Privacy Policy

SSH Manager Pro — last updated 4 October 2026

1. Who this is about

SSH Manager Pro ("the app") is an Android SSH client. This policy explains what the app does with your data. Contact: privacy@sshmanagerpro.app.

2. What stays on your device

The following never leaves your device unless you explicitly enable cloud backup:

• Host configurations (hostname, port, username, alias)
• SSH private keys and passwords
• Bastion / jump host configurations
• Command snippets
• Terminal session history and logs
• Tailscale authentication keys
• AI provider API keys, if you enter any

Passwords, keys and other secrets are encrypted with AES-256-GCM using a key held in the Android Keystore, and the app is configured with allowBackup="false" so this data is excluded from Android's automatic cloud backups.

3. What leaves your device, and when

4. Cloud backup is zero-knowledge

Cloud Backup is optional and off by default. When you use it, your vault is serialised and encrypted on your device with AES-256-GCM, using a key derived from a master passphrase that you choose (PBKDF2-HMAC-SHA256, 600,000 iterations). Only the resulting encrypted blob is uploaded.

That passphrase is never transmitted and is not stored on our servers. We cannot decrypt your backup, and neither can Google. The practical consequence is important: if you lose your master passphrase, your backup is permanently unrecoverable. There is no reset mechanism, by design.

5. The AI Copilot

The AI Copilot has two modes:

• Offline (default). With no API key configured, suggestions come from a rule engine that runs entirely on your device. Nothing is transmitted.
• Live provider. If you enter an API key for Google Gemini or OpenRouter, then when you ask the Copilot a question the app sends your prompt together with up to the last 1,000 characters of recent terminal output to that provider, so it can answer in context. Signed in with Google, the same content goes to Gemini through Google's Firebase AI Logic instead, needing no key of yours, together with Google's App Check / Play Integrity attestation that the request came from a genuine copy of the app.

Both live paths also say which session you are asking about: the host's alias, username and hostname as they appear in the terminal. Please be aware of what that means: terminal output can contain file contents, environment variables, hostnames, or credentials that happened to be on screen. That content is handled under the privacy policy of whichever provider you chose (Google or OpenRouter), not this one. If you would rather nothing was sent, leave the API key blank and the offline engine will be used.

6. Subscriptions

Payment is processed entirely by Google Play; the app never sees your payment details. When you subscribe, Google Play issues a purchase token which the app sends to our verification service to confirm the subscription is genuine. We store that token, your account ID, and the resulting subscription status. We do not store any payment information.

7. Crash reporting

Crash reporting is off by default. Nothing is collected or sent unless you turn it on, from the prompt shown after a crash. While it is on, Settings → About shows "Crash reports are on" with a Turn off button, so you can turn it off again at any time.

When it is on, crashes are sent to Firebase Crashlytics (a Google service) and contain the error and stack trace, the app version, and the device model and Android version. They do not contain your passwords, SSH keys, cloud credentials, or terminal output. One caveat we would rather state than gloss over: a stack trace includes the error's own message, so if a connection fails the name or address of the server you were connecting to can appear in it. We use crash reports only to find and fix crashes.

8. Feedback and support email

When you use Settings → About → Send feedback, the app sends your message, the app version, the Android version, your email address if you enter one, and a random ID created for this installation (it is not a device identifier and is used only to limit spam). When you email support@sshmanagerpro.app, we receive the email as sent. Nothing else is attached: no logs, no host list, no terminal output.

Both are stored in a database we run on Cloudflare and processed with Cloudflare Workers AI (on Cloudflare's own network, without retention by model vendors) to categorize the message and suggest reply drafts for the developer. A copy is sent to the developer through Telegram so it can be answered quickly. An email to support@ is also forwarded, as received, to Proton Mail, our email provider, so it can be read and replied to like any other mail. To limit abuse, in-app feedback additionally stores a one-way, salted hash of the IP address it was sent from — never the address itself; email is not IP-hashed. We use feedback and support email only to answer you and to improve the app, and we keep it for up to 12 months after the conversation ends. To have it deleted sooner, email privacy@sshmanagerpro.app.

9. What we do not do

• No analytics, advertising or usage-tracking SDKs of any kind
• No advertising, and no advertising identifiers
• No third-party trackers
• No telemetry of any kind unless you switch on crash reporting
• We do not sell or rent personal data, and share it with no one except the service providers named in section 3, who handle it only to run those features
• No profiling and no automated decision-making

The app requests eleven Android permissions: INTERNET and ACCESS_NETWORK_STATE to make connections, USE_BIOMETRIC / USE_FINGERPRINT to unlock the vault, CAMERA — used only while you are scanning a host-sharing QR code (the camera is never accessed at any other time, no image is stored, and nothing from the camera leaves your device), NFC for hardware security keys (for example a YubiKey), read only while you are tapping one, BILLING for subscriptions, and FOREGROUND_SERVICE, FOREGROUND_SERVICE_DATA_SYNC, POST_NOTIFICATIONS and WAKE_LOCK, which keep an open SSH session alive while the app is in the background and tell you that it is running.

10. Sharing a host by QR code

You can show a host's connection details as a QR code for someone else to scan. That code contains the alias, hostname, port, username, authentication type and Tailscale mode — never a password or an SSH key. A QR code is readable by anyone who can see the screen, so credentials are deliberately excluded; whoever scans it supplies their own.

Scanning uses the camera to read the code on-device. Frames are not recorded and are not transmitted anywhere.

11. Retention and deletion

Data held on your device is deleted when you delete it in the app, or when you uninstall. To delete a cloud backup, sign in and use the delete option in Settings, or email privacy@sshmanagerpro.app from the address associated with the account and we will remove the stored blob and entitlement record. Since backups are encrypted with a key we do not hold, the stored data is in any case unreadable to us.

12. Children

This app is a system administration tool intended for adults. It is not directed at children, and we do not knowingly collect data from anyone under 13.

13. Changes

If this policy changes materially, the updated version will be published at this URL with a new date at the top.