TurtleShell Privacy Policy

Effective date: July 31, 2026

TurtleShell is an SSH terminal and remote-workspace app published by Walldoff Studios ("we", "us", or "our"). This policy explains what TurtleShell stores, what leaves your device, and the choices you make when using the app.

Summary

• TurtleShell has no analytics SDK, advertising SDK, tracking, or third-party crash-reporting SDK. Standard builds have no publisher cloud API; a separately configured, invitation-only iOS private beta can offer optional reliable notification delivery through AWS, Amazon SNS, and Apple Push Notification service (APNs).
• Generic reliable alerts do not send your saved hosts, credentials, private keys, terminal sessions, commands, files, clipboard contents, photos, videos, voice audio, terminal output, or transcripts to the relay. Optional agent question previews are a separate, off-by-default exception described below.
• Network connections are initiated for features you choose: connections to servers you configure, iCloud host-metadata sync, Apple Speech when local recognition is unavailable, a one-time Hugging Face model download when you select Whisper, and—only in a configured private-beta build—the reliable notification relay you explicitly enable.
• Passwords, private keys, passphrases, and trusted host-key fingerprints are stored in the device Keychain and are not synced by TurtleShell.
• Image-to-text recognition uses Apple Vision entirely on the device. TurtleShell keeps no OCR history and never automatically runs recognized text.
• Opt-in local terminal alerts use Apple's on-device notification system and do not use a TurtleShell server. Optional private-beta reliable notifications are a separate mode, remain off until you enroll, and use only fixed generic copy unless you separately enable question preview in a later supported flow.

Information stored by TurtleShell

Host and workspace data

TurtleShell stores the hosts and workspace settings you create in its app container. A host record may include:

• a user-provided display name, hostname or IP address, port, and username;
• authentication type and a reference to a reusable key (but not the password, private key, or passphrase itself);
• favorites, groups, tags, and connection timestamps;
• tmux, ProxyJump, terminal-profile, and biometric-protection settings; and
• internal identifiers and modification timestamps used for local persistence and synchronization.

TurtleShell also stores command snippets, snippet folders/tags and host scope, non-secret snippet-run history (snippet and host names/identifiers, time, and trigger—but not resolved command text or placeholder values), tunnel profiles, public SSH-key metadata, and app/terminal preferences. A local tmux notification preference contains the saved host identifier and tmux session name you selected; it is not included in TurtleShell's iCloud host sync or written to the SSH host. These records remain in TurtleShell's app container or UserDefaults unless you edit or delete them.

Credentials and trust records

Passwords, imported or generated private keys, key passphrases, and pinned SSH host-key fingerprints are stored as Keychain items. TurtleShell uses WhenUnlockedThisDeviceOnly accessibility, so these items are not synchronized through iCloud Keychain and are not migrated to another device through a backup. If you enable biometric protection for a host, reading that host's credential also requires Face ID, Touch ID, or the device passcode.

Public-key text, key names, algorithms, and fingerprints are non-secret and may be stored in TurtleShell's app container so that the key manager can display them.

Temporary files and downloaded models

Downloads, terminal exports, camera captures, and other content selected for sharing or upload may be written temporarily inside TurtleShell's app container. TurtleShell removes temporary transfer files when their operation is completed, cancelled, or cleared where the feature supports it. The operating system can also manage temporary storage.

If you select Whisper voice input, the chosen Core ML model is downloaded into TurtleShell's app container and retained for future on-device transcription. Model sizes range from roughly 75 MB to several gigabytes.

Images used for Extract Text from Image are held only for the active decode and recognition operation. The editable extracted text remains only in memory while the terminal session retains its review or Local Compose draft; TurtleShell does not create OCR history or save the source image for this feature.

Information that leaves your device

Servers and endpoints you choose

SSH, SFTP, tmux, ProxyJump, and tunnel traffic goes to the hosts and endpoints you configure. TurtleShell does not proxy that traffic through Walldoff Studios. The operator of a server can receive your network address, authentication attempts, terminal input, commands, uploaded files, and any other content you send to it, and can retain that information under its own policies. You are responsible for choosing and trusting those systems.

TurtleShell reads a file, selected photo/video, camera capture, or clipboard item only when you use the related open, paste, share, upload, chat-image, or image-to-text action. An upload sends the selected content to your chosen SSH host. Add Image to Chat then inserts the uploaded image's remote path into active terminal input but does not press Return or submit the message. For Extract Text from Image, Apple Vision processes the image locally; neither the image nor extracted text is sent to Walldoff Studios, Apple Vision servers, or another OCR provider. Extracted text is sent to your chosen SSH host only if you explicitly insert it into the terminal or later send it from Local Compose. Copy writes it only to your local system clipboard.

