Effective date: 2026-10-26

Roamtty is an SSH terminal client for Android and iOS (together, “the app”). We, the Roamtty developers, run no app backend servers and require no account. We do not automatically collect or upload your personal data, and we do not sell it. When you contact support or share a report, the selected content goes to the recipient you choose. This policy covers Roamtty obtained from Google Play or the App Store, and the website roamtty.com.

• No accounts or ads, no third-party analytics or crash-reporting SDKs, and no automatic diagnostic uploads.
• Hosts, credentials and settings stay on your device; credentials are protected by the system keystore.
• Terminal, file and remote desktop data goes to servers you add; desktop plugin installation may also contact the download services described below. The developers do not automatically receive your session content; contacting support or sharing a report sends the content you choose to the recipient you select.

The following data stays on your device and is used only by the app itself:

• Hosts: name, address, port, username, authentication method, session mode, the detected remote system and whether tmux / mosh are installed.
• Credentials: passwords are stored only when you choose to save them. An imported private key is stored when you save a host using key authentication; there is no separate option to leave the key unsaved. Key passphrases are never saved.
  • Android: passwords and private keys are encrypted with AES-256-GCM using a non-exportable Android Keystore key, and the ciphertext is stored in the local Room database.
  • iOS: passwords and private keys are stored in the system Keychain with “this device only, after first unlock” accessibility, so they never move to another device through backups or device transfer.
• Server trust records: the server public keys and their algorithms you chose to trust, stored by server address and port. The app calculates fingerprints from these keys to detect man-in-the-middle attacks. Host entries using the same address and port share the record.
• Session list: the ID, host, mode, title, remote tmux session name and session number of up to 8 sessions per host, used to restore the session list after the app restarts. It contains no terminal content.
• Agent status previews: the latest agent state, tool and command details, working directory, up to 200 characters of the latest prompt and up to 400 characters of its reply are saved in local preferences (Android: app-private SharedPreferences with backup disabled; iOS: local preferences) to restore session cards after relaunch. Removing the corresponding session clears its previews; uninstalling the app removes its local preferences.
• Local diagnostics (iOS): the app keeps up to 400 event-log entries and 20 iOS MetricKit metric or diagnostic reports to help investigate crashes, hangs and memory issues. These files stay on the device and are not uploaded automatically. From About, you can choose to share them with a recipient through the system share sheet. Review their contents before sharing. Uninstalling the app removes these local files.
• Preferences: language, theme, font (including font files you import), font size, control bar and download folder settings.
• Files you transfer (iOS): files downloaded from a server are saved in the app's Documents folder, visible and removable in the Files app under “On My iPhone › Roamtty”. Images, files and text shared to the app are held in the app's container until you upload or delete them. On Android, downloads are saved where you choose with the system file picker.

Except for the agent previews described above, terminal output, input and text drafts are kept in memory only and never written to disk. The Android app disables system backup and device transfer. The iOS app excludes its host database from iCloud and computer backups, and Keychain credentials never enter backups. Files you download into the iOS Documents folder may be included in your own device backups, like your other files.

When remote desktop is enabled, screen frames, remote sound and keyboard/pointer actions travel between your device and the selected host over SSH or authenticated encrypted UDP, without a Roamtty relay. Sound is played back; the app does not record your phone microphone. Both Android and iOS save the latest desktop frame for each host as a local JPEG thumbnail in app-private storage for host/session cards. It may contain sensitive screen content, remains after disconnection, and is removed when you delete the host or uninstall the app. Android disables system backup and device transfer; on iOS these thumbnails may be included in your own device backups. Display, sound, quality and control preferences stay on your device.

Text is copied between the phone system clipboard and remote clipboard only when you tap the send or get clipboard action; the app does not continuously synchronize clipboards. The remote system and other apps with clipboard access may read their respective system clipboard.

When you choose to install or update the desktop plugin, the phone or remote computer may download the Roamtty desktop plugin from GitHub Releases and OpenH264 from Cisco over HTTPS. Those providers receive the requesting IP address and ordinary network request information under their own policies. The plugin is installed on your selected remote computer; downloaded executable code is not installed into the iOS app.

