Effective 7 September 2026. This policy covers waterbrother.app, the WATERBROTHER command-line tool, and the WATERBROTHER iPhone app. Operator: Phillip Holland. Contact: phillip.b.holland@me.com.
You can still bring your own keys. If you use hosted inference, you also have a WATERBROTHER account (Sign in with Apple). Cloud calls then go WATERBROTHER → OpenRouter on a key we hold. We meter those calls in US dollars and debit prepaid credits. We do not sell your prompts. Purchases of Unlock and Operator still go through Apple. Hosted Pro, Roundtable, and credit packs go through Stripe Checkout on the web.
The site is static documentation. Browsing does not require an account. Hosting and analytics (currently Vercel and Google Analytics) may receive IP address, user agent, and page path. We do not use that to build a marketing profile of you.
Sessions, groups, saved computers, and chat transcripts stay on the device. Provider keys (including OpenRouter), GitHub tokens, Vercel tokens, and Tailscale secrets stay in the Keychain on that iPhone. They are not written to iCloud. Downloaded on-device models stay on that iPhone.
If you turn on iCloud backup in Settings, sessions, groups, and saved computers sync with the Apple Account already on that iPhone. Keys, Tailscale secrets, and downloaded models are not included.
Apple Intelligence runs on device. Local MLX weights you download stay on that iPhone. WATERBROTHER does not upload those weights.
The command-line tool stores configuration, session history, receipts, and project memory on the machine where you run it, typically under ~/.waterbrother and in the working directory (including WATERBROTHER.md). That can include prompts, paths, command traces, and collaboration state if you enable those features.
When you attach from the iPhone, traffic goes over the private Tailscale path you set up. WATERBROTHER does not run a relay that reads that session.
If you paste an OpenRouter key, connect GitHub, connect Vercel, or sign into Tailscale, those companies process what you send them under their own policies. WATERBROTHER uses those connections only to do the work you start (chat, repo look and Ship, deploys, attach). We do not sell that access.
Optional adapters on the computer product may talk to other services you enable. Those services have their own policies.
Sign in with Apple gives us an Apple subject identifier and, if you share it, an email. We store a session (hashed tokens), your plan, spend cap, and a USD wallet. Each hosted reply is pre-authorized, then captured against that wallet. We store a hash of the request body, the model id, token counts, and dollar amounts. We do not keep prompt text or repository contents on the server.
Subprocessors for hosted mode: Stripe (payments, invoices, tax calculation when registered), OpenRouter (model inference), Apple (Sign in with Apple), and if we later host the API, the US cloud region we name here (intended: AWS us-east-1). Tailscale stays on the tailnet you already use for attach; we do not mint a phone auth key in this version.
Unlock and Operator are sold through StoreKit. Apple processes that payment and holds the App Store receipt. WATERBROTHER receives an entitlement (owned / subscribed), not your full card number. Restore uses your Apple Account. Family Sharing for Unlock follows Apple’s rules. Operator subscriptions do not use Family Sharing.
Hosted Pro, Roundtable, and credit packs are sold by WATERBROTHER through Stripe Checkout (web). Stripe processes the card. We receive customer, subscription, and invoice events, not your full card number. Manage card, cancel, and invoices in the Stripe Customer portal. We do not put Stripe secret keys in the iPhone app.
The iPhone app does not send prompts, repo names, project names, host names, or your provider keys to WATERBROTHER on the bring-your-own-key path. Hosted mode sends the chat request to our API so we can meter it; we still do not store prompt text. Product analytics, if enabled, are identifiers and dollar outcomes only.
Device data stays until you delete the session, turn off iCloud backup, or delete the app. Keychain items are removed when you delete the app or clear them in Settings. Apple keeps purchase records according to Apple’s policies. Website logs follow the host’s retention.
WATERBROTHER is a developer tool. It is not directed at children under 13, and we do not knowingly collect personal information from them.
Email phillip.b.holland@me.com. We may update this page when the product changes. The effective date at the top is the current version.