Remote-controlled terminal output may also request that TurtleShell write text to your system clipboard using the OSC 52 terminal protocol. The Remote Clipboard setting is Ask by default, with Off and Allow options, and TurtleShell rejects empty, non-UTF-8, or decoded payloads over 64 KiB. This does not send clipboard data to us.

If you opt in to Terminal Notifications, a connected remote terminal can emit BEL, OSC 9, or OSC 777 attention signals. For a tmux session you explicitly select, TurtleShell can also observe only output timing after you submit input and heuristically alert after five quiet seconds; it does not retain terminal output or create a completion history. TurtleShell sanitizes and bounds OSC text, rate-limits alerts per session, identifies the originating host, and submits the result to Apple's local notification system. The text may appear in Notification Center or a lock-screen preview according to your Apple settings. On iOS and iPadOS 26, TurtleShell may request Apple's continued-processing runtime for an armed turn. Apple displays only generic task text and progress; the host/session label and terminal output are not placed in that system activity. Apple or the user can stop the task, and force-quitting TurtleShell cancels it. Earlier systems and rejected requests receive only short finite background completion time.

This local terminal-alert mode does not use APNs or a publisher-operated push service, and Walldoff Studios does not receive its signal, message, timing, or selected-session preference. Disabling the feature stops new local terminal alerts; Apple notification permission can be changed in System Settings.

Optional reliable notifications private beta

A specifically configured iPhone/iPad private-beta build can offer Reliable Notifications as a separate, off-by-default feature for invited testers. The local terminal-alert mode above remains available without this cloud service. Enabling reliable notifications sends a random installation identifier and secret, a one-time invitation, and the current APNs device token over HTTPS to a TurtleShell relay hosted in AWS Europe (Ireland), eu-west-1. The secret is stored only as a SHA-256 digest by the relay. Amazon SNS retains the active platform endpoint/device-token routing data while the mode is enabled; TurtleShell's DynamoDB table stores the SNS endpoint reference rather than a second token copy. The device keeps the installation secret in this-device-only Keychain storage.

For an SSH host you later opt in, TurtleShell creates a random, revocable channel identifier/secret and opaque local route. The protected channel credential is stored for that Unix user on the chosen host. The relay stores only its digest and cannot use a host channel to register a device or read an APNs token. The same Unix user or root can nevertheless read, trigger, or suppress that host's alerts. Host setup is explicit and removable. TurtleShell transfers one viewable POSIX script under ~/.local/share/pocketterm-notify/, one viewable mode-0600 Pi lifecycle extension under ~/.pi/agent/extensions/, and one mode-0600 curl configuration under ~/.config/pocketterm/; the helper/config directories and executable are mode 0700. The channel secret is file content, not a command argument, terminal-history value, or URL. Setup does not install a daemon, cron job, package, or modify shell/tmux startup configuration. The extension runs with the same Unix permissions as Pi and is removed with the fixed helper files. Since ~/.pi/agent/extensions/ is Pi's standard user-global extension location, the adapter applies to every Pi session run by that Unix user on the host, not only sessions opened through TurtleShell.

The explicit Run & Notify action runs the reviewed command in a child shell, preserves its output in the terminal, observes its real exit status, and submits only fixed command.succeeded or command.failed plus a random event ID. The command is not sent to the relay. Because it is a child shell, use normal terminal Send for commands such as cd/export that must change the current interactive shell, interactive prompts/full-screen programs, shell-only aliases/functions, and job control.

The Pi adapter is pinned to reviewed Pi version 0.80.10. It waits for Pi's agent_settled event, after automatic retries, overflow compaction, and queued follow-up work. It submits only fixed agent.completed after a final normal stop or agent.failed after a tested final provider error/user abort. Recovered tool errors do not become agent failures, and ambiguous token-length or terminating- tool states emit no exact event. Its sequential pocketterm_question tool always shows the complete question and options in Pi's local terminal UI. With question preview off, unavailable, too long, or above four options, it sends only the fixed needs-input event and keeps the answer local. Only after separate preview consent and a content-free channel capability response may one bounded question and one to four bounded options be submitted transiently as described below. The host polls for at most 15 minutes and receives only pending state or a numeric answer index, which it maps back to its locally held option text. A different Pi version or unavailable helper fails closed with only a fixed local warning; Pi's work and final state are unchanged. Pi must be reloaded or restarted after installation or removal.

