Privacy
In effect 1 October 2026
Updated 28 September 2026 — now lists the status ping, the web hub’s fleet summary and its off switch, hub commands, error reports and profile pictures, which the earlier text left out.
Updated 19 October 2026 — adds automatic failure reports, which are off unless you switch them on, and names Cloudflare and Discord, which hold or hear about error and failure reports.
Farmero is made by Ranne Studio FZE, a Free Zone Establishment registered in Sharjah Publishing City Free Zone, Sharjah, United Arab Emirates (licence no. 4431716.01). It drives iPhones you own from a Mac you own, and it is built so that almost nothing needs to leave that Mac. This page says exactly what does.
If you only read one paragraph: we receive your email address, a licence key, an identifier for each Mac you activate, a status ping from each Mac while Farmero runs, a summary of your fleet for your own web hub — phone names, account usernames, post times and follower counts, which you can switch off — and, only when a phone has no cable, the clips you asked it to post. If you switch on automatic failure reports (they are off until you do), a run that fails also sends us the phone’s screenshot and its masked details. We never receive your passwords or session tokens, your messages, or what your accounts watched and liked.
The passwords of the accounts you add, your templates, your captions, your run history and the evidence bundles Farmero saves when something goes wrong all live in Farmero’s own folder on your Mac and are not uploaded — unless you switch on automatic failure reports, which send part of one bundle when a run fails (section 2). The one summary that leaves by default — for your web hub — is described in section 2 too, and you can switch it off.
The phones talk to your Mac over the USB cable. Warm-ups, likes, scrolling, account switching and posting all happen between your Mac and your phone, and are not reported anywhere. The one exception is the warm-up judge, which is off by default and described in section 6.
These, and nothing else.
| What | When | Why |
|---|---|---|
| Your email address | When you buy a plan or claim the free trial | To send your licence key, to let you recover it, and to hold one free trial to one address |
| Licence key, machine identifier, machine name, app version | When you activate Farmero on a Mac, and when it re-checks the licence | To count how many machines a licence is on, and to show you which ones so you can deactivate one |
| A rate-limit record: an action, an IP address and a time | When you call a licence, trial or recovery endpoint | To stop one person claiming a thousand trials or guessing at keys |
| A status ping: licence key, machine identifier, app version, how long Farmero has been running, your time zone’s offset, and how many phones are connected | Every minute while Farmero runs (every ten seconds for its first ten minutes) | To show your Macs as online in the web hub. It carries no account names |
| A fleet summary for your web hub: phone names and states, each account’s platform, username and days warmed, upcoming and failed post times, a list of recent warm-ups and posts, follower and recent-view counts, and per-day run and post counts | Each minute it changes, while your licence is active. On by default; from Farmero 0.9.87, farmeroctl hub-sharing off stops it and clears the hub’s copy | So you can see your fleet at farmero.co/hub. No captions, clip names, templates or passwords are in it |
| Commands you send from the web hub, and their results — a one-word outcome, or, for Remote agents you switch on, the tool’s answer | When you use the hub (or, if you switch on Remote agents yourself, when Claude calls a tool) | To carry out what you asked on the Mac |
| An error report: the last lines of Farmero’s logs with keys and tokens removed, a picture of Farmero’s own window, your phone names and the error | Only when you press Send on an error card | So we can fix what broke |
| An automatic failure report: the phone’s screenshot at the moment a run failed, the reason and step, the platform, the Farmero version, the phone’s model and iOS version, and the last lines of that run’s log — with account names, phone names and clip names masked (details below) | Only if you switch on “Automatically share failure reports” (Settings → Engine, or farmeroctl share-failures on). It is off by default. Then: once per failed post or stopped warm-up, the same failure at most once an hour, ten an hour at most | So we can see and fix what broke without you having to catch it and tell us |
| Clips you queued, and their captions | Only when the phone they are for has no cable and they have to reach it over the internet, or when you upload them through the web hub yourself | To get the file to the phone. Plugged in, it goes down the cable and we never see it |
They are off until you turn them on, and turning them off stops them at once. When they are on and a post fails (or may not have gone out) or a warm-up stops on an error, your Mac sends one report to your own account at farmero.co. It holds the phone’s screenshot from that moment, shrunk to at most 1280 pixels on its long side and 400 KB; the reason and the step that failed; the platform; the Farmero version; the phone’s model and iOS version; the account, masked to its first letter (“r•••”); the details Farmero recorded about the failure; and at most the last 80 lines of that one run’s log. Before anything leaves, the log lines and details have every account name, phone name and phone identifier your Mac knows masked the same way, clip file names replaced with “a clip”, your Mac’s user folder shortened to “~”, and keys and tokens removed; farmero.co removes keys and tokens a second time.
The screenshot is not masked. It is the phone’s screen as it was, so it can show an account’s name, a caption being posted, or the video or page that was open. The log lines can quote words Farmero read off the screen while it worked — a video’s title, the start of a caption — masked like the rest. A report never carries the full text and layout data Farmero records about the screen, your clips, your templates, or any password or token.
Reports are not sent when the cause is your phone rather than Farmero — a locked screen, a phone too hot, a page only you should answer, or a proxy rule — and never from a Mac without an active licence. The report’s text is stored in our database (Supabase) and the screenshot in private file storage (Cloudflare R2) that only short-lived signed links can open. The Farmero team reads them to fix bugs, and gets a short notice in its own Discord with only the reason, platform, step and versions — no account, log or picture. You can see every report your Macs sent, with exactly the log lines and details that were sent, on the hub’s Help page, and delete any of them or all of them there. They are deleted automatically after 30 days.
