Privacy Policy
This policy explains what SSH Ache collects, what it deliberately cannot collect, how long anything is kept, and how to get rid of it. It is written to be checked against the code rather than skimmed.
1. Who we are
SSH Ache is operated by Noor Ajmir Tanvir, a sole trader based in Bangladesh ("we", "us"). We are the data controller for account, billing and security data. For team content that you upload we act as a processor on your team's instructions.
Privacy questions, access requests and deletion requests: tanvirmahin24@gmail.com. We answer within 30 days.
2. What this policy covers
- The mobile app — "SSH Ache Teams" for Android (
com.sshache.teams) and iOS. - The desktop apps — SSH Ache Teams and the SSH Ache community edition for macOS, Windows and Linux.
- The website and web app at sshache.com, including the marketing pages, the documentation, and the signed-in app at
/app. - The backend — our API and the session relay used by the web terminal and session mirroring.
3. What we cannot see
SSH Ache Teams is zero-knowledge. Your SSH secrets — passwords, private keys, passphrases — and your connection hostnames and usernames are encrypted on your device before they ever reach us. Our servers store only ciphertext and keys that are themselves wrapped to your device's public key. We do not have, and cannot derive, the keys that decrypt your connection secrets. A legal demand served on us cannot produce your plaintext credentials, because we do not possess them.
The one documented exception is the web terminal and session mirroring feature: when you deliberately open a session through our relay, the terminal output of that session passes through the relay so it can be displayed in a browser or watched by a teammate. The relay holds session keys in memory only, for the life of the session. If this matters to you, use the desktop or mobile client, which connect to your servers directly.
4. What we do collect
4.1 If you never create an account
The desktop apps work fully offline with no account. In that mode nothing is sent to us at all: hosts, keys and history stay in your operating system's keychain and app-data directory on your own machine. The apps contain no analytics, no crash-reporting SDK and no advertising SDK.
4.2 Account and identity
- Email address and display name — to identify your account, send invitations and security notices.
- A password verifier (a salted Argon2id hash). Your password itself is never transmitted to us.
- Public keys (X25519, Ed25519) in the clear, and your private keys encrypted on your device — an opaque blob to us — so you can unlock on a new device.
- Recovery-code hashes and, if you enable it, a two-factor (TOTP) secret.
4.3 Devices and sessions
- A device record per signed-in device: device name, a hashed refresh token, IP address, browser or app user-agent, and last-seen time. This is what powers the device list you can revoke from.
- On mobile, signing in uses device linking — you approve the new device from an already-trusted one — so your password is never typed into the phone.
4.4 Team and connection data
- Encrypted: connection secrets, hostnames and usernames — ciphertext plus wrapped keys, unreadable by us.
- Not encrypted: the routing-neutral metadata needed to run the service — team names, folder structure, membership, roles, record identifiers, version numbers and timestamps.
4.5 Security and audit logs
Every privileged action writes an audit event: who did it, what action, which record, the IP address, the user-agent and the timestamp. We also keep short-lived rate-limit and authentication-failure counters to block brute force and abuse.
4.6 Billing
Paid plans are sold through Lemon Squeezy, which is the merchant of record and handles payment and tax. They receive your email and billing country. We store only their customer and subscription identifiers, your seat count and invoice references. We never receive or store your card number.
4.7 Website analytics
The marketing and documentation pages run Google Analytics in cookieless mode: it sets no cookie, writes nothing to your browser's storage, IP addresses are truncated, and Google Signals and ad personalisation are switched off. Because nothing is stored on your device there is no consent banner to click. The signed-in app (/app), the device-link page, the desktop apps and the mobile app load no analytics at all — their URLs carry team and connection identifiers, and a zero-knowledge product has no business shipping those to a third party.
5. The mobile app specifically
Google Play requires a precise account of what a mobile app does. For SSH Ache Teams:
| Data type | Collected? | Why |
|---|---|---|
| Email address, name | Yes — sent to our servers | Account identity and team membership |
| App activity / audit events | Yes — sent to our servers | Security records for your team |
| IP address, user-agent | Yes — sent to our servers | Session security and abuse prevention |
| SSH credentials and hostnames | End-to-end encrypted | Unreadable by us; decrypted only on your device |
| Biometric data (fingerprint / face) | No | Unlock is handled entirely by Android or iOS; the app receives only a yes/no result and never sees a biometric template |
| Location, contacts, photos, calendar, SMS, call logs, files | No | Never requested and never accessed |
| Advertising ID or any device identifier for tracking | No | The app contains no advertising or analytics SDK |
| Crash logs and diagnostics | No | No crash-reporting SDK is bundled |
The app requests only two Android permissions: INTERNET, because every feature is a network client, and USE_BIOMETRIC (with USE_FINGERPRINT on Android 9 and older), to offer an app lock. Your identity key, refresh token and known-host fingerprints are held in the Android EncryptedSharedPreferences store or the iOS Keychain. Connection secrets are fetched, used for the session and dropped — they are never written to the device's storage.
