Security

Keys stay on your device

SSHaven is designed so SSH secrets never leave your phone for an Adam Codes cloud. There is no SSHaven account and no vendor vault of your keys.

What never leaves the device for our cloud

In normal operation, Adam Codes does not receive:

SSH passwords or private keys
Key passphrases
The contents of your terminal sessions
A copy of the hosts you save, beyond optional recipe-catalog fetches that do not include credentials

Network traffic for SSH is from your device to the servers you choose — not through an Adam Codes relay.

Where secrets actually live

Passwords and key passphrases — iOS Keychain (Android: EncryptedSharedPreferences / Keystore on that platform).
Private key files — app sandbox, with OS file protection. Not iCloud-synced by SSHaven.
Host profiles — name, host, port, username, favorites, timestamps, stored locally.
Agent / project labels — on-device metadata so the fleet board can group sessions.

What the app may fetch

Optional install-recipe catalogs can be loaded over HTTPS from sshaven.app (or another allowlisted host). Those requests are for recipe JSON. They do not upload your SSH keys. Installing software on a server still requires your consent in the app.

Local network

SSHaven may ask for local network permission so you can reach a Pi, NAS, or other host on your LAN. That permission is for connections you start. It is not a background scan for advertising.

Your responsibilities

Device passcode, biometrics, OS updates, and the security of the servers and keys you use are still yours. SSHaven cannot make a weak host key or a reused password safe. Delete connections or uninstall the app to clear local data; Keychain items follow OS behavior when the app is removed.

Full legal text: Privacy Policy.