Two more things leave your Mac but do not reach us. To show your accounts’ pictures, your Mac fetches each account’s public profile page from instagram.com, tiktok.com or youtube.com — those companies see that request come from your Mac’s internet address. And to check whether a phone is behind a VPN, your Mac and your phones ask farmero.co/api/ip for their own address, country and time zone; the answer is sent back and nothing is stored.
The machine identifier is derived from your Mac’s hardware UUID. It identifies the machine, not you, and it is not usable to track you anywhere else. The machine name is whatever your Mac is called in System Settings, which on many Macs contains a person’s name — it is stored so that a list of your activated machines is readable rather than a column of hex.
One exception, and only if you switch it on: an automatic failure report’s screenshot shows whatever was on the phone’s screen when the run failed, which can include an account’s name, a caption or the video that was playing.
Purchases are processed by Whop. Whop — not Ranne Studio FZE — takes the payment, holds the card details and issues the receipt, and collects and remits sales tax or VAT where Whop is required to. Your card details never reach our systems and we could not retrieve them if you asked.
What we receive back from Whop is your email address, the plan you bought, and the identifiers for your membership and Whop user — enough to issue and maintain a licence.
These are all of them. Each is a company doing a specific job, and each has its own policy.
| Who | What they do | What they get | Where |
|---|---|---|---|
| Whop | Processes payments — takes the payment, holds the card details, issues receipts, and collects and remits sales tax or VAT where Whop is required to | Name, billing address, card or wallet details, purchase history | Global |
| Supabase | Database and licence endpoints | Licence keys, email addresses, machine fingerprints and names, rate-limit records, the fleet summary for your web hub, and the text of the error and failure reports you send. Supabase also keeps the short-lived records that say a clip is waiting in Cloudflare; the clips themselves are not stored there | Asia Pacific (Seoul) |
| Cloudflare (R2) | Private file storage, opened only through short-lived signed links | Clips you upload through the web hub or send to a phone that has no cable, and the screenshots attached to error and failure reports | Cloudflare R2, in Cloudflare's Eastern Europe storage location |
| Discord | Tells the Farmero team that a report has arrived | For an error report you send: the error, the app and engine versions, your Mac's and phones' names and the screenshot of the app's window. For an automatic failure report: only the reason, platform, step and versions | United States |
| Vercel | Hosts this website and counts its page views (Vercel Web Analytics) | Standard web request logs, including IP address; for analytics, the page viewed, the referrer, and country and device class derived from the request — aggregated, no cookies, no identifier that follows you between sites | Global edge network |
| Resend | Sends licence and recovery email | Your email address and the contents of that email | United States and EU |
Your data is stored and processed in the regions above, which may be outside the country you are in. We do not sell your data, and we do not share it with anyone for advertising.
Farmero can send you a message when a run finishes, through Telegram or through ntfy. Both are off until you turn them on and supply your own chat or topic. When they are on, the notification goes from your Mac to that service directly — it does not pass through us, and what you have told it to say is between you and them.
A free ntfy topic can be read by anyone who knows its name, so from Farmero 0.9.87 the ntfy push hides your account names and clip names by default (“@r•••”, “a clip”), and it can carry an ntfy access token for a reserved or self-hosted topic. Telegram is a private chat and gets the full line.
Remote agents — letting Claude run Farmero’s tools on your Mac through the web hub — are off until you switch them on, and publishing through them is a second switch of its own.
Automatic failure reports are off until you switch them on, and what they send is set out in section 2.
The warm-up judge is off by default. In Settings → Warm-up judge the default “Words” backend runs on your Mac and nothing leaves it. The “Apple” backend runs Apple’s on-device model on your Mac too: it reads the same text off the screen, never a screenshot, and sends nothing anywhere. Only if you choose the “Claude” backend and paste your own Anthropic API key does Farmero call Anthropic’s Messages API (api.anthropic.com), with your key, for each video a warm-up looks at. Each call carries a small JPEG of the phone’s screen as it shows that video in Instagram or TikTok, the text read off that screen (creator handle, caption, hashtags) and the niche description you typed for the account. It never carries your own account name, the phone’s identity or anything from other screens. The call goes from your Mac to Anthropic directly — it does not pass through us — and how Anthropic handles it is covered by your own agreement with Anthropic. The answer (on-niche, off-niche, junk or unknown) decides whether the warm-up likes, comments, follows, glances past or taps “Not interested”.
Email hello@farmero.co and you can ask us to show you everything we hold about you, correct it, export it, or delete it. Deleting your record ends any active licence, because the licence is the record. We will answer within 30 days.
Depending on where you live you may have these rights by law — under the GDPR, the UK GDPR, or the CCPA among others. We apply them to everybody regardless, because keeping two standards is how one of them gets forgotten. For anything Whop holds, ask Whop; their policy is linked above.
Licences are signed blobs your Mac verifies offline against a key we hold; the database tables behind them have row-level security on with no public policies, so the only way to reach them is through endpoints that check a key or an address first. No system is perfect, and we will tell you promptly if one of ours is breached in a way that affects you.
Farmero is not for anyone under 18, and we do not knowingly collect anything from them.
If this page changes in substance we will update the date at the top and, where the change matters to you, email the address on your licence.
Ranne Studio FZE, for Farmero — hello@farmero.co. We are established in and operate from the United Arab Emirates.