Generic reliable events use a fixed type such as command succeeded/failed, agent completed/failed, needs input, or attention. They contain no host name or address, username, tmux/session name, project, working directory, command, terminal output, or agent transcript. The relay stores only pseudonymous IDs, secret digests, the SNS endpoint reference, fixed state, a per-channel preview- consent Boolean, timestamps, option count, and at most a numeric answer index. Generic event deduplication is kept for no more than one hour; answerable question state is usable for no more than 15 minutes with up to a one-hour deletion margin. An installation and its host channels are deleted when you disable the mode or after 30 days without an app refresh. Application logs use fixed result codes and expire after seven days; they exclude bodies, headers, tokens, raw IDs, source IPs, questions, options, and answers. DynamoDB's asynchronous deletion can lag these logical limits.

Show agent questions in notifications is off by default and is not enabled by basic enrollment. When you separately turn it on in a supported beta build, TurtleShell synchronizes that choice to each active host channel. Before sending content, the Pi adapter makes a content-free capability check; the relay checks the channel choice again when it receives the preview. An eligible bounded question (up to 500 characters) and one to four bounded alternatives (up to 120 characters each), also constrained to Apple's complete 4 KiB payload, are then sent over TLS and processed transiently by AWS, Lambda, Amazon SNS, APNs, and iOS so the notification can display them. TurtleShell does not write that text to its DynamoDB records or application logs, but those providers necessarily process and may transiently queue it, and iOS may retain the delivered notification until you clear it. Question text can contain code, paths, names, or secrets; do not enable previews for sensitive terminal work. Your iOS Show Previews setting controls lock-screen visibility.

Numbered notification actions are fixed in the app. Choosing one requires device authentication when locked, opens TurtleShell, shows the full question and selected option, and requires confirmation before only the numeric index is sent. The SSH host maps that index back to its locally held option text. Invalid, stale, long, free-text, or more-than-four-choice prompts fall back to opening TurtleShell.

AWS, Amazon SNS, and Apple/APNs act under their applicable terms and privacy/data processing arrangements and necessarily process ordinary network/control data such as IP addresses and delivery timing. AWS regional storage does not mean all processing is confined to the EU. Reliable delivery is best effort: relay/SNS acceptance does not prove APNs displayed a notification. A push already accepted by SNS/APNs cannot be recalled.

iCloud host-metadata sync

TurtleShell mirrors the non-secret host records described above, plus deletion records, to your Apple iCloud key-value store so the host list can sync across your devices. Credentials, private keys, passphrases, and trusted host-key fingerprints are excluded. Walldoff Studios does not operate this storage or have an app feature that reads your iCloud records. Apple's handling of iCloud information is governed by Apple's terms and privacy policy.

Apple Speech

When Apple Speech is selected, TurtleShell requests on-device speech recognition whenever the device reports that it is supported. On a device or locale where on-device recognition is unavailable, Apple Speech may send dictated audio to Apple to provide recognition. The resulting transcript is returned to TurtleShell for your review or selected snippet action. TurtleShell does not send that audio or transcript to Walldoff Studios. Apple's handling is governed by Apple's privacy policy and your device settings.

Whisper model download

Selecting Whisper starts a model download from the public Hugging Face Hub (huggingface.co and its download infrastructure) through WhisperKit. The request identifies the selected public model and necessarily exposes ordinary network information such as your IP address. Hugging Face states that it may automatically record session date/location, IP address, and device type, model, version, operating system, and related service-use information. See the Hugging Face Privacy Policy for its current practices.

Whisper transcription itself runs locally after the model is available. TurtleShell does not upload microphone audio or transcripts to Hugging Face.

Information we receive

Outside the separately configured reliable-notification private beta described above, Walldoff Studios does not operate a TurtleShell collection endpoint and does not receive the app content listed in this policy. The private-beta relay processes only the minimized routing/event data and optional separately enabled question preview described above; it does not receive terminal sessions, commands, output, or transcripts for generic events. TurtleShell includes no ads, cross-app tracking, analytics SDK, or third-party crash-reporting SDK.

Apple may separately process App Store transactions, aggregate usage, and platform diagnostics according to your Apple settings and Apple's privacy policy. TurtleShell marks connection labels as private in local unified logs and does not intentionally log credentials, private keys, terminal input, command content, file content, voice audio, or transcripts.

