Privacy Policy

Last updated: 12 August, 2026

SSHush is built so that your data stays yours. The short version: your SSH credentials never leave your device, your metrics are never sent to us, and we collect nothing about how you use the app. The longer version is below.

Who this covers

This policy covers the SSHush app for iPhone and iPad, the SSHush agent, the SSHush backend service, and the website at sshush.app.

The app collects no data about you

SSHush contains no analytics, no tracking, no advertising, and no telemetry. It does not create an account, does not have a user profile, and does not report anything about how you use it back to the developer or to any third party.

Two systems, handled differently

SSHush has two parts, and they have different privacy characteristics.

Live metrics are read by your device, directly from your servers over SSH. Your metrics, your commands, and your credentials never pass through any system we operate. This part of the app has no backend at all.

Alerting is optional and requires a subscription. When you enable it, an agent runs on your server and communicates with our backend. What that involves is described below.

What SSHush stores on your device

• Server details. The name, host, port, and username you enter for each server, along with the host key fingerprint SSHush verified, are stored on your device using Apple's SwiftData. If iCloud is enabled, this list syncs across your own Apple devices through your private iCloud database (CloudKit). It is not visible to the developer or to anyone else.
• Credentials. Your SSH passwords and private keys are stored in your iCloud Keychain, encrypted by Apple. They sync between your devices the same way your other Keychain items do. SSHush only ever reads a credential to make a connection to the server it belongs to.

Because this data lives on your device and in your private iCloud, it is governed by the Apple Customer Privacy Policy (https://www.apple.com/legal/privacy/). The developer has no access to it.

What our backend holds, if you enable alerting

Enabling alerting is a deliberate action you take per server. Until you do, nothing described in this section applies to you.

When you enable it, our backend stores:

• An agent identifier and secret. A random identifier for the agent installed on that server, and a secret it uses to authenticate. These are generated at install time and are not derived from anything about you or your server.
• A push notification token. Apple's identifier for your device, so alerts can be delivered to it. This is issued by Apple and can be reset by you at any time by deleting and reinstalling the app.
• Your subscription identifier. Apple's original transaction identifier for your subscription, used to establish how many servers you are entitled to enable.
• Alert records. When a rule breaches or clears, that transition is recorded so it can be delivered to your device and shown in your alert history.

Our backend does not hold your SSH credentials, your server's hostname or IP address, your username, or your metrics. It is not built to receive them and they are never sent to it.

What the agent sends

Metrics are sampled and rules evaluated on your server. Only a crossed threshold is ever sent - never the underlying numbers. Alongside that, the agent sends a periodic heartbeat so that we can tell you if your server stops reporting.

The agent is open source under Apache 2.0, so you can verify all of this yourself: github.com/inatthegeekend/sshush-agent

Payments

Subscriptions are purchased and managed by Apple. We never see your payment details. Apple provides us with a signed transaction record confirming your subscription is active, which is used only to determine how many servers you may enable alerting on.

Data retention and deletion

Disabling alerting on a server removes the agent from it and its record from our backend. Records for agents that stop reporting are removed automatically after 24 hours of silence.

If you want everything associated with your subscription removed, disable alerting on every server and contact us using the link in the footer.

System permissions

• Local network. iOS may ask SSHush for permission to access devices on your local network. This is used only to reach servers you add by their local network address. SSHush does not scan your network or catalogue what is on it.
• Notifications. If you enable alerting, iOS will ask permission to send you notifications. This is used only to deliver your alerts.

Required-reason system APIs

Apple requires apps to declare certain system APIs and why they use them. SSHush uses:

• UserDefaults, to remember your settings such as the refresh interval. This stays on your device.
• System boot time, to calculate and display each server's uptime. This is a reading from the server, shown to you and not stored or sent anywhere.

The ratings prompt

SSHush may occasionally ask you to rate it, using Apple's standard system prompt. This is handled entirely by Apple. SSHush does not see whether or how you rate it, and no data is collected.

The website

The website at sshush.app is served by Caddy on a DigitalOcean server, with request logging turned off. It sets no cookies, runs no analytics, and uses no advertising or tracking. The site collects nothing about visitors.

Third parties

Apple, through iCloud, Keychain, StoreKit and the Apple Push Notification service. DigitalOcean, who host our backend and database. Neither is given data about you beyond what is described above.

Children

SSHush is a tool for people who administer servers. It is not directed at children.

Changes to this policy

If this policy changes, the updated version will be posted here with a new effective date.

Contact

Questions about privacy can be raised using the 'Contact' link in the footer.