Privacy policy

1. Who we are

PocketCmd ("the App") is made by Moodyprogramming FZE, Desk 27-B Maktabi, Floor 18, Sheikh Rashid Tower, Dubai World Trade Centre, Dubai, United Arab Emirates ("we", "us"). We are responsible for the personal data described in this policy. You can reach us about privacy at [email protected].

2. Overview

PocketCmd is built so that we hold as little about you as possible. There is no PocketCmd account. The App contains no analytics, advertising or tracking SDKs, and the public builds contain no crash reporter. Your servers, credentials, keys, files and terminal sessions stay on your device or go directly to your own servers; we never see them.

Only three things in the App ever contact us, and each is explained below:

• The license server, if you use PocketCmd Pro (section 6).
• The push relay, if you turn on alert notifications, which are part of Pro (section 7).
• The update check, in the builds downloaded from this website (section 8).

3. What stays on your device

Your servers, connection settings, passwords, SSH keys and passphrases, vault items, snippets, dashboards and settings are stored on your device only, using its secure storage:

• iOS and iPadOS: credentials in the iOS Keychain, with hardware-backed keys in the Secure Enclave where available
• Android: credentials in the Android Keystore, with hardware-backed keys (StrongBox or TEE) where available
• macOS: credentials in the macOS Keychain, with vault keys in the Secure Enclave where available
• Windows and Linux: credentials in the platform credential store (Windows Credential Manager, or the Secret Service keyring on Linux), with vault keys backed by a TPM 2.0 chip where available
• Everything else: in an encrypted database on the device

None of this is sent to us, and none of it is included in anything the App sends to us.

4. Your connections and the companion server

The App connects directly from your device to the servers you add, using SSH, Mosh, Eternal Terminal or Telnet. These connections do not pass through us, and we cannot see, log or record them. SSH, Mosh and Eternal Terminal are encrypted; Telnet is not, and the App warns you before it sends anything over Telnet. Transferring your SSH configuration by QR code also happens directly between your computer and your device on your local network.

The optional companion server is open source (github.com/pocketcmd/pocketcmd-server) and runs on a machine you control. Data you sync through it is encrypted on your device (AES-256-GCM) before it leaves, so your server stores only data it cannot read. Neither the server nor anything synced through it ever reaches us.

5. Where you get the App, and how you pay

You can get PocketCmd from the Apple App Store (iPhone, iPad and Mac), Google Play (Android), the Microsoft Store (Windows), or as a direct download from this website (macOS, Windows and Linux). The store you use processes your download under its own privacy policy.

PocketCmd Pro is paid for in one of two ways:

• Apple and Google process Pro purchases made in the App Store (including the Mac App Store) and in Google Play.
• Paddle.com is the merchant of record for Pro bought on this website and in the Windows app from the Microsoft Store. Paddle collects your payment and billing details under its own privacy notice.

We never receive your card number or any other payment details. See the Apple, Google and Microsoft privacy policies for the stores.

6. PocketCmd Pro: licenses and purchases

You never sign up with us. If you use PocketCmd Pro, a small license server that we run at license.pocketcmd.com checks that your purchase or license key is valid. This section explains what it stores, why, and for how long.

The App contacts license.pocketcmd.com only:

• to activate a license key on a device, to check that the key is still valid (roughly once a week), and to deactivate a device
• if your Pro comes from an App Store or Google Play purchase: once after you buy, and then about once a day, to confirm the purchase. That device holds one of the purchase's 3 device slots and keeps Pro while it keeps checking in; after 14 days without a check-in, its Pro lapses until it checks in again.
• if you bought Pro in the App Store or Google Play and choose "Use on other devices", to create a license key from that purchase

These requests send:

• your license key, or the store's proof of your purchase
• a random install ID generated by the App. It is not derived from your device's hardware or any other identifier.
• the platform name (iOS, Android, macOS, Windows or Linux)
• the App version

Like any web server, the license server sees your IP address when a request arrives. It uses it only for short-term protection against abuse and does not store it with your key or device records.

