Privacy Policy

1 Information We Do Not Collect

meshTerm is designed so that the following sensitive information never leaves your device and is never transmitted to the Developer or any third party:

• Terminal session content - everything you type and everything displayed in the terminal
• Roam session scrollback and any data the Roam daemon stores on your remote host (see Section 3b)
• SSH private keys and passwords - stored exclusively in the iOS Keychain on your device
• SSH host details and connection logs
• Command history
• Snippet vault contents (including secret snippets backed by the iOS Keychain)
• Macro bar contents (including secret macros backed by the iOS Keychain)
• Tailscale authentication credentials
• Contents of any file accessed through the Application

The one exception is Ask an Agent in Containers: only after you agree, meshTerm sends a summary of a container, which can include recent log lines, to the AI provider you choose (see section 2.5).

We do not use advertising identifiers (IDFA) or any equivalent tracking technologies. meshTerm does not contain advertising SDKs or analytics SDKs that transmit personal data to third parties.

2 Information We Do Collect

2.1 Crash Reports

If the Application crashes, anonymised crash data may be collected through Apple's standard crash reporting infrastructure (if you have opted in to sharing diagnostic data with app developers in your iOS Settings). This data includes:

• Stack traces showing which code was executing at the time of the crash
• Device model and iOS version
• Application version
• Date and time of the crash

Crash reports explicitly exclude terminal content, SSH credentials, command history, and any other user data. We configure our crash reporting to prevent any such data from appearing in crash logs.

2.2 Subscription Information

When you purchase a meshTerm Pro subscription, Apple processes your payment and provides the Application with a transaction receipt. We receive:

• Confirmation that a valid subscription exists
• The subscription product identifier (monthly or annual)
• Subscription expiry date

We do not receive your payment card details, billing address, or Apple ID. All payment processing is handled entirely by Apple Inc.

2.3 iCloud Sync Data

If you use iCloud sync for your snippet vault, host configurations, and settings, this data is stored in your personal iCloud account using Apple's CloudKit framework. This data is:

• Stored in your iCloud account, not on Developer-operated servers
• Encrypted in transit and at rest by Apple
• Subject to Apple's iCloud privacy policy
• Accessible only to you and to the Application running on your devices

We do not have access to the contents of your iCloud data.

Agent notification settings are not synced: whether a host notifies a device is set on that device and stays on it.

2.4 Agent Notifications

Notifications are off by default and opt-in per host and per device. If you enable them, the Application registers your phone to receive alerts when an agent needs approval or finishes a turn. To provide this service:

• The Developer's relay, hosted in the United Kingdom, holds a random device ID, a relay token, Apple's push token, the two alert switches (approval and turn-completion), which alert kinds this phone's app supports, and when this phone last opened the app, rounded to the hour. No account or email address is attached.
• Alerts travel from your host to the relay and then to Apple Push Notification service (APNs), over HTTPS. They carry only an opaque session tag, the alert kind and agent name. Your phone maps the tag to a session locally and adds its name. The relay never receives prompt text, agent output, host names, commands, code, file names or session content. APNs delivers alerts under Apple's own privacy policy.
• To help detect broken delivery, the relay keeps content-free counts of alerts accepted by APNs, muted by your switches, rate-limited or failed, with times rounded to the hour and the last APNs error code. Counts contain no session tags, alert content, IP addresses or host details and are deleted with the registration. The relay does not store or log IP addresses; it uses them briefly in memory to limit abuse.
• Your host holds this phone's device ID and relay token in its own private file under ~/.meshterm-agent-push on Linux and macOS, or %USERPROFILE%\.meshterm-agent-push on Windows, in your user's home folder. Only your user account can read it. Setup also adds notification entries to the agents' configuration on that host. Those entries contain no relay token. The notification helper runs on your own server (see section 3b).
• The host records which device last used each terminal session so its alerts reach that device. Agent chat alerts go to the device that sent the message; herdr alerts go to every device with herdr alerts on for the host. These routing records stay on your host; the relay receives no session names or host details.
• Turning alerts off removes this phone's file and session records when the host is reachable. Its file stays while herdr alerts are still on. Before removing a host, turn off both its notifications and herdr alerts while it is reachable so those details are removed too. Removing the notification setup in Edit Host → Changes on this host removes the agent config entries, helper and every device's notification files and records. The switches in Settings → Agents → Notifications stop the selected alert kinds at the relay.
• When no host sends this phone notifications any more (both notifications and herdr alerts are off for every host), the Application deletes its relay registration and delivery counts. If the phone is offline, it retries when you open the app until the relay confirms. Turning alerts on again creates a new registration. Erase This Device in Settings → Privacy & Security also deletes the registration; the relay deletes it automatically when Apple reports the push token invalid, for example after app deletion.

