Privacy
Burrow runs on your Mac. We don't run a server that receives your work, and we don't track you.
The short version
- The app has no analytics, no tracking, no ads and no crash reporting.
- What your agents are doing, your meetings, your music and your files stay on your Mac. We never see them.
- Burrow only goes online for the few jobs listed in Every connection.
- Your sign-in tokens and your license key live in the macOS Keychain.
- You can switch off or remove every connection, at any time.
What Burrow reads, and why
Claude Code and Codex activity
When you connect Claude Code, Burrow adds a few hooks to ~/.claude/settings.json and saves a backup copy next to it first. Codex works the same way with its own hooks file. The hooks send a small message to Burrow each time something happens: a session starts, needs you, finishes or ends.
Those messages go to your own Mac only (127.0.0.1, port 47823). They don't leave your computer. Each hook carries a secret, so other apps can't easily pretend to be your agent. Burrow made it on your Mac and keeps it in a private file.
A message can include the project folder, the session ID, the path to the session's transcript file, your terminal app, and the tool an agent wants to use with its input (a shell command, a file name or a web address). Depending on the event, Claude Code or Codex may also send other text, such as your prompt or a tool's output. Burrow ignores that part. It shows you the project name, the status and one line about what the agent wants to do.
Burrow keeps this in memory only. It doesn't write it to disk, and quitting Burrow forgets it.
To show a session's name, Burrow reads the end of that session's transcript file (up to the last 512 KB) to find the title line. For Codex usage numbers, it reads Codex's own local session files. It doesn't store, analyse or send what's in them. It never reads ~/.codex/auth.json or any other login.
When you tap Allow or Deny, Burrow answers your agent on your Mac. If you don't answer in time, the agent asks you in its own window as usual.
To turn it off: Settings → Connections → AI → Claude Code → Disconnect…. That takes out Burrow's hooks, and the status line if plan usage is on. Codex has the same option. Your own hooks and settings stay as they were.
Usage
If you turn on Claude Code usage, Burrow wraps your statusLine setting. Claude Code hands the wrapper your plan's usage percentages and reset times, and the wrapper passes only those numbers and the Claude Code version to Burrow, on your Mac. Burrow never asks for or stores a Claude login and never contacts Anthropic for your usage. It saves the last numbers locally so the rings show right away. Turning it off puts your old status line back.
Apple Calendar
After macOS asks your permission, Burrow reads events on your Mac to find your next meeting: title, times, your reply, and the location, notes and link fields (used only to spot a Zoom, Meet or Teams link). Nothing is sent anywhere.
Events are kept in memory only. Burrow shows one meeting at a time and opens the link when you tap Join.
GitHub
If you connect GitHub, you sign in on GitHub's own page using its device code flow. Or you can paste a read-only token instead. Burrow stores the token in the macOS Keychain and asks GitHub's API for pull requests that wait on your review and ones you opened. It uses them to show your counts and titles. They stay in memory. Disconnecting deletes the token. You can also revoke Burrow in your GitHub settings. Burrow's GitHub app only reads pull requests, and only on the repositories you pick when you install it. (GitHub also always shares basic read-only repository details.) A pasted token reads whatever you gave it.
Music
If Apple Music or Spotify is already running, Burrow asks it, through macOS Automation (macOS asks first), for the current track's title, artist, position, length and artwork, and sends play, pause, skip and seek to it. Burrow never opens a music app on its own. For Spotify, the artwork comes from a web address Spotify provides, so Burrow downloads that image from Spotify's servers, and Spotify sees your IP address as it would in its own app. For Apple Music, Music often has no artwork for streamed songs. Then Burrow looks the cover up in Apple's public music catalogue using only the song title and artist, and downloads the image from Apple's servers. Apple sees your IP address, as it would for any web request. Now-playing info is kept in memory only.
Files on the Shelf
Burrow remembers the location of each file you drop on the Shelf so it's still there after a restart. It doesn't copy, upload or read the files. AirDrop only happens when you choose it, through macOS's own sheet.
Other things on your Mac
- Your first name, from your macOS account, to say "Good morning". It stays on your Mac.
- Battery level and charging state, from macOS.
- Which windows cover the screen (size, position and owning app, not titles or contents), checked every few seconds, so Burrow can hide in full screen.
- Whether a Focus is on, from macOS, so Burrow can stay quiet. It doesn't read which Focus or why.
- Your sticky note and your settings, saved in Burrow's preferences on your Mac.
- Launch at login, only if you turn it on.
What Burrow keeps, and where
| What | Where |
|---|---|
| Your GitHub token, Pro license key | macOS Keychain on your Mac |
| Settings, sticky note, Shelf file locations, last usage numbers | Burrow's preferences on your Mac |
| The secret that lets your agents' hooks talk to Burrow | A file in ~/Library/Application Support/Burrow on your Mac |
| Agent sessions, meetings, now-playing | Memory only. Gone when you quit. |
iCloud sync (Pro)
If you have Pro and are signed in to iCloud, Burrow can sync your look and preferences between your own Macs through Apple's CloudKit, in your private iCloud space. That includes your buddy choices, desk cards, sticky note and a few settings, and your Pro key so a new Mac can unlock. The key is end-to-end encrypted with keys kept in iCloud Keychain. Things that belong to one Mac (the file tray, sign-ins, where the Desktop Buddy stands) never sync. We can't read your private iCloud data. It's Apple's service, under Apple's privacy policy. If you're not signed in to iCloud, everything stays local and nothing breaks.
