Privacy Policy

The short version

• Your SSH passwords and private keys never leave your phone. They are stored in your device’s secure keychain and are never sent to us.
• Your AI API keys never leave your phone either, except when they are sent with your own AI requests. We do not store them.
• We store what we need to run your account: your email, your devices, your server list (without secrets) and your activity.
• We do not sell your data, we do not show ads, and the app contains no advertising or third-party tracking tools.
• You can ask us to delete your account and data at any time, by email.

What we collect

Account information

When you create an account we collect your email address, an optional display name, and your password. We never store your password itself, only a one-way hash of it (Argon2id) that cannot be turned back into the password. If you sign in with Google, we receive your name, email address and a Google account identifier from Google; we do not receive your Google password.

Devices and sessions

For each phone you sign in on, we store a device name, the platform (Android or iOS), the app version, and when it was last used, so you can see and sign out your devices.

Server profiles

When you add a server we store its non-secret details: the name you give it, host or IP address, port, username, sign-in method (password or key), default folder, and the server’s host key fingerprint once known. We also keep a history of connection events (connected, disconnected, failed). We never store SSH passwords, private keys or passphrases; our servers refuse them if they are ever sent.

Activity and security logs

We record security-relevant events such as sign-ins, failed sign-ins, password changes and server changes, together with the IP address they came from. These logs protect your account and are shown to you in the app’s Activity screen.

AI chat

If you use AI chat, we store your conversations (the text you send and the replies), which AI provider and model answered, and how many tokens were used, so you can come back to your chats. Your AI provider API key is not stored by us.

Emails you send us

If you contact us by email, we keep your message and our reply so we can help you.

What we do not collect

We do not collect the contents of your terminal sessions, the files on your servers, your contacts, your location or your photos. The app does not include advertising or analytics SDKs.

What stays on your device

The following are stored only on your phone, in its secure keychain or local storage, and never on our servers:

• SSH passwords, private keys and key passphrases
• Your Claude or OpenAI API keys
• App preferences such as your theme and recently opened projects

Uninstalling the app removes them from your phone.

What we store on your servers

If you use Claude Code through Hectix, the app keeps its working files and chat history on your own server, in the folder ~/.hectix of the account you sign in with. This data is on your machine, not ours. Claude Code itself runs on your server and is signed in with your own Claude account, so those requests go from your server to Anthropic under your agreement with them. You can delete this folder at any time.

How we use information

• To provide the service: sign you in, sync your server list across your devices and show your activity
• To keep your account secure: detect suspicious sign-ins, stop stolen sessions and investigate abuse
• To run AI chat when you ask for it
• To answer your emails and support requests
• To send you essential messages, such as password reset emails. We do not send marketing email without your consent.
• To meet legal obligations

Where the law requires a legal basis (for example under the GDPR), we rely on performing our contract with you, our legitimate interest in keeping the service secure, your consent where we ask for it, and legal obligations.

Who we share it with

We do not sell or rent your personal information. We share it only in these cases:

• AI providers you choose. When you send an AI chat message, the message, the conversation so far and the project context are sent to the provider you picked (Anthropic or OpenAI) using your own API key. Their privacy policies apply to that request.
• Google, if you choose to sign in with Google, to confirm your identity.
• Service providers that host our servers and databases or deliver our emails, who process data only on our instructions.
• Legal reasons, when required by law, or to protect the rights, safety and security of our users and the service.
• Business transfers, if Hectix is merged or sold, in which case this policy continues to apply to your information.

How long we keep it

• Account, device, server and AI chat data: for as long as your account exists.
• Security and activity logs: for as long as your account exists, so you can review them.
• When you delete your account, we delete your data within 30 days. Copies in backups are removed when those backups expire, within a further 30 days. We may keep a minimal record that a deletion took place, or information we are legally required to keep.

Security

We use encryption in transit (HTTPS), hashed passwords, short-lived sign-in tokens that rotate on every refresh, and strict access controls. Secrets that would give access to your servers are kept off our systems entirely. No system is perfectly secure, so if you believe your account has been compromised, sign out your devices from the app and email us right away.

Your rights

Depending on where you live, you have the right to:

• access the personal information we hold about you and get a copy of it
• correct information that is wrong (you can change your name and password in the app)
• delete your account and data (see Delete your account)
• object to or restrict some processing, and withdraw consent you have given
• complain to your local data protection authority

To use any of these rights, contact us by email at support@hectix.app from the email address on your account. We will reply within 30 days, and may ask you to confirm your identity first.

Children

Hectix is not intended for children under 16, and we do not knowingly collect information from them. If you believe a child has given us information, email us and we will delete it.

International transfers

Our service providers and the AI providers you choose may process information in countries other than yours. When we transfer personal information internationally, we use appropriate safeguards required by law, such as standard contractual clauses.

Changes to this policy

We may update this policy as Hectix changes. We will change the “Last updated” date above, and for significant changes we will tell you in the app or by email before they take effect.

Contact us

For any question or request about your privacy or your data, please contact us by email at support@hectix.app. Email is the fastest way to reach us, and every message is read by a person.