2.5 Containers

Ask an Agent. If you use Ask an Agent on a container, meshTerm sends a summary of that container to the AI agent you choose, and only after you agree in the app. The summary holds the container's state and settings (including its environment variables, with secrets masked and Vault values replaced by their entry names), up to 200 recent log lines, recent events, CPU and memory, its links to other containers, and your server's name. Today the agent is Claude running on your own server, which sends the summary to Anthropic under the Claude account signed in there. meshTerm starts Claude there with its tools, and your Claude settings such as CLAUDE.md, hooks and MCP servers, turned off, so it can only read the summary and answer: it cannot run commands or read or change files on your server. Claude keeps no record of the request on your server (an older version of Claude that cannot skip it keeps its own record of the request there, which the app tells you about). If you set up your own API key, the summary is sent from your device to the AI provider you configure instead. Your key stays in this device's Keychain, is never synced, and is sent only to the address it was saved for; plain http is allowed only to an address on your own network or tailnet. meshTerm keeps the summary and the answer in memory only while you use them and does not save them on your device. Logs can contain personal data, such as email addresses, IP addresses or names. "Dig Deeper" starts a chat with an agent on your server and opens it with the container's name, image, container engine and its version, status (with any exit code or out-of-memory kill), restart count and policy, health, compose project and service, the names of the containers it depends on, recent events, any cause titles and your server's name, never its logs or environment. The Developer receives none of this data. You can stop sending at any time from Ask an Agent's Change screen.

Docker Hub. When you browse images to run, meshTerm asks Docker Hub for its list of popular images, your search text, and the tags of the image you look at, directly from your device. These requests carry no cookies, no account and nothing that identifies you, your servers or your containers; Docker's privacy policy applies to them. Pulling an image is done by your own server, not by the app. The Developer receives none of this data.

Templates. When you open Templates (Pro or the free trial), meshTerm downloads the list of templates and its signature from meshdeck.ag-applications.com, which is hosted on GitHub Pages, at most once a day unless you refresh it. The request carries no cookies, no account, and no identifier for you, your device, your servers or your settings; GitHub sees your IP address and that the list was requested, and GitHub's privacy statement applies. meshTerm checks the list's signature before using it. Deploying a template sends its compose file and your settings to your own server only.

3 How Information Is Stored on Your Device

3.1 SSH Credentials

SSH private keys and passwords are stored in the iOS Keychain with the following protections:

• Private keys: kSecAttrAccessibleWhenUnlockedThisDeviceOnly - requires device to be unlocked, never backed up to iCloud or transferred to other devices
• Passwords: kSecAttrAccessibleWhenUnlocked - protected by your device passcode
• Biometric authentication (Face ID / Touch ID) is required each time a private key is used

3.2 Application Data

All application data stored on your device (host configurations, snippets, themes, known SSH host keys) is protected by iOS Data Protection with NSFileProtectionComplete, meaning data is encrypted when the device is locked.

3.3 SSH Host Keys

SSH host key fingerprints are stored locally on your device only and are not synchronised to iCloud. This is intentional - known host key trust is device-specific for security reasons.

3b Data on Your Remote Hosts (Roam)

When you enable Roam on a host, the Application installs an open source helper program called mtroamd onto that host. Roam is opt-in per host and is off by default. Once enabled, the following data is stored on that remote host - a server you own or have legitimate access to - and not on the Developer's infrastructure:

• The terminal session itself (the running shell process) and its scrollback buffer. Scrollback is held in memory by the daemon, with an optional on-disk snapshot when you enable "Persist across daemon restarts" in the host editor.
• A small state directory containing the daemon's certificate and key (used to verify reconnects from your devices), per-session metadata (names, sizes, idle timestamps), and the optional persisted scrollback above.
• Log entries the daemon writes through its service supervisor (systemd-user, launchd, or a nohup-supervised fallback). Log content is operational metadata only and does not include the terminal output of your sessions.

This data is stored under your home directory on the host (typically ~/.local/share/mtroamd/). The Developer has no access to it. It is governed by your own security practices on that host - file permissions, account access, disk encryption, and any backup or syncing software you have installed.

Network traffic between the Application and the daemon flows directly between your device and your server. It does not pass through any Developer-operated server.

You can stop the daemon and remove this data at any time by running the daemon's uninstall command on the host, or by triggering Reinstall (which wipes the binary and supervisor unit) from the host detail screen in the Application.

