Privacy policy

your terminals

The apps connect to a phux server that you install and run on your own machine. The connection goes directly from your device to that server: over your local network, over an overlay network such as Tailscale or WireGuard, or through a relay you host yourself. We do not operate a relay, and no phux-operated service sits in that path. Terminal output, scrollback, the commands you type, and session titles never reach us.

When you pair a device with a server, the pairing token and certificate fingerprint are stored on your device (in the iOS Keychain, or encrypted with the Android Keystore). Pairing tokens are never synced to your account and never leave your device except to authenticate to your own server.

The phux command-line tool and server contain no telemetry or usage reporting. They contact GitHub only to download a release, when you run the installer or phux update.

optional Tailscale setup (iOS)

If you choose Tailscale setup to find your computers, the iOS app starts an embedded Tailscale node and asks you to sign in to your Tailscale account. This is separate from an optional phux account. The node contacts Tailscale's control service to read your tailnet's device list. It runs while the device picker is open, not as the transport for your terminal sessions; those use your phone's own network connection or Tailscale tunnel.

Tailscale receives the node's name (host name), public keys, IP addresses, and network and operating-system metadata, associated with your Tailscale account. This is a persistent node, not an ephemeral one. Its identity and authentication state are saved locally outside device backups so you do not have to sign in each time. The app disables Tailscale log uploads, but that does not prevent the identity and metadata exchange needed to join your tailnet.

Signing out of Tailscale setup attempts to reset authentication on a running node, then removes its local state. Closing the picker only stops the node; it does not erase that state. Neither action guarantees deletion of the node record or other data held by Tailscale. Manage the node in your Tailscale admin console; Tailscale's handling and retention of its records are governed by itsprivacy policy.

what stays on your device

Saved servers, preferences, and app settings are stored locally. The apps include no analytics or crash-reporting SDK. Specific device features are used only when you invoke them:

• Camera: to scan a pairing QR code. On Android, scanning uses the Google Play services code scanner, and the app receives only the decoded link.
• Microphone and speech recognition (iOS): to dictate a message. Transcription runs on your device.
• Face ID (iOS): to unlock the app when you turn on the optional app lock.
• Local network: to reach your phux server.

Notifications that a session needs your attention can be generated locally on your device. In iOS builds configured for account-backed push, remote notifications use Apple's Push Notification service (APNs). Registration requires both a signed-in phux account and active Pro access. Where enabled, the app sends its APNs device token and a push grant to the account backend to route notifications to that device. The free iOS release has no account or subscription backend, so this push path is inactive; builds using the no-op registry send no registration to an account backend.

On iOS, the app keeps Apple's MetricKit performance and hang reports in its own storage, capped at the 60 most recent files and excluded from backups. They contain timing and system diagnostics, not terminal content, and are not uploaded. The app's support report is sent only if you share it yourself. You can read it before you share it, and it excludes server names, tokens, account data, and terminal content.

On Android, if you have turned on device backup, Android may include the app's local data in your Google account backup. That backup is between you and Google.

iOS update checks

The iOS app checks for newer versions through the channel it was installed from. App Store builds query Apple's public lookup service at itunes.apple.com, sending the app's bundle ID and, when available, a country code. TestFlight builds requesthttps://phux.sh/api/ios/release, which returns available beta versions. Development builds do not make these update checks.

The receiving service sees your IP address and ordinary HTTP request metadata. Requests to phux.sh are subject to thewebsite processing described below. These checks do not send terminal content, pairing tokens, or your phux account identity. Updates themselves are installed through the App Store or TestFlight.

optional account

An account is optional. Its purpose is to sync your settings across devices. It is hosted on Supabase. You can sign in with Apple (iOS) or with a one-time code sent to your email address. There are no passwords.

When you have an account, we store:

• your email address (with Sign in with Apple, this can be an Apple private relay address) and a random account ID;
• if you use Sign in with Apple, an Apple-issued refresh token, kept only so that we can revoke Apple's sign-in grant when you delete your account;
• the settings you sync: server names and addresses, certificate fingerprints, workspace names (and any tailnet name you attach to a workspace), session collection names and the panes they contain, per-server input and font settings, and app preferences such as the key bar layout, font size, and haptics;
• your commerce ID (see purchases), so that a subscription follows you to a new device.

We do not store pairing tokens, terminal content, or anything you type into a terminal. Signing out only affects the device you sign out on: its local data stays, and syncing stops.

Deleting your account. In the iOS app, open the account screen and tap "delete account". Deleting your account:

• revokes the Apple sign-in grant, if you used Sign in with Apple;
• deletes your RevenueCat customer record;
• deletes your account, your email address, and every synced document from our Supabase database;
• removes the commerce ID from the device and resets its subscription state.

Deleting your account does not cancel an App Store or Google Play subscription. You cancel those in your Apple or Google subscription settings. If your version of the app does not offer in-app deletion, email privacy@phall.io and we will delete your account and associated data.

purchases

Subscriptions bought in the app are sold by Apple (App Store) or Google (Google Play), who process payment. We never see your card or payment details.

