Boardglance Privacy Policy

Effective date: 2026-10-18

Boardglance is an iPhone app made by shipthecontext, an independent studio. It works with Paperclip, the self-hosted platform for teams of AI agents. Boardglance is not made by or affiliated with the Paperclip project.

This policy covers three pieces:

• the Boardglance iPhone app (including the small part of the app that shows notifications),
• the Boardglance bridge, an open source program you can run next to your Paperclip server,
• the Boardglance relay, a small service we run to deliver notifications.

The short version

• By default, we collect nothing. The app talks straight to your own Paperclip server. Your Paperclip data never comes to us.
• There are no accounts, no analytics, no ads, no tracking and no third party SDKs.
• If you turn on notifications, your iPhone's push token is sent to our relay so alerts can reach you. The alerts themselves are encrypted, and the relay cannot read them.
• Apple handles all payments.

The app

What stays on your iPhone

• Your server list. The name and address of each Paperclip server you add, and which company you picked. This is kept in the app's own settings on your iPhone.
• Your board API keys. Kept in the iOS Keychain, on this iPhone only. They are not synced to iCloud Keychain. If your server runs in local trusted mode, you can leave the key empty and nothing is stored.
• Your notification keys. If you turn on notifications, the app creates an encryption key on your iPhone and keeps it in the Keychain, on this iPhone only.
• Your relay registration and Pro status. The device ID and push secret the relay gave this iPhone, the last pairing code, and whether Pro is on. Kept in the Keychain on this iPhone only.
• The relay address, if you change it in the notification settings.

Who the app talks to

• Your Paperclip server. The app sends your board API key to your server and reads your inbox, agents, work and spend from it. When you approve, decline, ask for changes, or pause or resume an agent, the app sends that to your server. This goes directly from your iPhone to your server. It does not pass through us.
• Apple, for purchases and, if you turn them on, for notifications.
• The Boardglance relay, only if you turn on notifications (see below).

Face ID and passcode

The app asks for Face ID or your passcode before you approve a request. iOS checks it and only tells the app whether it worked. The app never sees your face data or your passcode.

Demo mode

Demo mode uses sample data built into the app. Nothing is sent anywhere.

Notifications (optional)

Notifications are off until you turn them on. Here is what happens when you do.

1. The app asks iOS for a push token. This is a code Apple uses to deliver notifications to this app on this iPhone.
2. The app sends the push token to the relay, together with whether it is a test or a live build and the app's identifier (app.boardglance.ios).
3. The relay creates a random device ID and a random push secret, and sends them back to your iPhone.
4. Your iPhone creates a 256 bit encryption key and keeps it in the Keychain.
5. The app shows a pairing code. It contains the relay address, the device ID, the push secret, the encryption key and your iPhone's name as iOS reports it (usually just "iPhone"). You give this code to the bridge on your own computer. The pairing code is never sent to us.

From then on, the bridge checks your Paperclip server every 30 seconds. When something needs you, it encrypts the alert on your computer with AES-256-GCM, using the key from your iPhone, and sends the encrypted alert to the relay. The relay passes it to Apple, Apple delivers it to your iPhone, and your iPhone decrypts it.

What the relay stores

• your push token,
• the random device ID,
• a hash of the push secret (not the secret itself),
• whether it is a test or a live build, and the app identifier,
• when the record was created and last updated,
• an hourly count of alerts for each device ID, used only to stop abuse. Old counts are removed as new alerts arrive and when the device record is deleted.

The relay does not store alerts. It passes each one to Apple and keeps nothing.

What the relay can see

• the encrypted alert, which it cannot read,
• a short label the bridge attaches so a newer alert replaces an older one about the same thing. The label holds the type of alert (for example "approval"), Paperclip's internal ID for that item and, for budget alerts, the month. It does not include names, titles, amounts or any text,
• the network address (IP address) of your iPhone when it registers, and of your bridge's computer when it sends an alert, as with any web request. The relay does not save these.

What the relay cannot see

• what your alerts say,
• your Paperclip server's address, your board API key or any of your Paperclip data,
• your encryption key. Only your iPhone has it, and you put it on your bridge yourself.

Where the relay runs

The relay runs on Cloudflare Workers, and its records are kept in Cloudflare's database service. Cloudflare handles network traffic to the relay as part of running it. We keep Cloudflare's request logging for the relay turned off. Notifications are delivered by Apple Push Notification service.

Using your own relay

By default the app uses our relay at https://boardglance-relay.shipthecontext.workers.dev. The App Store version always uses this relay.

The bridge

The bridge is open source (MIT) and runs on your own computer, next to Paperclip. It:

• reads your Paperclip server, using a board API key you give it if your server needs one,
• keeps its settings in a folder on your computer (by default ~/.boardglance-bridge), readable only by your user account. This holds the paired iPhones (relay address, device ID, push secret, encryption key and iPhone name) and a list of alerts it has already sent, so it does not send them twice,
• sends only encrypted alerts to the relay.

The bridge sends nothing else to us. It has no analytics.

Payments

Boardglance Pro is sold through Apple. Apple processes the payment, and the app checks with Apple on your iPhone whether you have Pro. We never see your card or payment details, and Apple does not give us your name or email address.

Tracking

Boardglance does not track you. It does not use the advertising identifier, does not follow you across other apps or websites, and does not sell your data or share it for advertising.

Deleting your data

• Turn off notifications. Settings > Notifications > Turn off notifications asks the relay to delete your device record right away and deletes the key on your iPhone.

• Remove a server. In Settings, under Servers, swipe left on the server and tap Remove. This deletes it from the app, deletes its board API key from the Keychain and deletes its notification key. Without that key, alerts for that server can no longer be read on this iPhone. Removing a server also asks the relay to delete the device record for it. If the relay cannot be reached, the app tries again the next time it opens. The token expiry and the email route below remain as fallbacks.
• Unpair the bridge. On the computer running the bridge, run npx -y --package=https://boardglance.pages.dev/bridge.tgz boardglance-bridge devices to see the device ID, then npx -y --package=https://boardglance.pages.dev/bridge.tgz boardglance-bridge unpair <deviceId>. The bridge stops sending alerts to that iPhone.
• The relay record. The relay deletes a device record when Apple reports that the push token is no longer valid, for example after you delete the app and the next alert is sent. To have it deleted sooner, email support@boardglance.app with your device ID and we will delete it.
• Delete the app. This removes the app's settings and server list. iOS can keep Keychain items after an app is deleted, so remove your servers first if you want the keys gone too.

Changes to this policy

If this policy changes, we will update it here and change the effective date at the top.

Contact

Questions about privacy, or a deletion request: support@boardglance.app