4 Tailscale

The Application integrates with Tailscale networking. When you use Tailscale features:

• You authenticate directly with Tailscale using your Tailscale account - your Tailscale credentials are never seen by the Developer
• The Application creates an independent Tailscale node associated with your Tailnet
• Network traffic flows directly between your device and your Tailscale nodes, or via Tailscale DERP relay servers - it does not pass through Developer-operated infrastructure
• Tailscale's own privacy policy governs data processed by Tailscale infrastructure

5 Third-Party Services

The Application uses the following third-party open source components. These run entirely on your device and do not transmit data to third-party servers:

• Tailscale iOS SDK - BSD-3-Clause licence - tailscale.com
• SwiftNIO SSH - Apache 2.0 licence - Apple Inc.
• SwiftTerm - MIT licence - Miguel de Icaza

The Application does not integrate any advertising networks, social media SDKs, or data broker services.

External services the Application can contact

Beyond your own servers, the Application contacts the following third-party endpoints - each only for the purpose, and under the condition, noted:

• Your SSH hosts - the servers you choose to connect to. This is the core function of the Application; this traffic goes directly to your own hosts.
• github.com - to download the signed mtroamd daemon and CLI over HTTPS, only when you choose to install or update Roam on a host.
• Tailscale coordination servers and api.tailscale.com - only if you add a Tailscale auth key (to join your tailnet) or a read-only API token (to browse your devices). Your Tailscale auth keys and API tokens are stored in the iOS Keychain, the same as your SSH credentials.
• Apple - App Store / StoreKit endpoints process the optional Pro subscription (see section 6). Apple's Push Notification service (APNs) delivers agent notifications to your device, only if you enable them; the payload carries only an anonymous tag, the kind of alert and the agent's name.
• Docker Hub (hub.docker.com) - only when you browse or search images in Containers, with no cookies or account (see section 2.5).
• meshdeck.ag-applications.com (GitHub Pages) - to download the signed template list, only when you open Templates (see section 2.5).
• Your own AI provider or server - only if you set up your own API key for Ask an Agent, and only when you ask (see section 2.5).

6 Apple App Store and Apple Services

The Application is distributed through the Apple App Store. Apple may collect certain information in connection with your download and use of the Application, including your Apple ID and device identifiers, subject to Apple's own Privacy Policy available at apple.com/legal/privacy.

In-app subscription purchases are processed by Apple. Apple's privacy policy governs the data collected in connection with those transactions.

7 Children's Privacy

meshTerm is not directed at children under the age of 13 (or 16 in the European Economic Area). We do not knowingly collect personal information from children. The Application is intended for use by developers, system administrators, and technical users who manage remote Linux infrastructure.

8 Your Rights

Under the UK General Data Protection Regulation (UK GDPR) and applicable data protection legislation, you have the following rights:

• Right of access - to request information about personal data we hold about you
• Right to rectification - to correct inaccurate personal data
• Right to erasure - to request deletion of personal data we hold
• Right to restriction - to restrict processing of your personal data
• Right to data portability - to receive your personal data in a portable format
• Right to object - to object to processing of your personal data

Given the privacy-by-design nature of meshTerm, we hold minimal personal data about you. Most data is stored exclusively on your device and in your iCloud account, both of which you control directly. To exercise any of these rights or for any privacy-related enquiry, please contact us at the address below.

9 Data Retention

We retain crash report data (if collected through Apple's crash reporting) for a period of up to 12 months, after which it is deleted. This data is anonymised and cannot be linked back to you individually.

Subscription transaction data is retained for the period required by applicable tax and financial regulations, typically 7 years in the United Kingdom.

All other data (SSH credentials, snippets, host configurations) is stored exclusively on your device and in your iCloud account. Deleting the Application removes all locally stored data. You can manage iCloud data through your device Settings → Apple ID → iCloud → Manage Storage.

If you enable agent notifications, the push registration on the Developer's relay (the device ID, relay token, Apple push token, two alert switches, supported alert kinds and last app-open hour described in section 2.4) and its delivery counts are kept only while at least one host sends your device notifications. The Application deletes them from the relay when no host does any more (see section 2.4), or when you erase the Application's data (Settings → Privacy & Security → Erase This Device), and the relay deletes them automatically when Apple reports the push token invalid (for example after you delete the Application).

10 Security

We implement appropriate technical and organisational measures to protect the limited data we handle. The Application itself employs multiple layers of security including iOS Keychain storage, Data Protection, biometric authentication, and SSHv2 with modern cipher suites.

However, no method of transmission over the internet or method of electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your information, we cannot guarantee its absolute security.

11 Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by updating the effective date at the top of this document and, where appropriate, providing notice within the Application. We encourage you to review this Privacy Policy periodically.

Your continued use of the Application after any changes to this Privacy Policy constitutes your acceptance of the updated policy.

12 Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

We will respond to all privacy enquiries within 30 days.