The license server stores:

• Your key, as a hash only: we store a SHA-256 hash of your license key, never the key itself.
• Key details: where the purchase was made (Paddle, the App Store or Google Play), the plan (subscription or lifetime), whether the key is active or revoked, and when the current period ends.
• Paddle purchases: the email address you bought with and Paddle's subscription or transaction ID. We use the email only to send you your key and to send it again if you lose it.
• Store purchases: the store's original transaction reference, so we can check with Apple or Google that the purchase is still valid and has not been refunded. No email address is stored for store purchases.
• Your devices: for each device that uses the purchase or key, the random install ID, the platform name, the App version, and when the device was first and last seen. This is how the 3-device limit works.
• Lost-key requests: when you ask for a lost key to be sent again, a hash of the email address and your IP address, to limit how often requests can be made. When we email you a confirmation link, the email address is kept with that link.
• Purchase notifications from Paddle: kept in full only until they are processed. After that, only the notification's ID and type are kept, so the same notification is never processed twice.

We keep this data only as long as needed:

• Device records that are deactivated (by you in the App, or when a device unused for 60 days gives up its slot) are deleted one year after deactivation.
• Lost-key request records (hashed email and IP address) are deleted after 2 days. The email address stored with a confirmation link is deleted 2 days after the link expires.
• Paddle notification IDs are deleted after 90 days.
• The key record itself, including the purchase email stored with it, is kept for as long as the key can be used, and deleted 2 years after the key expires, is refunded or is revoked. The 2 years let us answer late refund and chargeback questions.

The license server and its database are hosted by Cloudflare (see the Cloudflare Privacy Policy).

7. Push notifications for alerts

Alert notifications are part of Pro, work on phones and tablets, and are sent by a companion server you have paired with the App. Nothing described here happens until you allow notifications in the App: before that, the App does not create a push token at all.

Once you allow them, your device's push token (from Firebase Cloud Messaging, which on iPhone and iPad uses Apple's push notification service) is sent to:

• Google Firebase, which delivers the notifications, under the Google Privacy Policy
• our push relay at push.pocketcmd.com, hosted by Cloudflare, which signs the token so your server can use it. The relay stores nothing.
• your own paired companion server, which stores it so it can send you alerts

When your server raises an alert, it sends the alert's title and text through the relay and Firebase to your device. The relay passes them on and keeps nothing. To stop alerts, turn off notifications for PocketCmd in your device settings or unpair the server.

8. The update check

The builds downloaded from this website (macOS, Windows and Linux) check https://pocketcmd.com/version.json at most once a day to tell you when a new version is available. It is a plain request that carries nothing identifying, and you can turn it off in Settings › About. Builds from the App Store, Google Play and the Microsoft Store never make this request; their store updates them.

9. Data security

• Credentials and keys are kept in the platform's secure storage, never in plain text
• The vault is sealed with hardware-backed keys where the device has them, and opening it always requires your app password
• The App's database on the device is encrypted
• Host keys are pinned on first connect and checked on every connection after that
• The license server stores license keys as hashes only
• Everything the App sends to us travels over HTTPS

10. Legal bases and transfers

We process license and device records to provide the Pro features you bought (performance of a contract), and use IP addresses and the device limit to protect the service against abuse (our legitimate interest). Push tokens are processed because you asked for alert notifications by allowing them. Our service providers (Cloudflare, and Google for push delivery) may process this data outside your country, under their standard contractual safeguards.

11. Your rights

• To see what the license server holds about your key, or to have it deleted, write to [email protected] with your license key or the email address you bought with. Deleting the record removes your key from the license server, so it can no longer be validated: if your purchase is still active, Pro stops unlocking with that key.
• Everything else is on your device. You can export it with the App's export feature, and deleting the App deletes it.
• You can stop push notifications at any time in your device settings.
• You can also lodge a complaint with the data protection authority where you live.

12. Children

PocketCmd is made for developers and system administrators and is not directed at children. We do not knowingly collect information from anyone under the age of 13.

13. Changes to this policy

When this policy changes, we post the new version on this page with a new "Last updated" date. We announce material changes in the App's release notes.

14. Contact

Moodyprogramming FZE, Desk 27-B Maktabi, Floor 18, Sheikh Rashid Tower, Dubai World Trade Centre, Dubai, United Arab Emirates.

[email protected]