photos, microphone, camera, or files — except content you explicitly pick to send to your own computer (see Sections 3 and 5)
Your code, prompts, agent conversations, or any session content
Payment card details (the App contains no purchases; licenses are sold separately on the Postern website — see Section 6)
Any analytics or telemetry — the App includes no Varlextech Limited-operated or third-party analytics, advertising, tracking, or crash-reporting SDK

5. Device permissions

The App requests the following permissions solely to provide its features:

Camera — used only to scan the pairing QR code shown by the desktop app. No images are recorded, stored, or uploaded.
Local network / Internet — used to discover and connect to your computer on your private network and to open the WebSocket connection. (On Android, the App permits cleartext HTTP because the connection runs on your private network.)
Photo library / file picker — accessed only when you tap to attach an image or file; the selected item is sent to your own computer and nowhere else.

6. Third-party services

The App embeds no third-party SDKs that collect data — no advertising networks, no analytics providers, and no purchase frameworks.

The only third parties involved are:

Google Play / Apple App Store — the store you downloaded the App from handles distribution, app updates, and any crash logs you choose to share with the store under your device settings. These are governed by the store's own privacy policies.
Your own infrastructure — the connection target is a computer (or tunnel endpoint) that you control, not a Varlextech service.

License purchases (outside the App). Postern desktop licenses are sold on the separate Postern website. Purchases there are processed by Stripe (card payments) or confirmed on public blockchains (stablecoin payments), license records are held on Cloudflare, and license emails are sent via Resend — none of this happens inside the App. That website flow is covered by its own privacy policy.

Google Play Terms: https://play.google.com/about/play-terms/
Apple Media Services Terms: https://www.apple.com/legal/internet-services/itunes/

7. How information is used

Core functionality — remembering your paired computers so the App can reconnect, and relaying your commands and your computer's session content between your phone and your machine.
Attachments — delivering files/images you choose to your own computer.

For users in the EEA/UK, the legal basis for processing the limited data stored on your device is performance of the contract (providing the connection features you request). Varlextech Limited performs no processing of your personal data on its own systems through the App.

8. Data sharing and sale

Varlextech Limited does not sell your personal information and does not share data with third parties for their own marketing. The App transmits data to no one other than the computer you pair it with.

9. Data retention and deletion

All data the App stores remains only on your device and is erased when you use "Unpair" for a computer, clear the App's storage, or uninstall the App. Data held on your computer (such as the desktop app's local audit log of approvals and messages) is governed by your own retention of that machine and can be removed there. Varlextech Limited holds no App data about you, so there is nothing on our side to delete.

10. Your rights and choices

Depending on where you live, you may have rights over your personal data, including the right to access, correct, delete, restrict or object to processing, data portability, and to withdraw consent.

Delete your data: use "Unpair" in the App, "Clear data"/"Clear storage" in your device's app settings, or uninstall the App — this removes all locally stored pairing and preference data.
Control pairing: rotate the pairing code in the desktop app at any time to disconnect every paired phone.
Permissions: revoke camera, photo, or local network access in your device settings (pairing by typing the address and code manually still works without the camera).
Contact us: for any privacy request or question, email varlextechltd@gmail.com. We respond within a reasonable time and will not discriminate against you for exercising your rights.

EEA/UK users may also lodge a complaint with their local data protection authority.

11. Children's privacy

Postern is a developer tool intended for adults and is not directed at children under 13 (or the applicable age of digital consent in your region). We do not knowingly collect personal information from children, and the App transmits no personal information to us at all.

12. Security

The App refuses public internet addresses and only connects to private network addresses or private endpoints on your own tunnel, keeping your session traffic off third-party infrastructure. Access to your computer is gated by the 8-digit pairing code (or your custom password), which is stored on your device only. Because connections run over your private network, traffic may be unencrypted HTTP within that network — use your own encrypted tunnel (VPN, Tailscale) when connecting from outside. The primary safeguards on your phone are your device's own security (device lock, OS sandboxing).

13. International data transfers

Varlextech Limited transfers no data internationally through the App, because the App sends us no data. If you purchase a license on the Postern website, the processors involved (Stripe, Cloudflare, Resend) may process data in the United States and other countries under the safeguards described in their own privacy policies.

14. Changes to this policy

We may update this Privacy Policy from time to time. Any changes will be posted at this URL with an updated "Effective date". Your continued use of the App after changes take effect constitutes acceptance of the revised policy.

15. Contact us

If you have questions about this Privacy Policy or the App's data practices, contact:

Varlextech Limited
Email: varlextechltd@gmail.com