Privacy Policy

SSH Manager Pro — last updated 4 September 2026

The short version. This app has no analytics, no advertising, and no third-party tracking of any kind. Your servers, credentials and SSH keys stay on your device, encrypted. Optional cloud backup is encrypted on your device before it is uploaded, with a passphrase only you hold — we cannot read it. The only feature that ever sends your terminal content off the device is the AI Copilot, and only if you choose to configure an API key for it.

1. Who this is about

SSH Manager Pro ("the app") is an Android SSH client. This policy explains what the app does with your data. Contact: sshmanagerpro@gmail.com.

2. What stays on your device

The following never leaves your device unless you explicitly enable cloud backup:

Host configurations (hostname, port, username, alias)
SSH private keys and passwords
Bastion / jump host configurations
Command snippets
Terminal session history and logs
Tailscale authentication keys
AI provider API keys, if you enter any

Passwords, keys and other secrets are encrypted with AES-256-GCM using a key held in the Android Keystore, and the app is configured with allowBackup="false" so this data is excluded from Android's automatic cloud backups.

3. What leaves your device, and when

Data	Goes to	When
SSH session traffic	Your own servers, directly	Whenever you connect. This is an end-to-end encrypted SSH connection; we operate no intermediary and never see its contents.
Encrypted vault backup	Google Firebase (Firestore)	Only if you enable Cloud Backup. See section 4.
Email address and account ID	Google Firebase Authentication	Only if you sign in with Google, which is required for Cloud Backup. Used solely to identify which backup is yours.
Recent terminal output and your prompt	Google Gemini or OpenRouter	Only if you configure an AI API key. See section 5.
Tailscale coordination data	Tailscale, or your own Headscale server	Only if you use a Tailscale connection mode.
Purchase token	Google Play, and our verification service	Only if you subscribe. See section 6.

4. Cloud backup is zero-knowledge

Cloud Backup is optional and off by default. When you use it, your vault is serialised and encrypted on your device with AES-256-GCM, using a key derived from a master passphrase that you choose (PBKDF2-HMAC-SHA256, 600,000 iterations). Only the resulting encrypted blob is uploaded.

That passphrase is never transmitted and is not stored on our servers. We cannot decrypt your backup, and neither can Google. The practical consequence is important: if you lose your master passphrase, your backup is permanently unrecoverable. There is no reset mechanism, by design.

5. The AI Copilot

The AI Copilot has two modes:

Offline (default). With no API key configured, suggestions come from a rule engine that runs entirely on your device. Nothing is transmitted.
Live provider. If you enter an API key for Google Gemini or OpenRouter, then when you ask the Copilot a question the app sends your prompt together with up to the last 1,000 characters of recent terminal output to that provider, so it can answer in context.

Please be aware of what that means: terminal output can contain file contents, environment variables, hostnames, or credentials that happened to be on screen. That content is handled under the privacy policy of whichever provider you chose (Google or OpenRouter), not this one. If you would rather nothing was sent, leave the API key blank and the offline engine will be used.

6. Subscriptions

Payment is processed entirely by Google Play; the app never sees your payment details. When you subscribe, Google Play issues a purchase token which the app sends to our verification service to confirm the subscription is genuine. We store that token, your account ID, and the resulting subscription status. We do not store any payment information.

7. What we do not do

No analytics or telemetry SDKs of any kind
No advertising, and no advertising identifiers
No third-party trackers
We do not sell, rent, or share personal data with anyone
No profiling and no automated decision-making

The app requests five Android permissions: INTERNET and ACCESS_NETWORK_STATE to make connections, USE_BIOMETRIC / USE_FINGERPRINT to unlock the vault, and CAMERA — used only while you are scanning a host-sharing QR code. The camera is never accessed at any other time, no image is stored, and nothing from the camera leaves your device.

7b. Sharing a host by QR code

You can show a host's connection details as a QR code for someone else to scan. That code contains the alias, hostname, port, username, authentication type and Tailscale mode — never a password or an SSH key. A QR code is readable by anyone who can see the screen, so credentials are deliberately excluded; whoever scans it supplies their own.

Scanning uses the camera to read the code on-device. Frames are not recorded and are not transmitted anywhere.

8. Retention and deletion

Data held on your device is deleted when you delete it in the app, or when you uninstall. To delete a cloud backup, sign in and use the delete option in Settings, or email sshmanagerpro@gmail.com from the address associated with the account and we will remove the stored blob and entitlement record. Since backups are encrypted with a key we do not hold, the stored data is in any case unreadable to us.

9. Children

This app is a system administration tool intended for adults. It is not directed at children, and we do not knowingly collect data from anyone under 13.

10. Changes

If this policy changes materially, the updated version will be published at this URL with a new date at the top.