Privacy policy
Last updated: October 28, 2026 · Current development version
1. Scope and developer
This policy describes the current XShell iPhone and iPad app, developed by GreatWhole90. XShell connects directly to SSH servers you choose. It does not require a XShell service account, use a developer-operated business backend, or include advertising or behavioral analytics SDKs. This development version is not yet publicly distributed.
2. Data stored on your device
Host names, addresses, ports, usernames, authentication method, terminal preferences, language, appearance, server trust records, and sync metadata are stored on the device. Older configurations may retain an unused tmux session field; the app does not automatically execute it. Host configuration files do not contain passwords, private keys, or key passphrases. Local configuration, trust files, migration backups, and diagnostics use file protection and are excluded from system backups.
Saved passwords and imported private keys are managed by the local Keychain with WhenUnlockedThisDeviceOnly protection and iCloud Keychain synchronization disabled. Temporary credentials are held in app memory and are not saved to Keychain or uploaded. They can remain in memory until the app exits; XShell does not promise secure memory erasure. The app currently has no Face ID app lock.
3. iCloud Drive synchronization
Host and preference sync is on by default. When iCloud is available, configuration.json in your own iCloud Drive contains host configuration and terminal, language, and appearance preferences. The local and iCloud files are readable JSON, not an application-encrypted vault. Server trust records, diagnostic logs, and per-device sync switches do not sync.
Apple operates iCloud and may retain downloads, cached files, and file versions according to its services and settings. XShell uses iCloud Documents, not a developer-hosted account service. Turning host sync off pauses this device without deleting local or cloud data. Account changes pause sync until you choose to enable it again.
4. Optional credential sync — plaintext files
Credential sync is OFF by default on every device. If you explicitly enable it, saved passwords and private keys are written to a separate credentials.json file in your iCloud Drive and can be restored on devices where you enable credential sync. This file currently has NO app-level encryption. Anyone or any service with access to that file may read its contents. Temporary, unsaved credentials are not included.
Turning credential sync off stops this device from uploading and downloading credentials; it does NOT delete existing cloud files, iCloud versions, or saved local credentials. Application-level encryption, key management, and removal of older plaintext copies are not implemented yet. Use dedicated SSH credentials and make your own secure backups.
5. SSH connections and terminal content
XShell sends authentication material and terminal input to the SSH server you select, through the SSH connection. It asks you to verify a new server fingerprint before sending login credentials and blocks known fingerprint changes. The server and any VPN or network service you choose are operated separately from XShell.
Terminal output is kept in memory for display and scrollback and is not written to app diagnostic logs or uploaded to the developer. XShell does not automatically export a terminal transcript. You control local copy and paste. Remote terminal requests to read or write the system clipboard are denied. Commands, files, and logs on your remote server remain governed by that server; deleting a host in XShell does not delete remote data.
6. Diagnostics and sharing
Local diagnostic logs contain a fixed set of app, configuration, and connection events, timestamps, session identifiers, and app version information. They exclude host addresses, usernames, passwords, keys, fingerprints, and terminal content. Logs are capped at 500 entries and 256 KB and are not automatically sent to the developer.
You can view, filter, copy, share, or clear diagnostics from the version-row long-press entry. Copy and share contain the filtered results. Copied diagnostic text is marked local-only and expires after five minutes. If you choose to send logs or contact support, the recipient receives the information you choose to share. System-level diagnostics are controlled separately by Apple and your device settings.
7. Permissions and external pages
Local network permission is used to connect to the LAN SSH host you choose; the app does not scan or upload a device inventory. The system file picker grants access to the private key file you choose. XShell uses the system clipboard only for user-initiated copy and paste and offers the system share sheet for diagnostics.
The Website and Privacy policy buttons open web pages only when you tap them. The links include the selected language, not host details, credentials, or terminal content. The website host can receive ordinary web request information such as IP address, user agent, and requested URL for serving and operating the site. These pages can store a language preference in browser local storage; this is separate from app diagnostic data.
8. Your controls, retention, and deletion
Edit or delete a host in the app to manage its configuration. Deleting a host also deletes its saved local Keychain credential and temporary credential, and disconnects it if active. Server trust records have a separate removal control. The default credential-saving setting applies to newly entered credentials and does not remove existing Keychain items. To remove a saved credential, delete its host.
Enabled sync may propagate configuration and credential changes; conflicts and unmatched cloud credentials can pause that process. A local deletion or disabled sync switch is not proof that every cloud copy is gone. There is currently no dedicated in-app action to erase all cloud credential copies. Manage iCloud files through Files/iCloud Drive and Apple’s version and recovery controls. Local configuration and logs remain until removed through the app or system; uninstalling alone does not guarantee that Keychain items or iCloud copies are erased.
9. Security boundaries and third parties
XShell verifies SSH host keys and uses the device Keychain and protected local files. These measures do not make the optional iCloud credential file application-encrypted or guarantee absolute security. Keep your device and Apple Account secure, verify fingerprints through a trusted channel, and do not remove passphrase protection from your primary key for use with this app.
Apple provides iCloud, Keychain, system permission dialogs, file selection, and sharing. Your chosen SSH server receives the data needed for your session. Third-party licenses for SwiftTerm, SwiftNIO SSH, SwiftNIO, and Swift Crypto are available in the app. There is no third-party credential service.
10. Policy updates and contact
This page will be updated when XShell’s data handling changes. The date above identifies this version of the policy. For questions, correction requests, or privacy concerns, contact greatwhole90@gmail.com. Do not include passwords, private keys, or terminal content in a support message.