What our servers hold
As of 29 October 2026. This page changes when the list does, before the change ships.
Macarun runs your CI jobs on your Macs. A small service of ours, the control plane, keeps your team's hosts in one view, relays the actions you take from the apps, and delivers each Mac's license. It is never in the path of a job: if it is down, or gone for good, your Macs keep taking and running jobs, and you lose the fleet view and notifications until it is back.
What it never receives
- Your source code, build logs, test output or result bundles.
- Signing certificates, private keys and provisioning profiles, or any secret you give your jobs, in a form it can read.
- Your GitHub App, its private key, or any other credential for your GitHub organization.
- Your images, caches, environment variables, or paths inside a job.
What it checks but never keeps
Your team key, when a device joins with it, and each device's and host's token, on every request: the server compares them with the SHA-256 hashes it stores and keeps nothing else of them, so they cannot be recovered from what it holds.
What it holds
| What | Why | Kept |
|---|---|---|
| Your team: its name, the hash of its team key and when it was set, whether it was made by a checkout or by us, its Paddle customer ID, and, for a team we made by hand, our note of whom it is for | To know which devices, Macs and payments are yours, and to recover the team if you lose its key | While the team exists |
| Each device of the team (a Mac app or an iPhone app): the name it gives itself, its kind, whether it joined with the team key or a pairing link and which device paired it, when it joined and was last used (to the hour), the hash of its token, and when and by which device it was revoked | To let your devices in, and let you see and revoke them | While the team exists; a revoked device for 90 days after its revocation |
| Pairing links: the hash of the link's secret, the device that made it, when it expires and whether it was used | To let a new device join with a link | One day after it is used or expires |
| Each connected host: its name, Mac model, macOS version and agent version, when it connected, and the hash of its token | The fleet view | While the host is in the team, and 31 days after it is removed from the team, once its events and actions are gone. Being offline removes nothing |
| Setup codes for connecting a host: the code's hash, who made it, our note on it if we made it, when it expires, and which host used it | To let a host join your team | One day after it expires, used or not; a code lasts at most 7 days |
| Each host's latest state: when it booted and its agent started, slots and jobs in use, free and total disk, whether it is paused, why and until when, its resource budget and settings version, its runner's name, labels and image, the names of its images with their macOS and Xcode builds, its machine ID and license ID, and how many of its reports are queued or were dropped | The fleet view and its alerts, and the license that names the Mac | The latest only, replaced on every heartbeat |
| Events the host reports: that the agent started (and when the Mac booted), and that the host paused or resumed, with the reason | To tell a reboot from a restart, and show a host's recent history | 31 days after it last arrived |
| Actions sent to a host from the apps or by us (such as pause and resume): what, by which device, when, and the host's answer | To deliver them and show whether they worked | 30 days after the action expires; an action expires within 24 hours |
| Your subscription as Paddle reports it: its ID, status, items (price and number of Macs), billing period, scheduled change, and the team name and key hash from the checkout | To know what you paid for | While the team exists |
| Payments and seats: for each payment, the day it licenses through and for how many Macs; which Mac holds which seat and who gave it; each change to the subscription made from the apps (a change of the number of Macs, a cancellation, or its undoing), by which device, when, and its outcome | To license the Macs you paid for, and show the history of your changes | While the team exists |
| Each Mac's license: the machine ID, the license's ID and kind, the period it covers, the team's name if you chose to show it, and the signed file itself | So the Mac can check its license offline | While the team exists, until we remove it; releasing a seat does not remove it |
| Paddle's notifications about your subscription and payments: the fields we use from each (IDs, status, items, periods, and the checkout's team details) | To process each once, in order, and retry one that failed | 3 days after it is processed; 30 days if it could not be |
| The server's own logs: each request's method, path and status, what it did and for which team, device, host or subscription, by ID, and errors; no keys, tokens or job content; and the proxy in front of it, which logs each request's IP address, browser or client, path and status | To find and fix problems, and stop abuse | Rotated by size, five files of 10 MB at most for each, so the oldest lines go as new ones come: about five days at the traffic of 29 October 2026 |
After your team is deleted
Deleting your team removes everything above that belongs to it at once, with these exceptions:
- Kept for good: the hashes of every team key the team ever had, and the IDs of its Paddle subscriptions, so that an old key can never join or make a team again and a late notification from Paddle cannot bring a subscription back. None of them says who you are.
- The server's logs, including a line recording the deletion, until they rotate out.
- The backups: the continuous copy keeps 7 days, and each nightly copy is locked for 30 days and deleted after 31.
- What Paddle keeps as the seller, under its own terms.
Coming with the first version
Listed here before they ship:
- A record of each job, for your team's fleet view: the host, label, image (its macOS and Xcode builds and recipe version), runner version, when it was queued, started and ended, how long its VM took to boot, and its result, with a short failure signature when the host itself failed. Never its output. Kept 30 days.
- Daily summaries of those records for your team: jobs by result, durations and queue times. Kept while the team exists.
- Only if your team opts in: fleet-wide daily counts with no team or host in them, which tell us how Macarun behaves across macOS and Xcode versions. Kept for good.
- For iPhone notifications: each iPhone's push token from Apple, while the device is in the team.
- For secrets shared between your hosts: the secrets encrypted on your Macs with a key the control plane never has, so it holds only what it cannot read.
Where
The control plane runs on a server of Hetzner's in Germany. Its database is copied, encrypted, to Scaleway in Paris as it changes, kept 7 days, and once a night to Scaleway in Amsterdam, locked for 30 days and deleted after 31; a standby server at Scaleway in Amsterdam takes over if the main one fails. All of it is in the EU.
What we do with it
Run the fleet view, the apps and licensing, and help you when you ask. We do not sell it, use it for advertising, or put a third party's analytics in the agent, the apps or the site. Analysis of how Macarun is used runs on a copy of the database, never on the live server.
To ask what we hold about your team, or to have it deleted, write to support@macarun.dev. The privacy notice has the rest: who we are, your rights, and the services that see your data.
Using Macarun with nothing connected
The agent is complete on its own. A Mac that never connects to the control plane still runs jobs, builds images and keeps its caches, and checks its license offline. A Mac that never connects gets its license file from us by email and installs it with macarun license install; without one it still runs jobs, and only updates stop. It goes without the fleet view, notifications and remote actions.