Permissions

TurtleShell asks for operating-system permission only when a related feature needs it:

• Local Network: connect to SSH servers on a local network or Tailnet.
• Face ID: protect selected Keychain credentials with user presence.
• Microphone and Speech Recognition: dictate terminal input with Apple Speech or Whisper; the microphone may also be used when recording a video you choose to upload.
• Camera: capture a photo or video you choose to upload, add a photo to a terminal chat through your SSH host, or photograph text you explicitly choose to recognize on device.
• Photo Library: choose photos or videos to upload, add an image to a terminal chat through your SSH host, or choose an image for on-device text recognition.
• Files: import an SSH configuration or private key, upload a selected file, choose an image for on-device text recognition, or save/share a download or terminal export.
• Clipboard: paste or upload content you request, explicitly choose a clipboard image for on-device text recognition, copy terminal/extracted text or a public key, and handle bounded remote OSC 52 clipboard-copy requests according to your Off, Ask, or Allow setting.
• Notifications: after you enable Terminal Notifications, show bounded, rate-limited local alerts requested by a currently connected terminal or by the per-tmux quiet-output heuristic you selected. The remote host controls optional OSC message text, which may be visible on the lock screen according to your Apple notification-preview settings. In a configured private-beta build, the same Apple permission also allows the separately disclosed Reliable Notifications mode to register with APNs and display generic remote alerts or an explicitly enabled bounded question preview.

You can review or revoke system permissions in Apple Settings. Features that need a revoked permission will stop working, while the rest of TurtleShell remains available.

Retention and deletion

TurtleShell has no searchable user profile or normal server account. If you join the reliable-notification private beta, the app shows a shortened installation diagnostic ID and authenticates deletion with its local installation secret; we do not search the relay by host, name, email, or APNs token. Disable and Delete Cloud Registration asks the relay to delete the SNS endpoint and the installation's channels/events. A push already accepted by SNS/APNs and Apple's local notification history cannot be remotely erased. You can otherwise remove individual hosts, reusable keys, snippets, history, tunnel profiles, and completed transfer files from their related screens.

Settings also provides Delete All TurtleShell Data. It requires you to type DELETE exactly, stops TurtleShell's live terminal/SFTP/tmux-manager/tunnel work, cancels active image recognition, clears its in-memory review, and then independently attempts to remove:

• hosts and deletion records from local storage and TurtleShell's iCloud key-value store;
• the reliable-notification cloud registration when reachable, followed by its local installation identity/pending invitation and the complete TurtleShell Keychain service namespace, including credentials, private keys, passphrases, and trusted host-key fingerprints;
• snippets, non-secret run history, tunnel profiles, and reusable-key metadata;
• UserDefaults preferences, including onboarding, theme, terminal/clipboard/notification, tmux-memory, and voice choices;
• pending and delivered local TurtleShell notifications; and
• TurtleShell temporary downloads/exports and downloaded Whisper models.

TurtleShell reports any step it cannot verify instead of claiming complete success. If reliable cloud deletion cannot be confirmed while offline, local deletion still proceeds and the relay's 30-day inactivity cleanup is the backstop. iCloud removal can remain pending while a device is offline; if the app reports that synchronization was not confirmed, reconnect to iCloud and retry. Files already exported outside TurtleShell are outside its storage boundary, and content or tmux sessions on your remote servers must be deleted under those systems' own controls.

Deleting the app itself removes its app container according to the operating system's behavior, but Apple may retain Keychain or iCloud state independently. Use Delete All TurtleShell Data and allow iCloud changes to synchronize before uninstalling when you also want those records removed.

Hugging Face and Apple apply their own retention rules to information they process. Requests concerning their data should be directed to them.

Security

TurtleShell encrypts SSH traffic using standard SSH protocols, stores secrets in the Keychain, and pins a server's host-key fingerprint after you approve first contact. No software or transmission method can guarantee absolute security. Keep your device and servers updated, verify host-key warnings, protect your credentials, and use servers you trust.

Children

TurtleShell is a technical SSH client and is not directed to children under 13. We do not knowingly operate an account or collection service for children's personal information.

Changes to this policy

We may update this policy when TurtleShell's features, dependencies, or legal requirements change. The effective date at the top identifies the current version. Material changes will be reflected in the published policy and, when appropriate, in release notes or the app.

Contact

For privacy questions about TurtleShell, contact:

Walldoff Studios
WalldoffStudios@gmail.com
https://walldoffstudios.com/

Apple Privacy Policy: https://www.apple.com/legal/privacy/
Hugging Face Privacy Policy: https://huggingface.co/privacy