Privacy Policy

HerdrChat · last updated 3 August 2026

HerdrChat has no accounts, no back end, and no analytics. We do not operate a server, so there is no system of ours for your data to reach. The app talks over SSH to a computer you own and administer, using credentials you supply.

What we collect

Nothing. HerdrChat collects no personal data, transmits nothing to us, and contains no analytics, advertising, tracking or crash-reporting SDKs. The app's Apple privacy manifest declares NSPrivacyTracking = false and an empty set of collected data types, which matches the “Data Not Collected” label on the App Store.

About this page itself: it makes no third-party requests. No web fonts, no analytics, no trackers. It is served through Cloudflare, whose Web Analytics would normally be injected here automatically; that is switched off for this hostname specifically. The one script on the page is Cloudflare's own, served from this domain, and it exists to keep the contact address below from being harvested by scrapers.

What is stored on your device

All of this stays on your phone and is never sent to us:

Host details — the name, address, port, username and herdr path for each machine you add.
Credentials — your SSH private key or password, and the pinned fingerprint of each host key, held in the iOS Keychain rather than in the app's database.
A cache of your conversations — message bubbles read from the transcripts on your own machine, plus the last-message previews and read positions that let a thread reopen where you left it.
Preferences — appearance, and which optional message kinds to show.

Deleting the app removes all of it. Removing a host from the app deletes that host's Keychain entries. Settings → Clear cached messages clears the cached conversations without touching anything on your machines.

Where your data goes

Only to the machine you point the app at. The connection is a direct SSH session from your phone to your host — in normal use across a private network such as Tailscale, so it is not exposed to the internet at all. Host keys are pinned the first time you connect, and a changed host key refuses the connection rather than silently trusting it.

Notifications

If you turn notifications on, your device's Apple Push Notification token is written to a file on your own host over the same SSH connection. A watcher you run there signs a request with your own Apple push key and sends it to Apple. The token identifies your installation of the app so Apple can deliver to it; it does not identify you, and it never passes through any service of ours, because none exists.

Children

HerdrChat is a developer tool and is not directed at children. It collects no data from anyone, including children.

Changes

If this policy changes, the date above changes with it. The app is open source and this page lives in the same repository, so any change is visible in the project's history alongside the code it describes.

Contact

Questions about this policy: [email protected].