Privacy Policy

Short version: Sudo stores your SSH credentials and keys locally on your device in the iOS Keychain. We do not collect analytics, advertise, or send your data to our servers. Optional AI features send request content and limited context, such as staged diffs or the connected host name/IP for terminal assistance, directly to the AI provider of your choice using your own API key. Remote Code connects to user-installed code-server on your SSH host through a private SSH tunnel; Sudo does not bundle code-server or Visual Studio Code.

1. Who we are

Sudo is an iOS application ("we", "us"). You can reach us at privacy@sudo-app.com.

2. Data stored on your device

All of the following is stored locally on your device and is never transmitted to our servers:

SSH credentials — passwords and private keys are stored in the iOS Keychain with kSecAttrAccessibleWhenUnlockedThisDeviceOnly. They do not leave the device.
SSH host keys — known-host fingerprints are written to a local file in Application Support.
SSH key pairs — Ed25519, ECDSA P-256, and Secure Enclave P-256 keys are generated on-device. Secure Enclave keys are hardware-bound and cannot be exported.
Git identity — your committer name and email address are stored in iOS UserDefaults.
Repository working copies — cloned repositories are stored under Documents/Repositories and accessible from Files.app. Repository contents may include any files you clone or create.
AI provider API keys — stored in the iOS Keychain, used only to authenticate outbound AI requests that you initiate.
App Lock PIN — stored as a PBKDF2-SHA256 hash with a random salt in the iOS Keychain. The PIN itself is never stored.
Remote Code settings — the remote folder path you enter may identify a project directory on your SSH server. code-server itself runs on your server, not on this device.
Host configuration — host records (hosts.json) are stored in Application Support and optionally synced to your own iCloud account when iCloud Drive is enabled (see Section 5). Passwords and private keys are never synced.
Snippets — stored locally in Application Support. Snippets are not synced to iCloud.

3. Data we do not collect

No analytics or crash reporting SDKs are included in Sudo.
We do not operate any backend servers that receive app telemetry.
We do not use advertising networks or cross-app tracking.
We do not use third-party login (no "Sign in with Google/Facebook").

4. AI features (optional)

When you use AI in Sudo, requests go directly from your device to the provider's API — Sudo does not proxy or log them.

Git commit suggestions: when you tap Suggest in the Git workflow, Sudo sends your staged diff to the AI provider you have configured (Anthropic Claude or OpenAI).
Terminal command assistance: when you ask Sudo to convert natural language into a shell command, Sudo sends your request and the connected host name or IP address to the selected AI provider.
Your API key is used to authenticate the request and is stored only in the iOS Keychain.
AI requests may contain source code, file paths, hostnames, commands, and other data you enter or select.
Do not use this feature with code that contains secrets, credentials, or proprietary information you are not permitted to share.
When using OpenAI, Sudo sends requests with the store field set to false. Anthropic does not store API request content by default. Review each provider's current privacy policy for authoritative details on data handling.
Sudo shows in-app disclosures before AI data is sent and again in the AI settings section. Terminal command assistance also requires first-use consent before sending the request and host context.
Anthropic's and OpenAI's own privacy policies govern how they handle your data. Review them before enabling the feature.

5. iCloud sync (optional)

If iCloud is enabled on your device and the Sudo iCloud container is provisioned, your host list (hosts.json) is synced to your personal iCloud account using Apple's iCloud infrastructure. This data goes to Apple's servers under your Apple ID — it does not go to our servers. Passwords and private keys are never included in the sync.

6. Files.app and FileProvider

Sudo can expose saved SSH hosts as locations in Apple's Files.app through a FileProvider extension when Pro is active. The extension uses the same Keychain access group as the main app so it can read credentials you saved in Sudo. It does not silently trust new or changed SSH host keys: connect to the host in Sudo first to verify its identity before browsing it in Files.app.

7. Remote Code and code-server

Remote Code is an interoperability feature for code-server running on an SSH server you control. Sudo can check whether code-server is installed on the remote host, start it on the remote loopback interface, create a private SSH tunnel, and display the loopback web UI inside a WKWebView.

Sudo does not include, redistribute, or execute Microsoft Visual Studio Code, code-server, Node.js, extensions, language servers, compilers, or your remote project code on the iPhone or iPad. Any files, extensions, build tools, terminals, and processes used by code-server run on your SSH server and are governed by that server's configuration and the third-party software you install there.

Visual Studio Code is a Microsoft product. code-server is third-party MIT-licensed software from the code-server project. Sudo is not affiliated with or endorsed by Microsoft, Coder, or the code-server project.

