CodeShell Privacy Policy

The app stores the following on your device so it can work:

• Connection details — names, host addresses, ports, usernames, groups and the operating system detected for each server.
• Passwords, private keys and key passphrases — stored in the Apple Keychain, encrypted by your device.
• API keys you add for AI coding agents — stored in this device's Keychain only and never synced.
• Trusted server fingerprints, so the app can warn you if a server's identity changes.
• Snippets you save.
• Workspace history — which AI agents were found on your servers, recent folders, chosen models, and your saved agent chats.
• Settings, such as your terminal theme.
• The number of free workspace messages you have used — kept in the on-device Keychain.

We cannot access any of this information.

If you're signed in to iCloud, your connection details (without passwords or keys), snippets, settings and a list of your persistent session names sync between your devices through your private iCloud database (CloudKit). Your passwords, keys and passphrases stay in iCloud Keychain, which is end-to-end encrypted. This data is stored by Apple under Apple's privacy policy (https://www.apple.com/legal/privacy/), and we cannot access it. You can turn off iCloud for the app in your device's settings.

The number of free workspace messages you have used is stored in your iCloud key-value storage and in the on-device Keychain, so the allowance is shared across your devices. It is not sent to us.

The app connects directly from your device to the servers you add, using SSH. Everything you type, the commands the app runs and their output travel only between your device and that server, encrypted by SSH. To provide some features, the app may place files in your home folder on the server:

• ~/.codeshell/ — a small helper script used for the server dashboard and persistent sessions, session data including a log of session events, and output from long-running jobs. The script collects system statistics (CPU, memory, disk, network, GPU and running processes) only when the app asks, and returns them only to the app over SSH. It does not send anything anywhere else.
• tmux — for persistent sessions, the app may install tmux on the server using the server's own package manager (for example Homebrew or apt). This happens only when you use persistent sessions.
• If you add an API key for an AI coding agent, the app sends it to your server over the encrypted SSH connection and saves it in that agent's own settings file, readable only by your user account.

You can remove these files at any time.

The built-in assistant uses Apple's on-device language model. Your requests, the commands it runs and the server output it reads are processed on your device and are not sent to us or to any cloud AI service. Assistant conversations are kept in memory and are not saved.

Workspaces let you use AI agents that are installed on your server: Claude Code, Codex, opencode and Antigravity. These agents run on your server, not in the app, with your own account or API key. Your prompts and code go from your server to the agent's provider (for example Anthropic, OpenAI or Google) under that provider's terms and privacy policy, not through us.

Antigravity is an agent you run on your own server with your own Google account or Gemini API key. If you sign in with Google, the sign-in happens with Google in your browser; the app only passes the one-time code you paste back to your server and never sees or stores your Google account tokens.

When you ask the assistant to install software it doesn't have instructions for, the app may look up that software's name on public package directories: npm (registry.npmjs.org), PyPI (pypi.org), Homebrew (formulae.brew.sh) and GitHub (api.github.com). Only the software name is sent. As with any internet request, these services can see your device's IP address. No account details, server information or personal data are included.

Purchases (the yearly subscription and the one-time lifetime purchase) are handled by Apple through the App Store. The app checks your purchase status on your device and does not send purchase information to us. We don't receive your name, email address or payment details. See Apple's privacy policy for how Apple handles purchases.

Links you tap, for example in terminal output or for creating an API key, open in your web browser. Those websites have their own privacy policies.

• Local network — to connect to servers on your home or office network.
• Notifications — to tell you when a long task finishes or needs your approval, if you allow them. These are created on your device; we don't send push notifications.
• Clipboard and files — only when you choose to paste or import a private key or a sign-in code, or copy text.

The app does not use your location, contacts, photos, camera or microphone.

The app is a tool for managing computer servers and is not directed to children under 13. We don't knowingly collect information from children.

Deleting a connection in the app removes its saved password or key. Deleting the app removes the data stored on that device. To remove synced data, delete it in the app on each device or manage the app's data in your iCloud settings. Files the app placed on your servers can be removed by deleting ~/.codeshell and any agent settings files you created.

If we change this policy, we'll update this page and the effective date above.

Use of the app is covered by Apple's standard Licensed Application End User License Agreement (https://www.apple.com/legal/internet-services/itunes/dev/stdeula/).

Questions about privacy, or need support? Email us at [email protected]