Privacy Policy

1 Information We Do Not Collect

meshTerm is designed so that the following sensitive information never leaves your device and is never transmitted to the Developer or any third party:

• Terminal session content - everything you type and everything displayed in the terminal
• Roam session scrollback and any data the Roam daemon stores on your remote host (see Section 3b)
• SSH private keys and passwords - stored exclusively in the iOS Keychain on your device
• SSH host details and connection logs
• Command history
• Snippet vault contents (including secret snippets backed by the iOS Keychain)
• Macro bar contents (including secret macros backed by the iOS Keychain)
• Tailscale authentication credentials
• Contents of any file accessed through the Application

We do not use advertising identifiers (IDFA) or any equivalent tracking technologies. meshTerm does not contain advertising SDKs or analytics SDKs that transmit personal data to third parties.

2 Information We Do Collect

2.1 Crash Reports

If the Application crashes, anonymised crash data may be collected through Apple's standard crash reporting infrastructure (if you have opted in to sharing diagnostic data with app developers in your iOS Settings). This data includes:

• Stack traces showing which code was executing at the time of the crash
• Device model and iOS version
• Application version
• Date and time of the crash

Crash reports explicitly exclude terminal content, SSH credentials, command history, and any other user data. We configure our crash reporting to prevent any such data from appearing in crash logs.

2.2 Subscription Information

When you purchase a meshTerm Pro subscription, Apple processes your payment and provides the Application with a transaction receipt. We receive:

• Confirmation that a valid subscription exists
• The subscription product identifier (monthly or annual)
• Subscription expiry date

We do not receive your payment card details, billing address, or Apple ID. All payment processing is handled entirely by Apple Inc.

2.3 iCloud Sync Data

If you use iCloud sync for your snippet vault, host configurations, and settings, this data is stored in your personal iCloud account using Apple's CloudKit framework. This data is:

• Stored in your iCloud account, not on Developer-operated servers
• Encrypted in transit and at rest by Apple
• Subject to Apple's iCloud privacy policy
• Accessible only to you and to the Application running on your devices

We do not have access to the contents of your iCloud data.

3 How Information Is Stored on Your Device

3.1 SSH Credentials

SSH private keys and passwords are stored in the iOS Keychain with the following protections:

• Private keys: kSecAttrAccessibleWhenUnlockedThisDeviceOnly - requires device to be unlocked, never backed up to iCloud or transferred to other devices
• Passwords: kSecAttrAccessibleWhenUnlocked - protected by your device passcode
• Biometric authentication (Face ID / Touch ID) is required each time a private key is used

3.2 Application Data

All application data stored on your device (host configurations, snippets, themes, known SSH host keys) is protected by iOS Data Protection with NSFileProtectionComplete, meaning data is encrypted when the device is locked.

3.3 SSH Host Keys

SSH host key fingerprints are stored locally on your device only and are not synchronised to iCloud. This is intentional - known host key trust is device-specific for security reasons.

3b Data on Your Remote Hosts (Roam)

When you enable Roam on a host, the Application installs an open source helper program called mtroamd onto that host. Roam is opt-in per host and is off by default. Once enabled, the following data is stored on that remote host - a server you own or have legitimate access to - and not on the Developer's infrastructure:

• The terminal session itself (the running shell process) and its scrollback buffer. Scrollback is held in memory by the daemon, with an optional on-disk snapshot when you enable "Persist across daemon restarts" in the host editor.
• A small state directory containing the daemon's certificate and key (used to verify reconnects from your devices), per-session metadata (names, sizes, idle timestamps), and the optional persisted scrollback above.
• Log entries the daemon writes through its service supervisor (systemd-user, launchd, or a nohup-supervised fallback). Log content is operational metadata only and does not include the terminal output of your sessions.

This data is stored under your home directory on the host (typically ~/.local/share/mtroamd/). The Developer has no access to it. It is governed by your own security practices on that host - file permissions, account access, disk encryption, and any backup or syncing software you have installed.

Network traffic between the Application and the daemon flows directly between your device and your server. It does not pass through any Developer-operated server.

