Privacy policy · SSHPeaches
What we collect, and what we don't
Effective October 8, 2026. Replaces the policy dated March 5, 2026.
- Your hosts, passwords, keys, and everything you type in a session stay on your phone or go only to the servers you connect to. We never receive them.
- There's no account, no ads, and we don't sell or share data for advertising.
- Release versions send crash reports and anonymous usage statistics to Google Firebase by default, with personal details removed. You can turn both off in Settings → Diagnostics & Privacy.
- Anything else, like a problem report, is sent only when you choose to send it.
This policy covers the SSHPeaches Android app, made by Major Daft Apps ("we", "us"). SSHPeaches is open source, so you can check everything described here in its source code.
1. What stays on your phone
Everything you set up in SSHPeaches is stored only on your device:
- Hosts (names, addresses, ports, usernames, notes, and connection preferences), port forwards, snippets, keyboard layouts, themes, and settings.
- Saved passwords, private keys, and key passphrases, which are encrypted using the Android Keystore. If you set an app PIN, secrets are also protected by it.
- The host keys of servers you've trusted (your known hosts).
- Connection logs, which stay on your phone unless you choose to send one to us (see section 4).
SSHPeaches turns off Android's cloud backup for its data, so none of this is copied to your Google account. It stays until you delete it in the app, clear the app's storage, or uninstall the app.
2. Your connections
When you connect, SSHPeaches talks directly to the server you chose, using SSH, SFTP, SCP, or Mosh. Your login details, commands, terminal output, files, and port-forward traffic travel only between your phone and that server. None of it passes through or is copied to us.
3. Diagnostics and analytics
Release versions of SSHPeaches can send the following. Each one is a switch in Settings → Diagnostics & Privacy, and turning one off stops it straight away. When crash reports are turned off, reports that haven't been sent yet are deleted.
| Setting | Default | What it sends, and where |
|---|---|---|
| Crash reports | On | When the app crashes or hits an unexpected error: the error and where in the code it happened, the app screens and session steps leading up to it, app version, phone model, and Android version. Host names, IP addresses, usernames, file paths, and passwords are removed before anything is sent. Sent to Google Firebase Crashlytics. |
| Usage analytics | On | Anonymous statistics about which app actions are used, such as adding a host or starting a port forward. Only the name of the action is sent, never server details or anything you typed. Sent to Google Analytics for Firebase. The advertising ID is not collected, and analytics aren't used for ads. |
| Session diagnostics | Off | Adds more technical detail to the connection log on your phone. Nothing is sent unless you choose Send to developer. |
| Send usage reports | Off | Every 7 days: app version, phone manufacturer and model, Android version, which of these settings are on, and how many hosts, keys, port forwards, and snippets you have (counts only, no names or addresses). Sent to our diagnostics server. |
Firebase may also record a random app-instance identifier and your approximate country, as it does for every app that uses it. See Google's Firebase privacy information. Crashlytics keeps crash reports for 90 days.
Debug builds send none of this.
4. Problem reports you send
When a connection fails, you can tap Send to developer. Before anything is sent, you see the whole report: a summary of the error, the app and Android versions, the recent connection log, and an optional note you can write. Host names, addresses, usernames, file paths, and secrets are removed from it. It goes to our diagnostics server only when you tap Send. Release builds use Firebase App Check (Google Play Integrity) so our server accepts reports only from the genuine app.
We use problem reports and usage reports only to find and fix bugs, and keep them only as long as we need them for that. To have a report deleted, email us.
If you email us, we use your email address and message only to reply to you.
5. Moving data between devices
Export and import happen only when you start them, and never go through our servers:
- Wi-Fi sends your export directly to another phone on the same local network. It's encrypted with a one-time code shown on screen, and the app accepts only local network addresses.
- QR code and File are created on your phone. Passwords and keys are included only if you choose, and then they're encrypted with a passphrase you set.
- Share hands the export file to the app you pick, such as Bluetooth, Quick Share, or email. That app's own privacy policy applies to it.
6. Permissions
- Internet and network state: to connect to your servers, and to notice when your network changes so sessions can reconnect.
- Foreground service and notifications: to keep sessions running when you leave the app, and to show their status.
- Camera: only when you scan a QR code for import or Wi-Fi transfer. Images aren't stored or sent.
- Vibration: for key-press feedback.
- Fingerprint or face unlock: only if you turn on biometric app lock. Android handles it, and SSHPeaches never sees your biometric data.
7. Who else gets data
Only Google, as described in section 3, and only for crash reports and usage analytics. We don't sell personal information, and we don't share it with anyone for advertising.
8. Your choices
- Turn any diagnostics setting off in Settings → Diagnostics & Privacy.
- Edit or delete hosts, keys, port forwards, snippets, and stored host keys in the app.
- Delete everything by clearing the app's storage or uninstalling it.
- Ask us about, or to delete, anything you've sent us: support@majordaftapps.com.
9. Security
We use Android's encrypted storage for secrets, keep app data private to SSHPeaches, verify server host keys, and encrypt Wi-Fi transfers. No system is perfectly secure; if you find a security problem, please email us before making it public.
10. Children
SSHPeaches is a tool for managing servers and isn't directed at children under 13. We don't knowingly collect information from them.
11. Changes
If we change this policy, we'll post the new version here with a new effective date. Significant changes will also be noted in the app's release notes.
12. Contact
Major Daft Apps · support@majordaftapps.com