Privacy Policy

Last updated: August 31, 2026

Short version: Tinyhack SSH does not collect any data.

No data collection

Tinyhack SSH and its developer do not collect, receive, sell, or share personal information or device data. The app contains no analytics, advertising, crash-reporting, or tracking SDKs. Network connections occur only when you direct a terminal tool such as ssh, mosh, rsync, or wget to contact a destination you choose. Data sent in those connections goes directly to that destination, not to Tinyhack SSH or its developer.

Data stored on your device

• Shell history and files you create or download are stored locally in the app's private storage on your device. Live terminal sessions exist only on your device while they are running.
• Connection profiles can contain server hostnames, usernames, ports, and optional passwords or Cloudflare Access service-token credentials. These profiles remain in the app's private storage. Passwords and Cloudflare token secrets are encrypted with Android Keystore before a profile is saved.
• SSH private-key material you create or import is stored in the app's private storage (and/or Android Keystore for security keys). SSH authentication sends signatures, not the private key. If you explicitly enable agent forwarding for a trusted profile, that server can request signatures from the agent while the connection is active.
• Preferences (fonts and feature/security toggles) are stored locally.

Retention and deletion

Tinyhack SSH has no developer-operated server and therefore has no server-side user data to retain or delete. Local app data remains on your device until you delete it, remove individual profiles, keys, history, or files, clear Tinyhack SSH's app data in Android settings, or uninstall Tinyhack SSH. Uninstalling or clearing app data removes Tinyhack SSH's private local data.

Security

Android isolates Tinyhack SSH's private files from other apps. Saved connection-profile passwords and Cloudflare token secrets are encrypted using a key held by Android Keystore; an encryption failure causes the credential not to be saved. Android-backed security keys are non-exportable. Ordinary imported or generated SSH private-key files remain in the app's private storage and can optionally be protected with an SSH passphrase.

Terminal-controlled features

Remote terminal output is untrusted. Kitty graphics and OSC 52 clipboard writes are disabled by default and can be enabled separately for an individual profile. OSC 52 permits terminal output to replace the Android clipboard. SSH agent forwarding is also disabled by default and should be enabled only for a server you trust. Web links detected in terminal output require confirmation by default.

Permissions

• Storage — the Google Play build does not request broad all-files access. The F-Droid/direct-download build declares All files access so terminal tools can use filesystem paths, but the feature remains disabled until you explicitly enable Storage Access and grant it in Android Settings. App-created files and shell data otherwise remain in Tinyhack SSH's private storage.
• Biometrics — optional, used only to authorize SSH agent operations with security keys.
• Notifications — optional, used for the visible foreground-service notification that helps terminal sessions remain connected in the background, and for notifications explicitly emitted by terminal programs.

Optional local debug server

Development builds include an optional HTTP Debug Server for local automation; release builds cannot start it. In a development build it is disabled by default, listens only on the device loopback interface, and requires a randomly generated bearer token stored in Tinyhack SSH's private files. Requests have strict size, timeout, and concurrency limits. The server can expose terminal contents and control sessions to a client that possesses the token; it does not send data to the developer.

Contact

Tinyhack SSH is developed by Yohanes Nugroho. For privacy questions or requests, email [email protected] or visit the public source repository.