You can stop the daemon and remove this data at any time by running the daemon's uninstall command on the host, or by triggering Reinstall (which wipes the binary and supervisor unit) from the host detail screen in the Application.

4 Tailscale

The Application integrates with Tailscale networking. When you use Tailscale features:

• You authenticate directly with Tailscale using your Tailscale account - your Tailscale credentials are never seen by the Developer
• The Application creates an independent Tailscale node associated with your Tailnet
• Network traffic flows directly between your device and your Tailscale nodes, or via Tailscale DERP relay servers - it does not pass through Developer-operated infrastructure
• Tailscale's own privacy policy governs data processed by Tailscale infrastructure

5 Third-Party Services

The Application uses the following third-party open source components. These run entirely on your device and do not transmit data to third-party servers:

• Tailscale iOS SDK - BSD-3-Clause licence - tailscale.com
• SwiftNIO SSH - Apache 2.0 licence - Apple Inc.
• SwiftTerm - MIT licence - Miguel de Icaza

The Application does not integrate any advertising networks, social media SDKs, or data broker services.

External services the Application can contact

Beyond your own servers, the Application contacts the following third-party endpoints - each only for the purpose, and under the condition, noted:

• Your SSH hosts - the servers you choose to connect to. This is the core function of the Application; this traffic goes directly to your own hosts.
• github.com - to download the signed mtroamd daemon and CLI over HTTPS, only when you choose to install or update Roam on a host.
• Tailscale coordination servers and api.tailscale.com - only if you add a Tailscale auth key (to join your tailnet) or a read-only API token (to browse your devices). Your Tailscale auth keys and API tokens are stored in the iOS Keychain, the same as your SSH credentials.
• Apple - App Store / StoreKit endpoints process the optional Pro subscription (see section 6).

6 Apple App Store and Apple Services

The Application is distributed through the Apple App Store. Apple may collect certain information in connection with your download and use of the Application, including your Apple ID and device identifiers, subject to Apple's own Privacy Policy available at apple.com/legal/privacy.

In-app subscription purchases are processed by Apple. Apple's privacy policy governs the data collected in connection with those transactions.

7 Children's Privacy

meshTerm is not directed at children under the age of 13 (or 16 in the European Economic Area). We do not knowingly collect personal information from children. The Application is intended for use by developers, system administrators, and technical users who manage remote Linux infrastructure.

8 Your Rights

Under the UK General Data Protection Regulation (UK GDPR) and applicable data protection legislation, you have the following rights:

• Right of access - to request information about personal data we hold about you
• Right to rectification - to correct inaccurate personal data
• Right to erasure - to request deletion of personal data we hold
• Right to restriction - to restrict processing of your personal data
• Right to data portability - to receive your personal data in a portable format
• Right to object - to object to processing of your personal data

Given the privacy-by-design nature of meshTerm, we hold minimal personal data about you. Most data is stored exclusively on your device and in your iCloud account, both of which you control directly. To exercise any of these rights or for any privacy-related enquiry, please contact us at the address below.

9 Data Retention

We retain crash report data (if collected through Apple's crash reporting) for a period of up to 12 months, after which it is deleted. This data is anonymised and cannot be linked back to you individually.

Subscription transaction data is retained for the period required by applicable tax and financial regulations, typically 7 years in the United Kingdom.

All other data (SSH credentials, snippets, host configurations) is stored exclusively on your device and in your iCloud account. Deleting the Application removes all locally stored data. You can manage iCloud data through your device Settings → Apple ID → iCloud → Manage Storage.

10 Security

We implement appropriate technical and organisational measures to protect the limited data we handle. The Application itself employs multiple layers of security including iOS Keychain storage, Data Protection, biometric authentication, and SSHv2 with modern cipher suites.

However, no method of transmission over the internet or method of electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your information, we cannot guarantee its absolute security.

11 Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by updating the effective date at the top of this document and, where appropriate, providing notice within the Application. We encourage you to review this Privacy Policy periodically.

Your continued use of the Application after any changes to this Privacy Policy constitutes your acceptance of the updated policy.

12 Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

We will respond to all privacy enquiries within 30 days.