PRIVACY NOTES · SEPTEMBER 20, 2026

Small footprint.
Clear boundaries.

Wand is an independent project in development. These notes describe this website and the intended behavior of the current preview; they are not a claim that a public remote-control service has launched.

This website

The public site has no advertising trackers, analytics scripts or mailing-list form. Cloudflare hosts the site and processes connection information needed to deliver it. Our account dashboard uses Google sign-in through Firebase Authentication. Google processes your sign-in details under its own privacy terms. Wand uses your Firebase account ID to connect your devices and stores your sign-in session in your browser. Signing in does not give Muse permission to control a device.

Connecting a Mac

The connection flow uses a short-lived pairing code. The dashboard can hold that code in tab-scoped session storage for up to ten minutes while you sign in. Long-lived device credentials are stored in the Mac’s Keychain. The relay stores only their hashes.

Allowing Muse

A separate permission screen lets you choose which Macs and actions an approved connector can use. Wand stores this permission until you disconnect it or delete your Wand data. Connection requests expire after ten minutes. You can disconnect Muse in the dashboard without disconnecting your Mac from Wand.

Commands and history

The relay sees command contents while routing them. End-to-end payload encryption is not implemented. The relay audit records command metadata with parameters redacted. Read-state results are held briefly for retrieval. The Mac’s private local command log retains full parameters for investigation; state response contents are not added to that log.

The current retention policy purges relay command/audit records after 90 days. Local logs are bounded to 90 days and 10 MiB. Account deletion removes active Wand service records and revokes its device tokens; it does not automatically delete a hosted sign-in identity or external backups.

Limits by design

No remote unlock, screenshots, camera or microphone access, keystroke entry or arbitrary shell endpoint. Approved Apple Shortcuts can themselves execute code: approve only Shortcuts you trust.

Before public release

A finalized privacy policy, operator contact and support channel will be published before public account onboarding and downloads are enabled.