• Except for plugin downloads you initiate, the app connects to servers you add: SSH (TCP), mosh (UDP), encrypted remote desktop transport, and TCP reachability checks that show whether a host is online and its latency. On iOS, the system asks for Local Network permission before the app connects to a host on your local network.
• SSH and mosh connections are encrypted; the app makes no cleartext HTTP requests (desktop plugin downloads use HTTPS only). Links you tap in the terminal open in the system browser or the matching app.
• When connecting, the app performs read-only operations on the server: it identifies the system, checks whether tmux / mosh are available (stored in the host entry on your device), and reads the remote shell history file to suggest common commands. Common commands are cached only in the session's memory and may remain available to view after disconnecting. They are not written to persistent app storage and do not survive process termination. Host monitoring data (CPU, memory, disk, network, processes) is likewise only shown from memory. Everything else happens only when you ask for it, such as installing tmux / mosh or uploading and downloading files over SFTP.
• When you start Claude Code, Codex or Grok from the app (except in a Windows start folder), the app writes hook files to the server so it can show the agent's status: ~/.roamtty/agent-hook.sh, plus ~/.roamtty/claude-hooks.json (Claude Code) or the launchers ~/.roamtty/codex and ~/.roamtty/grok. The Codex launcher appends trust entries for these hooks to the end of ${CODEX_HOME:-~/.codex}/config.toml (an existing entry with the same name is left alone); the Grok launcher writes ${GROK_HOME:-~/.grok}/hooks/roamtty.json, whose hooks act only for a Grok started from the app. The hooks store the agent's state, the tool and command it is running, the first 200 characters of your latest prompt and the first 400 characters of the agent's latest reply as options of that tmux session, cleared when the agent exits. The app reads them over SSH to show in the session list. Both Android and iOS save the latest status previews locally as described under “Agent status previews” above so session cards restore after relaunch. The app does not automatically send these states to the developers or other recipients. The files stay on the server; you can delete the ~/.roamtty folder, the entries appended to config.toml and roamtty.json at any time, and the next agent started from the app writes them again. None of these files are written unless you start an agent from the app.
• Remote desktop: when a terminal session connects, the app checks read-only, along with the plugin check, whether the host has a graphical desktop (stored in the host entry on your device). Only after you tap the desktop button does the app install the desktop plugin roamtty-desktop and Cisco's OpenH264 encoder under ~/.roamtty/ on the host: the host downloads them from GitHub Releases (github.com/yahaa/roamtty-desktop) and ciscobinary.openh264.org, and when it cannot, the phone downloads them over HTTPS and uploads them over SFTP; both are checked against SHA-256 hashes fixed in the app. The picture, cursor and input travel over the SSH connection you opened, or, when the host is reachable over UDP, over UDP ports 60000–61000 encrypted with AES-128-GCM under a random per-connection key sent over SSH and never stored; when UDP fails it falls back to SSH by itself. Except for the local desktop thumbnails described above, the picture is not written to phone storage; screen content is not logged; the plugin's log records events and statistics only, never pixels, clipboard contents or typed text. The clipboard syncs only when you tap "Send phone clipboard" or "Get remote clipboard". The plugin listens on no TCP port. On macOS it is ~/.roamtty/Roamtty Desktop.app (login item com.roamtty.desktop), on Windows the logon task "Roamtty Desktop"; uninstall it from the plugins page, or delete ~/.roamtty on the host. On Windows, when you connect with an administrator account while nobody is signed in to the PC (it sits at the sign-in screen), the app installs (or an administrator can install it on the PC with the command the desktop page shows) the service RoamttyDesktop, which runs as LocalSystem and starts with the PC, so the sign-in and lock screens can be seen and typed into too. Everything it runs or loads lives in C:\ProgramData\Roamtty, which only SYSTEM and administrators can change; the named pipe between it and the desktop session admits only SYSTEM and the user who installed it, and an inbound firewall rule allows its own UDP. Uninstalling from the plugins page as an administrator removes the service, the firewall rule and C:\ProgramData\Roamtty. To reconnect by itself after a drop, the app keeps the host's password or key passphrase in memory while a desktop connection is open (including the background keep-alive you set, 30 minutes at most) and discards it when the connection closes; it is never written to storage.
• The app contains no ads or third-party analytics or crash-reporting SDKs. It uses open-source components including AndroidX, JSch, Bouncy Castle, SwiftTerm, libssh2 and OpenSSL for its interface, SSH and cryptography; they are not used to collect data for the developers. Connections and file transfers go to the servers you choose. Local diagnostic reports are sent to a recipient only when you choose to share them.

Platform	Permission	Purpose
Android	Internet, network state	Connect to the servers you add and notice network changes
Android	Foreground service, wake lock	Keep the terminal connections you opened alive in the background; released when the last one disconnects
Android	Notifications	Show ongoing connections and offer a “Disconnect all” action
iOS	Local Network	Connect to servers you add on your local network

Uploads, downloads and importing keys or fonts go through the system file picker or the system share sheet, so the app can access only the files you pick. Photos are likewise read only after you pick them, and only uploaded to the server you choose. The app does not access contacts, location, camera, microphone or the advertising identifier.

Other than the plugin downloads described above and external links you choose to open, the app uses no third-party services. If you install it from Google Play or the App Store, Google or Apple handles installation, purchase, payment and store data (such as download counts, order details and crash reports you choose to share) under its own privacy policy, which this policy does not cover. The servers you connect to are controlled by you or their administrators, who are responsible for how they handle data.

roamtty.com is a static website hosted on GitHub Pages and delivered through Cloudflare. It uses no cookies, analytics or tracking scripts. As hosting and network providers, GitHub and Cloudflare may process technical logs such as visitors' IP addresses for security and operations, under their own privacy policies.

We hold none of your data, so there is nothing to ask us to delete. You can delete the data on your device at any time:

• Deleting a host removes its configuration, saved credentials and session records. Server trust records remain stored separately and can be removed with Verify again.
• Android: clearing Roamtty's storage in system settings, or uninstalling the app, deletes all local data stored by the app.
• iOS: uninstalling the app deletes its data and Documents folder. To remove Keychain credentials, delete the hosts in the app before uninstalling.
• Remove the hook files on your servers as described under “Network connections”.

Credentials are protected by the system keystore, connections are blocked when a host fingerprint changes, and session connections are protected by SSH, mosh or encrypted remote desktop transport; plugin downloads use HTTPS. If you find a security issue, please report it privately to the email below rather than disclosing it publicly.

The app is intended for developers and technical users. It is not directed at children under 13 and does not knowingly collect any information from children.

If this policy changes, this page will be updated along with its effective date.

If you have questions about this policy, email roamtty@gmail.com or visit https://roamtty.com/support/.