PocketTerm Privacy Policy

Effective date: July 28, 2026

PocketTerm is an SSH terminal and remote-workspace app published by Walldoff Studios ("we", "us", or "our"). This policy explains what PocketTerm stores, what leaves your device, and the choices you make when using the app.

Summary

• PocketTerm has no publisher-operated account, cloud API, analytics SDK, advertising SDK, tracking, or third-party crash-reporting SDK.
• We do not receive your saved hosts, credentials, private keys, terminal sessions, commands, files, clipboard contents, photos, videos, voice audio, or transcripts.
• Network connections are initiated for features you choose: connections to servers you configure, iCloud host-metadata sync, Apple Speech when local recognition is unavailable, and a one-time Hugging Face model download when you select Whisper.
• Passwords, private keys, passphrases, and trusted host-key fingerprints are stored in the device Keychain and are not synced by PocketTerm.
• Image-to-text recognition uses Apple Vision entirely on the device. PocketTerm keeps no OCR history and never automatically runs recognized text.
• Opt-in terminal alerts use Apple's local notification system. PocketTerm has no push-notification server and does not receive terminal alert content.

Information stored by PocketTerm

Host and workspace data

PocketTerm stores the hosts and workspace settings you create in its app container. A host record may include:

• a user-provided display name, hostname or IP address, port, and username;
• authentication type and a reference to a reusable key (but not the password, private key, or passphrase itself);
• favorites, groups, tags, and connection timestamps;
• tmux, ProxyJump, terminal-profile, and biometric-protection settings; and
• internal identifiers and modification timestamps used for local persistence and synchronization.

PocketTerm also stores command snippets, snippet folders/tags and host scope, non-secret snippet-run history (snippet and host names/identifiers, time, and trigger—but not resolved command text or placeholder values), tunnel profiles, public SSH-key metadata, and app/terminal preferences. A local tmux notification preference contains the saved host identifier and tmux session name you selected; it is not included in PocketTerm's iCloud host sync or written to the SSH host. These records remain in PocketTerm's app container or UserDefaults unless you edit or delete them.

Credentials and trust records

Passwords, imported or generated private keys, key passphrases, and pinned SSH host-key fingerprints are stored as Keychain items. PocketTerm uses WhenUnlockedThisDeviceOnly accessibility, so these items are not synchronized through iCloud Keychain and are not migrated to another device through a backup. If you enable biometric protection for a host, reading that host's credential also requires Face ID, Touch ID, or the device passcode.

Public-key text, key names, algorithms, and fingerprints are non-secret and may be stored in PocketTerm's app container so that the key manager can display them.

Temporary files and downloaded models

Downloads, terminal exports, camera captures, and other content selected for sharing or upload may be written temporarily inside PocketTerm's app container. PocketTerm removes temporary transfer files when their operation is completed, cancelled, or cleared where the feature supports it. The operating system can also manage temporary storage.

If you select Whisper voice input, the chosen Core ML model is downloaded into PocketTerm's app container and retained for future on-device transcription. Model sizes range from roughly 75 MB to several gigabytes.

Images used for Extract Text from Image are held only for the active decode and recognition operation. The editable extracted text remains only in memory while the terminal session retains its review or Local Compose draft; PocketTerm does not create OCR history or save the source image for this feature.

Information that leaves your device

Servers and endpoints you choose

SSH, SFTP, tmux, ProxyJump, and tunnel traffic goes to the hosts and endpoints you configure. PocketTerm does not proxy that traffic through Walldoff Studios. The operator of a server can receive your network address, authentication attempts, terminal input, commands, uploaded files, and any other content you send to it, and can retain that information under its own policies. You are responsible for choosing and trusting those systems.

PocketTerm reads a file, selected photo/video, camera capture, or clipboard item only when you use the related open, paste, share, upload, chat-image, or image-to-text action. An upload sends the selected content to your chosen SSH host. Add Image to Chat then inserts the uploaded image's remote path into active terminal input but does not press Return or submit the message. For Extract Text from Image, Apple Vision processes the image locally; neither the image nor extracted text is sent to Walldoff Studios, Apple Vision servers, or another OCR provider. Extracted text is sent to your chosen SSH host only if you explicitly insert it into the terminal or later send it from Local Compose. Copy writes it only to your local system clipboard.

Remote-controlled terminal output may also request that PocketTerm write text to your system clipboard using the OSC 52 terminal protocol. The Remote Clipboard setting is Ask by default, with Off and Allow options, and PocketTerm rejects empty, non-UTF-8, or decoded payloads over 64 KiB. This does not send clipboard data to us.

If you opt in to Terminal Notifications, a connected remote terminal can emit BEL, OSC 9, or OSC 777 attention signals. For a tmux session you explicitly select, PocketTerm can also observe only output timing after you submit input and heuristically alert after five quiet seconds; it does not retain terminal output or create a completion history. PocketTerm sanitizes and bounds OSC text, rate-limits alerts per session, identifies the originating host, and submits the result to Apple's local notification system. The text may appear in Notification Center or a lock-screen preview according to your Apple settings. On iOS and iPadOS 26, PocketTerm may request Apple's continued-processing runtime for an armed turn. Apple displays only generic task text and progress; the host/session label and terminal output are not placed in that system activity. Apple or the user can stop the task, and force-quitting PocketTerm cancels it. Earlier systems and rejected requests receive only short finite background completion time.