8. Live Activities

Sudo's Lock Screen and Dynamic Island Live Activity uses privacy-safe session state only: protocol type, session count, connection age, and verified/unverified status. It does not show hostnames, usernames, IP addresses, commands, terminal output, file names, repository names, or server health details on the Lock Screen.

If Sudo cannot refresh the Live Activity, for example after the app is terminated by the user or iOS, the activity can become unverified instead of continuing to claim a verified active SSH connection.

9. Support email

When you contact support via the Help & Feedback screen, Sudo pre-fills the email body with diagnostic information: OS version, device model, device name, app version, and your Git committer email address (if you have set one in Settings → Git). You can review and edit or remove any of this information before sending. The email is sent directly from your Mail app to our support address — it does not pass through Sudo's servers.

We use the information you send only to respond to your support request. We do not retain support emails beyond what is necessary to resolve your request.

10. Subscriptions and purchases

In-app purchases are processed entirely by Apple's App Store. Sudo does not receive or store your payment details. We receive a StoreKit transaction receipt to verify your subscription tier.

If Pro expires, Sudo applies Free feature limits. Saved host and repository records are not automatically deleted, but host connections and repository opening are blocked while your saved counts exceed the Free limits. Files.app host locations are removed while Pro is inactive.

11. Biometric authentication

App Lock can optionally use Face ID or Touch ID via iOS LocalAuthentication. Biometric data is processed entirely by iOS; Sudo does not have access to it and it never leaves the device.

12. Local network access

Sudo requests local network permission to discover SSH-capable devices on your local network via Bonjour/mDNS. This scan happens only inside the app and only when you open the device discovery screen. No discovery data leaves your device.

Sudo includes App Intents that can be used with the iOS Shortcuts app. When you trigger a Shortcuts action such as Connect to Host, selected host metadata (name, address, username) may pass through Apple's Shortcuts infrastructure on your device. SSH credentials and private keys are never exposed to Shortcuts or Siri.

13. Data retention and deletion

All data is stored on your device. Deleting the app removes app container data but iOS may retain Keychain items. Use the in-app Delete All Local Data option (in Sudo's Settings) before deleting the app to remove hosts, SSH credentials, SSH keys, known host fingerprints, AI keys, App Lock PIN, snippets, repositories, and local preferences from the device.

Repository deletion removes the selected local clone folder under Documents/Repositories. The optional Settings → Git → Clean Deleted Repositories action removes only orphaned clone folders that are no longer shown in Sudo. SSH key deletion is blocked while an active session uses the key; otherwise Sudo warns before removing the private key and clears affected host key references.

14. Your rights (GDPR and applicable law)

Because virtually all data Sudo handles is stored exclusively on your device, most standard data-subject rights are exercised directly by you through the app's own controls. Specifically:

Right of access and portability — all data is on your device. You have full access to it at all times. Repository files can be exported from Files.app.
Right to erasure — use the in-app Delete All Local Data option (in Sudo's Settings) to erase all Sudo-managed data from your device. For iCloud-synced host records, also delete the Sudo iCloud data from iOS Settings → Apple ID → iCloud → Manage Account Storage.
Right to rectification — edit or delete any host, key, snippet, or Git identity directly in the app.
Right to object / restrict processing — AI features can be disabled at any time in Settings → AI. iCloud sync follows your device-level iCloud settings.

The only personal data that reaches us directly is what you choose to include in a support email. To request deletion of a support email record, contact us at privacy@sudo-app.com. We will action verified requests within 30 days.

If you are in the European Economic Area and believe we have not addressed your concern, you have the right to lodge a complaint with your local supervisory authority. In Italy, the supervisory authority is the Garante per la protezione dei dati personali.

15. Encryption

Sudo uses standard SSH, SFTP, Git-over-SSH, and optional Mosh encryption to connect to servers you choose. These connections are direct between your device and your servers or configured providers; Sudo does not operate a proxy server for them.

16. Children's privacy

Sudo is not directed at children. You must be at least 16 years old to use Sudo (or the minimum age required by the laws of your country to consent to data processing, if higher). We do not knowingly collect personal information from children under 16. If you believe a minor has provided us with personal data via a support email, contact us at privacy@sudo-app.com and we will delete it.

17. Changes to this policy

We may update this policy from time to time. The effective date at the top of this page will reflect when the latest version was published. Continued use of Sudo after changes constitutes acceptance of the revised policy.

18. Contact

Questions about this Privacy Policy? Email us at privacy@sudo-app.com.