Reference

Privacy & security

iphone-use runs on your own Mac and talks to your own iPhone. There is no iphone-use account and no developer server in the loop. This page sums up what stays where, what an agent can and cannot do, and how to reach the phone safely from outside your network. The full texts are docs/privacy.md and docs/telemetry.md.

Local by default

The daemon listens on 127.0.0.1:44321 behind a password. Agents authenticate with a bearer token (IPHONE_USE_AGENT_TOKEN, or the password as a legacy fallback), and every state-changing request also needs X-Phone-Control: 1.
The runner on the phone refuses any request not signed with a token that setup generates at each runner launch: HMAC-SHA256 over the method, target, body, a timestamp and a one-time nonce. The token stays on the Mac (mode 0600) and is never sent, so a captured request can be neither replayed nor altered.
USB and the CoreDevice Wi-Fi tunnel are private to this Mac. Signing does not encrypt: the iOS 15/16 LAN relay and the explicit IPU_RUNNER_ALLOW_LAN=1 relay are plain HTTP, so someone watching that Wi-Fi can see the screen, but cannot drive the phone.
Anyone who can read your user's files on the Mac can read the token. Treat the daemon's URL and password as credentials.

Secrets stay with you

For logins, passcodes and Face ID the agent stops and asks you to finish on the phone. It never asks for the password or the code.
If you use bitwarden-use, phone_login fills an app's sign-in form from your own vault entry inside the daemon. The password never reaches the model; the answer names the entry and a masked account only.
Flow inputs are given per run and never written back to the flow file. Inputs must not carry credentials, codes or private content.

Limits the agent cannot talk its way past

The phone's owner sets these in the daemon's environment; they hold whatever an agent's prompt says.

IPHONE_USE_BLOCKED_APPS (for example Wallet, Passwords): an agent cannot open, install or uninstall those apps.
IPHONE_USE_MAX_ACTIONS: caps the actions per task.
A refusal answers 403 with outcome:"not_sent": nothing reached the phone.

Details: Owner limits and the activity feed.

You see what it does

The web page shows each action over the live screen in plain words, for example Tapped “Wi-Fi”. Typed text is never kept, only its length.
Every /agent/* request is timed in ~/.iphone-use/agent-timing.jsonl: route, owner and timings only, never request or screen content.
A phone has one owner at a time. While you are in control, an agent waits or is told who holds the phone.

Telemetry: off

✅ This build sends no usage data

The daemon contains code for anonymous usage counts, but no project token ships with it, so it sends nothing unless you set IPHONE_USE_TELEMETRY_TOKEN yourself. If a future release turns it on, it will say so in privacy.md and telemetry.md.

If it were ever on, each event would carry only which agent API endpoint was called, whether it worked, a failure class from a fixed list, its duration, the daemon's version and platform, and a random install id. It would never send typed or read text, element labels, screenshots or video, app bundle ids, phone identifiers or names, or file paths. Either of these turns it off completely:

bash

IPHONE_USE_TELEMETRY=0
DO_NOT_TRACK=1

The iOS app

The iOS app (Phone Use Remote) collects no data, and the developer runs no server for it: no account, no analytics, crash reporting, advertising or tracking SDKs. It talks only to the Mac address you enter or scan. The address is kept in the app's preferences and the password or pairing token in the iOS Keychain; the camera is used only to read the pairing QR code, and local network access only to reach that Mac. Forget this Mac in the app's settings removes the saved password and pairing token.

Reaching the phone from outside

Reach port 44321 through an authenticated HTTPS reverse proxy or a trusted VPN such as Tailscale, never by exposing the runner's ports.
Binding the daemon to 0.0.0.0 makes a password mandatory. Never do it on an untrusted network.
iphone-use-mcp --listen on a loopback address is reachable only from the same Mac. Listening on any other address requires IPHONE_USE_MCP_TOKEN.
The owner lease is coordination between cooperating sessions, not a security boundary. Do not leave payment apps, private chats or 2FA screens open while exposing access, and stop the LaunchAgent when you are not using it.

This website

iphone-use.leeguoo.com is a static site. It loads Google Analytics 4 (the leeguoo.com stream) and the blog.leeguoo.com visitor beacon to count visits. It shows no ads. Neither has anything to do with the iphone-use software on your Mac or phone.