We do not sell your data, share it with data brokers, or use it for advertising — on any platform.
6. How we use it, and on what legal basis
| Purpose | Data | Legal basis (UK/EU GDPR) |
|---|---|---|
| Create and run your account | Email, name, password verifier, keys | Performance of a contract |
| Keep you signed in, secure sessions | Device records, IP, user-agent | Contract; legitimate interest in security |
| Store and sync team content | Ciphertext, wrapped keys, metadata | Contract (as processor, on your team's instructions) |
| Audit logging | Actor, action, target, IP, timestamp | Legitimate interest in security and accountability |
| Prevent abuse and brute force | IP, failure counters | Legitimate interest |
| Take payment | Email, country, subscription ids | Contract; legal obligation for tax records |
| Service email — invites, security alerts, receipts | Email, name | Contract |
| Understand which pages bring people to the site | Truncated IP, page and referrer | Legitimate interest (no cookie or device storage is used) |
7. Who else touches your data
We use a small number of sub-processors, each under contract, and only as needed to run the service:
| Provider | Purpose | What they see |
|---|---|---|
| Lemon Squeezy | Payments, subscriptions, tax (merchant of record) | Email, billing country, seat count |
| Our hosting provider | Servers, database, cache | All stored data — team secrets remain ciphertext |
| Object storage (Cloudflare R2 / Amazon S3) | Encrypted backups, session recordings | Encrypted blobs |
| Transactional email provider | Invitations, security alerts, receipts | Email address, message content |
| Google Analytics | Marketing-page statistics, cookieless | Truncated IP, page, referrer |
Beyond that, we disclose data only when we are legally required to, and we will tell you unless we are legally barred from doing so. We do not sell personal data, and we do not share it for cross-context behavioural advertising.
8. Where your data is
Our database, cache and primary object storage sit in a single region. Lemon Squeezy, our email provider and Google Analytics may process data outside that region; those transfers rely on the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum.
9. How long we keep it
| Data | Kept for |
|---|---|
| Account, keys and team content | As long as the account exists, then erased within 30 days of deletion |
| Audit events | 7 days on Team Free · 90 days on Team Pro · unlimited on Team Enterprise |
| Connection change history | Not retained on Free · 30 days on Pro · full history on Enterprise |
| Sessions and refresh tokens | Until they expire or you revoke the device |
| Rate-limit and security counters | Minutes to hours |
| Pending invitations | Until accepted or expired, plus a 7-day grace period |
| Encrypted backups | A rolling 30-day window, then destroyed |
| Invoices and tax records | As long as tax law requires, even after account deletion |
10. Your rights
Wherever you live, you can ask us to give you a copy of your data, correct it, delete it, export it in a portable format, restrict or object to how we use it, and withdraw any consent you have given. If you are in the EEA or the UK you also have the right to complain to your data protection authority. If you are in California you have the equivalent rights to know, delete, correct and opt out — and we confirm we do not sell or share your personal information.
Exercise any of these by emailing tanvirmahin24@gmail.com from your account address, or from the app itself. Deleting your account is self-serve and immediate — here is exactly how.
11. Security
All traffic to our servers uses TLS. Passwords are stored only as Argon2id verifiers. Connection secrets are end-to-end encrypted with XChaCha20-Poly1305 and AES-256-GCM before they leave your device; keys are wrapped to per-user X25519 keypairs and rotated when membership changes. Data at rest is stored on encrypted volumes, and audit logs are hash-chained so tampering is detectable. On your own devices, secrets live in the operating system's keychain rather than in a plaintext config file.
No system is perfect. If you find a vulnerability, please report it to tanvirmahin24@gmail.com before disclosing it publicly, and we will work with you on a fix.
12. Children
SSH Ache is a professional tool for system administrators and developers. It is not directed to children, and we do not knowingly collect personal data from anyone under 18. If you believe a child has given us data, email tanvirmahin24@gmail.com and we will delete it.
13. Changes to this policy
If we change this policy materially we will update the date at the top and, for changes that affect how we handle your data, email account holders before the change takes effect. Previous versions are recoverable from the site's public repository history.