PocketTerm does not use APNs or a publisher-operated push service, and Walldoff Studios does not receive the signal, message, timing, or selected-session preference. Disabling the feature stops new terminal alerts; Apple notification permission can be changed in System Settings.

iCloud host-metadata sync

PocketTerm mirrors the non-secret host records described above, plus deletion records, to your Apple iCloud key-value store so the host list can sync across your devices. Credentials, private keys, passphrases, and trusted host-key fingerprints are excluded. Walldoff Studios does not operate this storage or have an app feature that reads your iCloud records. Apple's handling of iCloud information is governed by Apple's terms and privacy policy.

Apple Speech

When Apple Speech is selected, PocketTerm requests on-device speech recognition whenever the device reports that it is supported. On a device or locale where on-device recognition is unavailable, Apple Speech may send dictated audio to Apple to provide recognition. The resulting transcript is returned to PocketTerm for your review or selected snippet action. PocketTerm does not send that audio or transcript to Walldoff Studios. Apple's handling is governed by Apple's privacy policy and your device settings.

Whisper model download

Selecting Whisper starts a model download from the public Hugging Face Hub (huggingface.co and its download infrastructure) through WhisperKit. The request identifies the selected public model and necessarily exposes ordinary network information such as your IP address. Hugging Face states that it may automatically record session date/location, IP address, and device type, model, version, operating system, and related service-use information. See the Hugging Face Privacy Policy for its current practices.

Whisper transcription itself runs locally after the model is available. PocketTerm does not upload microphone audio or transcripts to Hugging Face.

Information we receive

Walldoff Studios does not operate a PocketTerm collection endpoint and does not receive the app content listed in this policy. PocketTerm includes no ads, cross-app tracking, analytics SDK, or third-party crash-reporting SDK.

Apple may separately process App Store transactions, aggregate usage, and platform diagnostics according to your Apple settings and Apple's privacy policy. PocketTerm marks connection labels as private in local unified logs and does not intentionally log credentials, private keys, terminal input, command content, file content, voice audio, or transcripts.

Permissions

PocketTerm asks for operating-system permission only when a related feature needs it:

• Local Network: connect to SSH servers on a local network or Tailnet.
• Face ID: protect selected Keychain credentials with user presence.
• Microphone and Speech Recognition: dictate terminal input with Apple Speech or Whisper; the microphone may also be used when recording a video you choose to upload.
• Camera: capture a photo or video you choose to upload, add a photo to a terminal chat through your SSH host, or photograph text you explicitly choose to recognize on device.
• Photo Library: choose photos or videos to upload, add an image to a terminal chat through your SSH host, or choose an image for on-device text recognition.
• Files: import an SSH configuration or private key, upload a selected file, choose an image for on-device text recognition, or save/share a download or terminal export.
• Clipboard: paste or upload content you request, explicitly choose a clipboard image for on-device text recognition, copy terminal/extracted text or a public key, and handle bounded remote OSC 52 clipboard-copy requests according to your Off, Ask, or Allow setting.
• Notifications: after you enable Terminal Notifications, show bounded, rate-limited local alerts requested by a currently connected terminal or by the per-tmux quiet-output heuristic you selected. The remote host controls optional OSC message text, which may be visible on the lock screen according to your Apple notification-preview settings.

You can review or revoke system permissions in Apple Settings. Features that need a revoked permission will stop working, while the rest of PocketTerm remains available.

Retention and deletion

PocketTerm has no server account for us to delete. You can remove individual hosts, reusable keys, snippets, history, tunnel profiles, and completed transfer files from their related screens.

Settings also provides Delete All PocketTerm Data. It requires you to type DELETE exactly, stops PocketTerm's live terminal/SFTP/tmux-manager/tunnel work, cancels active image recognition, clears its in-memory review, and then independently attempts to remove:

• hosts and deletion records from local storage and PocketTerm's iCloud key-value store;
• the complete PocketTerm Keychain service namespace, including credentials, private keys, passphrases, and trusted host-key fingerprints;
• snippets, non-secret run history, tunnel profiles, and reusable-key metadata;
• UserDefaults preferences, including onboarding, theme, terminal/clipboard/notification, tmux-memory, and voice choices;
• pending and delivered local PocketTerm notifications; and
• PocketTerm temporary downloads/exports and downloaded Whisper models.

PocketTerm reports any step it cannot verify instead of claiming complete success. iCloud removal can remain pending while a device is offline; if the app reports that synchronization was not confirmed, reconnect to iCloud and retry. Files already exported outside PocketTerm are outside its storage boundary, and content or tmux sessions on your remote servers must be deleted under those systems' own controls.

Deleting the app itself removes its app container according to the operating system's behavior, but Apple may retain Keychain or iCloud state independently. Use Delete All PocketTerm Data and allow iCloud changes to synchronize before uninstalling when you also want those records removed.

Hugging Face and Apple apply their own retention rules to information they process. Requests concerning their data should be directed to them.

Security

PocketTerm encrypts SSH traffic using standard SSH protocols, stores secrets in the Keychain, and pins a server's host-key fingerprint after you approve first contact. No software or transmission method can guarantee absolute security. Keep your device and servers updated, verify host-key warnings, protect your credentials, and use servers you trust.

Children

PocketTerm is a technical SSH client and is not directed to children under 13. We do not knowingly operate an account or collection service for children's personal information.

Changes to this policy

We may update this policy when PocketTerm's features, dependencies, or legal requirements change. The effective date at the top identifies the current version. Material changes will be reflected in the published policy and, when appropriate, in release notes or the app.

Contact

For privacy questions about PocketTerm, contact:

Walldoff Studios
WalldoffStudios@gmail.com
https://walldoffstudios.com/

Apple Privacy Policy: https://www.apple.com/legal/privacy/
Hugging Face Privacy Policy: https://huggingface.co/privacy