The relay should know where a signal goes—not what it says.

What this notice covers

This notice covers the Transponder private-beta iPhone, Apple Watch, and Mac apps, the hosted relay, and the public website and beta waitlist.

Accounts and approved devices

The iPhone uses Sign in with Apple to establish the account owner. The relay stores a keyed digest of Apple’s account identifier rather than the identifier itself. It also stores device identifiers, names, platforms, capabilities, public agreement and signing keys, public device certificates, approval relationships, and signed revocations.

A Mac may link by QR or short code without signing into iCloud. Link requests expire after ten minutes and can be claimed only once. Private device keys, pairing secrets, and decrypted bootstrap material stay in device-protected storage and are not sent to the relay.

Audio and transmissions

Approved endpoints encrypt and sign every remote transmission before it leaves the device. The relay processes the visible routing header and may keep a short-lived, bounded replay buffer of ciphertext so an approved recipient can reconnect. It has no audio or recording storage and cannot decrypt the transmission.

Private signing and agreement keys, pairing secrets, plaintext audio, and assistant transcripts are not available to the relay. Recent-transmission history and playable audio remain on the endpoint devices where they were created or received.

Push notifications and operational data

An iPhone may register a Push to Talk token with the relay. The token is encrypted at rest, separately digested for deduplication, and sent only to Apple’s push service. Wake notifications are generic; the signed, encrypted stream remains authoritative.

The service processes limited connection, delivery, security, and request metadata needed to authenticate devices, route encrypted traffic, reject replay and abuse, and operate the beta. Logs use opaque correlations and do not include raw push tokens, bearer credentials, Apple account identifiers, packet contents, filenames, audio, or transcripts.

Your controls and retention

The account owner can revoke a linked computer. Revocation invalidates its relay sessions, approvals, and push registrations and closes active connections. The revoked Mac removes account credentials and pairing material while retaining its device-local audio history unless you delete it there.

Encrypted replay data and pending delivery jobs expire automatically. Account, device, approval, and signed revocation records are retained as needed to operate the beta and prevent a revoked identity from silently returning.

The website and beta waitlist

When you join the list, we collect your email address. You may also tell us which supported devices and Mac assistant you expect to use.

If campaign parameters are present in the page URL, we save the submitted UTM source, medium, campaign, content, and term, together with the referring website’s hostname. We do not save the referring page path.

The website has no analytics scripts, advertising pixels, cookies, or persistent browser identifiers. The waitlist does not retain your IP address or full user-agent string, and we do not sell or share the list for advertising.

Active entries are kept while recruiting and operating the private beta. Entries are deleted when you withdraw, or within 90 days after the beta waitlist closes.

Withdraw from the waitlist

Enter the same email address below. The response is deliberately generic so the website never reveals whether someone else’s address is registered.