burrow

Privacy

Last updated: 2026-05-08

Burrow is a phone-to-home-machine bridge for Claude Code. Your prompts, replies, and conversation history live on your hardware. The relay (this server) is dumb plumbing that forwards bytes between your phone and your worker; it doesn't keep a copy.

What we store on the relay

  • Your email, so we can send you magic-link sign-in URLs.
  • A session cookie after you sign in (HttpOnly, Secure, SameSite=Lax). Stored as an HMAC-SHA256 hash, not the raw token — DB leaks don't grant logins.
  • A worker token per home machine you register, also stored as a hash. Separately, optional push tokens for scheduled jobs that inject notifications into your chat.
  • Your Web Push subscription (browser-supplied endpoint + keys), used solely to wake your phone when Claude finishes a reply.

What we deliberately don't store on the relay

  • Prompts and replies are buffered in RAM for up to 5 minutes (or 1 MB per conversation, whichever first) so a phone that briefly disconnects can catch up. Past that window they're discarded. The relay never writes prompts or replies to disk.
  • No long-term conversation history. Your home worker keeps a local JSONL archive of your conversations on a disk you control. Burrow's servers do not have a copy.
  • No analytics, no third-party trackers, no ad networks.

Third parties

  • Resend sends the magic-link emails. The email body contains a single sign-in URL that expires in 15 minutes.
  • Browser push services (Apple, Google, Mozilla) deliver the Web Push notification when the worker finishes. They see only the timestamp + the truncated body the relay sends ("Your reply is ready.").
  • Anthropic / your chosen model provider. The worker runs Claude Code under your account — your prompts and replies pass through their infrastructure under their privacy terms, not ours. If you've configured Bedrock or Vertex, those providers see the traffic instead.

Cookies

One cookie: burrow_session. HttpOnly, Secure, SameSite=Lax. 30-day sliding expiry. Used to identify your account; cleared on sign-out.

Deletion

Email samyu66@gmail.com and we'll wipe your row + push subscriptions + worker tokens from the relay's database. The conversation history on your home worker is yours to delete locally — it never left your machine.

Changes

If anything material changes here, we'll bump the "Last updated" date and email signed-in users.