Who we are
MySSH is an SSH client for Mac and Windows, together with its cloud for sync and this website. In this policy “MySSH”, “we” and “us” mean the team that makes and runs them. Questions about privacy go to support@myssh.app.
This website
- No cookies, no analytics, no tracking pixels and no third-party scripts. Fonts come from our own server.
- Your choice of theme and language is kept in your browser’s local storage. It never reaches us.
- The site is delivered through Cloudflare, which handles your IP address and your request in order to deliver the page and protect it from attacks.
- Like any web server, ours keeps short technical logs of requests, which can include IP addresses.
The app without an account
Hosts, passwords, keys, snippets and command history stay on your computer, in an encrypted vault. None of it is sent to us.
To check for updates, the app asks our server which release is current. Like any request, this carries your IP address and the app’s version, and nothing about your hosts or your work. Connections to your servers go straight from your computer and never through us.
With an account
An account is needed only for sync. With one, our server keeps:
- Your email, which is your login.
- A hash of your sign-in key. The key is derived from your master password on your device; the password itself is never sent.
- Your encrypted records: hosts, identities, snippets, settings and the public keys of your saved hosts' servers, and SSH keys only if you turn sync on for them. We cannot read them. Next to each we see its size, when it changed and from which device.
- Your devices: the name of each, its system and app version, and when it last signed in, so that you can recognise them and revoke their access.
- Your plan, if you choose a paid one: which plan and until when.
- How much you used AI suggestions: how many you asked for and how many tokens they took, by day. Not what you asked.
To protect accounts from password guessing, the server briefly counts failed sign-in attempts in memory. How the encryption works is described on the security page.
Account pages in a browser
From the app you can open your account in a browser. Those pages, at cloud.myssh.app, set two cookies: one keeps you signed in for up to 24 hours and stops working when the device that opened the pages is signed out, the other remembers the language. Neither is used for anything else.
AI suggestions
AI suggestions work only with an account, and only when you ask: nothing is sent until you choose “Turn the text into a command with AI”. Then the app sends our server the line you typed, your server’s system and shell, the folder you are in and a few last lines of the screen. Passwords, tokens and keys are taken out on your device before anything is sent, and a line typed with a leading space is never sent.
Our server passes the request to Google Gemini and sends back its answer. It keeps none of the text: only how many suggestions your account asked for and how many tokens they took, to apply the limits of your plan. Google processes the request under its terms for the Gemini API. AI suggestions can be turned off in the app’s settings.
Payments
Payments for paid plans are handled by Creem, which sells the subscription as the merchant of record and calculates and collects taxes. Card details go to Creem, not to us. We learn your account's e-mail as Creem knows it, which plan you have and until when, and whether a payment went through, failed or was refunded. Creem's own privacy policy covers what it does with your payment details.
Why we use it
- To provide what you asked for: sync between your devices, shared sessions, AI suggestions, the account pages and updates.
- To keep MySSH secure and working: against password guessing, abuse and attacks.
- To answer you when you write to us.
We do not use your data for advertising, we do not build profiles of you, and we do not sell or rent your data to anyone.
Who else processes it
- Cloudflare delivers the website and the cloud, protects them from attacks, and runs the STUN server used by shared sessions.
- The company that hosts our server, where the database lives.
- Microsoft, if you install the Windows version from the Microsoft Store, which has its own privacy policy.
- A payment provider, if you pay for a plan.
- Google, which answers AI suggestions through the Gemini API, if you ask for them.
We share your data with no one else, unless the law requires us to.
How long we keep it
- Account data: until you delete the account. You can do that in the app’s settings, with your master password, and everything our server keeps for the account is then erased.
- Technical logs: only as long as needed to keep the service running and secure.
- What is on your devices stays there until you remove it, with an account or without one.
Your rights
You can ask us what we hold about you, ask us to correct or delete it, or object to how it is used, by writing to support@myssh.app. You can delete your account yourself, in the app. Depending on where you live, you may also complain to your data protection authority.
Children
MySSH is a tool for working with servers and is not meant for children. We do not knowingly collect data about them.
Changes to this policy
When this policy changes, we update this page and the date at the top. If a change affects how your data is used, we say so in the app or on this site before it takes effect.