# Privacy Policy

Effective date: 10 August 2026

Rodger's iOS Music Export is a local, skills-only Codex plugin. The developer operates no service for it. The plugin contains no analytics, advertising, developer account, telemetry endpoint, or developer-controlled server.

## Data handled locally

At the user's direction, the workflow may process:

- device name, product type, device class, iOS version and build, and battery fields when available;
- a one-way SHA-256 fingerprint derived from the device's usbmux identifier, used only to prevent an export manifest from being reused with another device;
- music titles, artists, albums, genre labels, source locations, filenames, sizes, modification signatures, and database snapshot hashes;
- locally stored audio bytes selected for export;
- destination paths, SHA-256 file hashes, progress, verification results, and a local append-only TSV audit manifest with per-event checksums;
- the Mac's existing pairing record in memory, including host and device certificate material required to establish Apple's local TLS session.

The raw device identifier, pairing record, certificates, and private key are never written to logs or the manifest. Python's TLS API requires certificate paths, so host credentials are written only inside a mode-0700 temporary directory as mode-0600 files, loaded locally, and immediately removed. TLS peer identity is pinned to the existing pair record.

## Purpose and recipients

The data is used only to identify the attached device, select exact matching locally stored tracks, copy them to a user-chosen Mac folder, support safe resume, and verify the local result. The script communicates only with Apple's local macOS `usbmuxd` service and local filesystem tools. It sends no data to the developer or another developer-controlled recipient.

Command output and files that an agent reads may become part of the user's Codex task context and are therefore also subject to OpenAI's applicable product and workspace terms. macOS, iOS, and separately installed tools such as `ffprobe` remain subject to their own terms.

## Retention and control

The plugin itself retains nothing remotely. Audio files, the TSV manifest, and its empty advisory `.lock` file remain on the user's Mac until the user moves or deletes them. Temporary database snapshots and certificate files are scoped to temporary directories and removed when the command exits normally; the operating system may clean remnants after an abnormal termination. Users control the destination and may delete local outputs with ordinary Finder or command-line tools after confirming the exact paths.

Privacy questions can be filed through the public repository's issue tracker listed in [SUPPORT.md](SUPPORT.md). Never attach pairing material, private media, or a raw device identifier to an issue.