Shellbay Privacy Policy
Effective: 1.0.0 release date.
Shellbay is an SSH client. It is built so that we — the developer — never receive your data. There is no Shellbay account, no analytics, no advertising and no tracking.
What Shellbay processes, and where it stays
| Data | Where it is stored | Who can access it |
|---|---|---|
| Saved hosts (name, address, port, username, settings), snippets, port-forward rules, trusted server fingerprints, custom workflows | On your device. If you turn on iCloud Sync (Pro), also in your private iCloud database | You (and Apple as your iCloud provider, under Apple's terms) |
| Workflow run history (which workflow ran on which host, your answers such as a domain or port, the steps' results and the last part of the server's output) | On your device only. Never synced, exported or included in device backups | You |
| The sudo password you type for a workflow | In memory only, sent once to your server, then erased. Never stored | You and your server |
| SSH private keys | In your device's Keychain or Secure Enclave. If you turn on key sync for a key, in your iCloud Keychain (end-to-end encrypted by Apple) | You |
| Saved passwords | In your device's Keychain, never synced | You |
| Terminal content, files you transfer with SFTP | In memory while a session is open; files only where you choose to save them | You and the servers you connect to |
| Performance and crash diagnostics (Apple MetricKit) | On your device | You; shared only if you choose "Export diagnostics" and send the file yourself |
Third parties
- Servers you connect to. Shellbay sends your keystrokes, commands, files and credentials only to the SSH servers you configure. Their operators' privacy practices apply.
- Software vendors, when you run a workflow. Workflows make your server download software from its distribution's package repositories and, for some workflows, from vendors such as Docker, NodeSource, MongoDB, Caddy (through Cloudsmith and Fedora COPR), Tailscale, Eclipse Adoptium, the Fedora Project (EPEL), Let's Encrypt and go.dev. Those requests come from your server, not from Shellbay, and each vendor's privacy practices apply. Shellbay itself doesn't contact them.
- Apple. iCloud Sync and iCloud Keychain use your Apple Account. Purchases are handled by the App Store. See https://www.apple.com/legal/privacy/.
Shellbay contains no third-party analytics, advertising or tracking code.
This website
This website (shellbay.eonix.lk) sets no cookies and has no analytics, advertising or tracking code, and it has no forms or accounts. It is hosted by Vercel Inc. To deliver and protect the pages, Vercel processes your IP address and browser details for each request and may keep them briefly in its server logs, under Vercel's privacy policy (https://vercel.com/legal/privacy-policy). When a page fails to load, our own error log records only the page address and a random request ID, never your IP address. Fonts and images are served from this website, so your browser doesn't contact any other site. If you email us, we use your message only to answer it.
Retention and deletion
Data stays until you delete it. Shellbay keeps the 20 most recent finished workflow runs per host and deletes older ones. Settings → Erase All Data removes every host, snippet, custom workflow, workflow run, key, password, trusted fingerprint, preference and diagnostic file from the device and, if sync is on, from your iCloud database. Deleting the app removes local data; Keychain items may persist until you reset the device, so use Erase All Data first.
Children
Shellbay is a developer tool and does not knowingly collect any data from anyone.
Changes
We will update this page and the in-app link if this policy changes.