Every connection
| Where | When | What is sent |
|---|---|---|
127.0.0.1 (your own Mac) | Agent hooks and the usage status line | Stays on your Mac |
Our update feed on meetburrow.com (Sparkle) | About once a day, and when you choose Check for Updates… | What any web request carries (your IP address), plus Burrow's and macOS's version numbers. Sparkle's system profile is off. |
Polar (api.polar.sh) | When you unlock Pro on a Mac, about daily to confirm it (only if this Mac has Pro), and when you free a Mac | Your license key, this Mac's name, a hashed hardware ID, Burrow's version and your macOS version (details below). Trial and Lite never contact Polar. |
| Apple iCloud (CloudKit) | If you have Pro and are signed in to iCloud | See iCloud sync above |
api.github.com, github.com | Only if you connect GitHub | Your token and a search for your pull requests |
| Spotify's artwork servers | When the Spotify track changes | A request for the album art image |
Apple's music catalogue (itunes.apple.com) and artwork servers (mzstatic.com) | When an Apple Music track changes and Music has no artwork | The song title and artist, then a request for the cover image |
| Links you open (Join, a pull request) | When you tap them | Opens in your browser or meeting app |
That's the full list. Burrow doesn't use live weather or your location.
What Burrow never does
- No analytics, tracking, advertising or telemetry in the app.
- No crash reporting. If Burrow crashes, we only see the report if you choose to email it to us.
- No servers of ours receive your agent activity, calendar, music or files.
- No selling or sharing of your data. We don't hold any.
- It never sends your prompts, code, transcripts or files anywhere.
- It never logs your tokens.
This website
meetburrow.com is hosted on Cloudflare, which sees visitors' IP addresses in the course of serving pages.
We use Cloudflare Web Analytics to count visits to meetburrow.com. It sets no cookies, doesn't follow you across other sites and builds no profile of you. We see totals for pages, referrers, countries and device types. The Burrow app has no analytics of its own.
The site hosts its own fonts and loads nothing from third-party font services.
The site sets no cookies of its own. It remembers, for this visit only and only in your browser, whether you signed up and which link brought you here. The buy button passes that link's name to Polar.
Launch email. If you give your email to be told when Burrow launches, it goes to Buttondown, our email service. We use it once, to send you the launch-day note, and ask you to confirm first. We don't use it for anything else, don't share it, and delete the list after launch. To be removed sooner, email support@meetburrow.com.
Buying Pro
Payments go through Polar, who sell Pro to you as the merchant of record. Polar takes your name, email, payment details and country to process the order and the taxes. We get your email, the order details and your license key, so we can deliver your license and help you. Polar's own policy covers what it does with your data.
When you unlock Pro on a Mac, Burrow sends Polar your license key and four details about that Mac:
- Your Mac's name, such as "Sam's MacBook Pro". It ties the license to your Mac and shows in Polar's list, so you can spot it when you want to free it.
- A hardware ID, hashed. A scrambled code made from your Mac's hardware ID, so the original can't be read from it. Its first few characters sit next to your Mac's name in Polar's list, which tells two Macs with the same name apart.
- Burrow's version, so Polar's record shows which version is on that Mac.
- Your macOS version, to check that Burrow works with it.
The daily check, and freeing a Mac, send only your license key and the ID Polar gave that Mac when you unlocked Pro. Nothing else about you or your Mac, apart from what any web request carries (your IP address).
If you email support, or use Send Feedback… in Burrow's menu, we use your message and address to answer you, and we keep the thread for up to 24 months, then delete it. Send Feedback… opens a new email in your own mail app with Burrow's version and your macOS version filled in. Nothing is sent until you press Send, and you can delete those lines first.
Your choices
- Turn things off. Each connection can be disconnected in Settings → Connections. You can take back macOS permissions in System Settings → Privacy & Security (Automation, Calendars).
- Delete everything. First open Settings → Connections → AI and, under Remove Burrow from your AI tools, choose Remove… next to Claude Code (and next to Codex if you connected it). Then quit Burrow, delete the app, and delete its preferences (
com.meetburrow.burrow.plistin~/Library/Preferences), its Keychain items (search Keychain Access for "notchling", Burrow's early name), and the~/Library/Application Support/Burrowfolder. Thesettings.json.burrow-backup-…copies next to your agent's settings are yours to keep or delete. - Your rights. We hold almost none of your data, so there's little to export or delete. For purchase records or anything else, email us. In the EU and UK you may also ask to see, fix, delete or move your data, and complain to your data protection authority. Juan Romero is responsible for the data described here. We use it to deliver what you bought and to answer you when you write to us. Our providers (such as Polar and Cloudflare) may handle it outside your country under their own safeguards. In California, we don't sell or share personal information.
Children
Burrow isn't made for children under 13, and we don't knowingly collect their data.
Changes
If this page changes, we'll update the date and say so in the release notes. If something big changes, like a new service getting data, Burrow will tell you before it happens.