Privacy Policy

This policy covers Wand’s website, account dashboard and Mac app. Wand is operated by Thabhelo Duve. Questions or data requests can be sent to Wand support.

This website

Cloudflare hosts the site and processes connection information needed to deliver it. Its analytics script measures page visits and loading performance. The script does not use cookies or browser storage. See Cloudflare’s analytics data and privacy details.

Our account dashboard uses Firebase Authentication. You can sign in with Google, or create an account with an email address and password. Facebook is not offered for new public sign-ins. If you choose a password, Firebase Authentication keeps it in hashed form and Wand’s own servers never receive it. We email you a link to confirm your address, and a password account cannot connect a Mac or approve Muse until that link is opened. We also email you a reset link if you ask for one. You can add a second sign-in method in Account settings. Wand never joins two accounts just because their email addresses match. Your chosen provider processes your sign-in details under its own privacy terms. Wand uses your Firebase account ID to connect your devices and stores your sign-in session in your browser. Signing in does not give Muse permission to control a device.

Support messages

When you use our support form, we send your name (if provided), email address, topic and message to Wand’s support inbox through Cloudflare. We use these details to answer your request. Messages stay in our support mailbox until deleted; you can ask us to delete them through the support form. We do not publish your message or use your email for marketing.

Connecting a Mac

The connection flow uses a short-lived pairing code. The dashboard can hold that code in tab-scoped session storage for up to ten minutes while you sign in. Long-lived device credentials are stored in the Mac’s Keychain. The relay stores only their hashes.

Allowing Muse

A separate permission screen lets you choose which Macs and actions an approved connector can use. Wand stores this permission until you disconnect it or delete your Wand data. Connection requests expire after ten minutes. You can disconnect Muse in the dashboard without disconnecting your Mac from Wand.

Commands and history

The relay sees command contents while routing them. End-to-end payload encryption is not implemented. The relay audit records command metadata with parameters redacted. Read-state results are held briefly for retrieval. The Mac’s private local command log retains full parameters for investigation; state response contents are not added to that log.

The current retention policy purges relay command/audit records after 90 days. Local logs are bounded to 90 days and 10 MiB. Account deletion removes active Wand service records and revokes its device tokens; it does not automatically delete a hosted sign-in identity or external backups.

Delete your Wand data

Sign in at app.getwand.app, open Settings, choose “Delete my Wand data…” and confirm. This disconnects all Macs, revokes their tokens and removes your Wand service records. It does not delete your Google or Facebook account, your Firebase sign-in identity, or logs stored locally on your Mac.

Current controls

No remote unlock, camera or microphone access, or arbitrary shell endpoint. Window images and keyboard input are available only in optional desktop-control sessions described below. Approved Apple Shortcuts can themselves execute code: approve only Shortcuts you trust.

Requests for your data

Wand is run by one developer, who reviews every request for user data personally. We act only on valid legal process addressed to Wand, such as a subpoena, court order or warrant. We do not act on informal requests. We check each request for legal validity, jurisdiction and scope, and we push back on or refuse requests that are overbroad or unclear. We share only the minimum the process requires, and we tell the affected person first unless the law forbids it. We keep a record of each request and our response. Requests from private third parties are treated the same way and are refused without valid legal process or your consent.

What we could share is limited to what our servers hold: account identifiers, email addresses, device names, connection records and command history entries without command details or screen content.

Contact and changes

For privacy questions or help deleting your data, contact Wand support. We will update the date on this page when the policy changes and give notice of material changes through the service.

Optional desktop control

If you enable desktop control in Wand, apps’ visible text and optional window images pass through our relay to the caller. This is separate from the minimal Mac status feature. Desktop consent stays enabled across restarts until you pause it or revoke the connection. Lock, sleep and user switching suspend control; it resumes only in your unlocked active session. Window images and observations are transient results, not saved to the cloud audit log. The Mac’s private local command log may include text entered by desktop actions; it is kept for up to 90 days with a 10 MB size cap. Desktop access covers apps across your Mac. Pause it before opening information you do not want to share. GUI actions can modify files or run code in capable apps. This mode is experimental and may make mistakes.

When you load the app picker, Wand reads installed app names, identifiers, available last-opened dates and running status from your unlocked Mac. The list passes through the relay temporarily and stays only in memory in your browser; it is not stored in the cloud audit log.

When you request Mac status, an unlocked Mac can also report storage capacity, approximate memory use, macOS version, time since restart, Low Power Mode and thermal condition. These readings are returned temporarily to show your Mac’s status, not stored in the cloud audit log.