We use RevenueCat to track which subscriptions are active. The app creates a random commerce ID on your device and uses it as your RevenueCat customer ID. It is not your email address, a device identifier, or a pairing token. RevenueCat receives:

• the commerce ID;
• your purchase and subscription transactions from Apple or Google;
• technical details that its SDK sends with each request: platform, operating system version, device model, app version, preferred languages, and store country. On iOS, this also includes Apple's identifier for vendor, an ID that is specific to our apps on your device and cannot be used to link you across other companies' apps.

We do not send RevenueCat your email address, name, server information, or anything from your terminals. Where web purchases are offered, Paddle processes them as merchant of record, and RevenueCat links them to the same commerce ID.

the website

phux.sh and docs.phux.sh run on Cloudflare. The site loads no third-party analytics script and sets no cookies for ordinary visits. Its fonts load from Bunny Fonts, which receives your IP address as part of that request. Two kinds of measurement run on the server side.

Public aggregate counters. For each request, the site increments hourly counters by user-agent class (for example "browser" or a named AI crawler), country, hostname, response status, and type of request. These counters contain no IP addresses, raw user agents, or cookies. They are published live at /telemetry.

Private analytics. Each request is also recorded in a private event store. It stores the hostname and page path (never the query string, except the campaign tags utm_source, utm_medium, and utm_campaign), the referring site's hostname, country, and user-agent class, and for installer downloads the operating system, CPU architecture, and download tool. Visitors are counted with an ID computed from your IP address and user agent under a key that changes every day, so visits cannot be linked from one day to the next. The IP address itself is never stored. To tell people apart from AI agents, crawlers, and scanners, a summary of a visitor's day (user-agent class, country, referrer type, campaign tags, and pages visited; for unrecognized clients, a truncated user-agent string with email addresses removed) can be sent to TypeSafe, an AI classification service. The summary never includes an IP address, email address, or cookie.

The beta list. If you join the beta, we store your email address, the date you joined, the form you used, your country, and your user-agent class. We use it to email you about the beta. We do not sell or rent it. The beta emails include a personal link. If you choose to open it, it sets a first-party phux_mid cookie for one year, which links your later visits on that browser to your beta membership. This cookie is the only way the site identifies an individual visitor, and only happens if you click that link.

TestFlight requests. If yourequest access to phux for iPhone, we send your email address to Apple through App Store Connect, which adds you as a TestFlight tester and emails you the invite. Apple keeps tester records under its own privacy policy. If you ask for the Android beta instead, we add the address to the app's Google Play testing list by hand, and Google handles it under its own privacy policy. We also keep either request on the beta list described above. To leave the beta, tap Stop Testing in TestFlight, leave the test in Google Play, or email us and we remove you as a tester.

The hosted shell. The live terminal on the landing page runs on shell.phux.sh. The basic version needs no sign-in. To unlock the full Linux shell, you sign in with GitHub or Google. From GitHub we read your public user ID, username, and account creation date. From Google we read your account ID, name, and verified email address. Your identity is kept in a signed cookie that expires after 8 hours. On our side, only your provider account ID is kept, to enforce usage limits: launch records are deleted after one hour and daily usage totals at the end of the UTC day. Your IP address is used to rate-limit launches. It is stored in keyed-hash form for rate limiting, and in plain form only while a hosted session is running. Hosted sessions are discarded when they end.

Pairing links. When a phux.sh/connect pairing link opens in a browser instead of the app, the page reads the link on your device and removes the token from the address bar. The page loads no analytics script, and our analytics record only the path, never the token.

what we do not do

• We do not show advertising or use advertising identifiers.
• We do not sell or rent personal data.
• We do not track you across other companies' apps or websites. The iOS app's privacy manifest declares no tracking and no tracking domains.
• We do not use your data to build advertising profiles.

service providers

These companies process data for us, only for the purposes described above. They may process it in the United States and other countries.

how long we keep it

Apple, Google, and Paddle keep their own purchase records under their own policies.

your choices and rights

• Access and export. The iOS app can export everything your account holds as a JSON file: open the account screen and tap "export account data". On other platforms, or for other data, email us.
• Deletion. Delete your account in the app as described above, or email us. To leave the beta list, email us.
• Correction. You can change synced settings in the app. For anything else, email us.
• No account. All terminal features work without an account.

Depending on where you live, you may have further rights, such as objecting to or restricting processing, or complaining to a data protection authority. Email us to exercise any of them. We will not treat you differently for doing so.

children

phux is a developer tool. It is not directed at children under 13, and we do not knowingly collect personal data from them. If you believe a child has given us personal data, email us and we will delete it.

changes to this policy

When we change this policy, we update the date at the top of this page. If a change affects how we use data you have already given us, we will say so on this page before the change takes effect. The history of this page is public in the phux repository.

contact

Questions and requests about privacy: privacy@phall.io.