LumenSSH Privacy Policy

Last updated: September 5, 2026

LumenSSH is a local-first macOS SSH workbench. It has no advertising, tracking, or third-party analytics. Most data remains on the Mac or in the user's private iCloud database. Terminal AI is optional and contacts only the provider the user configures after explicit consent.

Data stored on this Mac

Passwords, private keys, key passphrases, AI API keys, security-scoped bookmark material, and transcript encryption keys are stored in the non-synchronizing macOS Keychain.
Host-key pins are stored in the local-only SwiftData store. They are not stored in Keychain and do not sync with iCloud.
Session, transfer, snippet-execution, and diagnostic summaries are stored locally. Local telemetry is rolled up and deleted according to the configured retention period.
Optional terminal transcripts are encrypted with AES-GCM and stored locally. Capture is disabled by default and recording failures are shown in the app.

Data that may sync with iCloud

When “Sync non-secret metadata with iCloud” is enabled, Apple's private CloudKit container `iCloud.xyz.dess.LumenSSH` may sync server names, hosts, ports, groups, tags, notes, jump-host relationships, public identity metadata, snippets, tunnel presets, and dashboard presets.

Snippet bodies are user content and may contain secrets. LumenSSH warns before saving content that resembles a private key, token, or password. Credentials, private-key bytes, passphrases, Keychain bindings, host-key pins, histories, transfer details, and terminal transcripts do not sync.

SSH, SFTP, tunnels, and monitoring

SSH, SFTP, and tunnel traffic goes to hosts and ports selected by the user. Tunnels bind to loopback by default. Linux monitoring uses read-only commands over the existing SSH connection; it does not install an agent or run `sudo`.

Offline GeoIP uses the bundled DB-IP City Lite database. LumenSSH does not send queried IP addresses to DB-IP or another geolocation provider.

Terminal AI and third-party providers

Terminal AI supports OpenAI-compatible, Anthropic-compatible, and custom HTTPS services. Before the first request to a provider origin, LumenSSH displays the destination and asks for explicit consent.

When enabled, LumenSSH may send:

AI chat messages;
commands proposed by the AI; and
bounded, control-sequence-stripped output from commands the user approves.

Terminal scrollback, manually typed commands, server addresses, usernames, and Keychain secrets are not uploaded automatically. Every AI command requires separate user confirmation; no command is executed automatically.

Requests to the official `api.openai.com` endpoint include `store: false`. Retention and deletion for OpenAI, Anthropic, or a custom compatible service are still controlled by that service and the user's account with it. Changing the provider origin requires new consent. Consent can be withdrawn in Settings, which prevents new requests but cannot delete data already held by a provider.

Files and diagnostics

LumenSSH reads an OpenSSH configuration, private key, or transfer directory only after the user selects it. Exported diagnostics contain aggregate runtime state and redacted errors; they exclude credentials, host names, keys, command output, terminal bytes, and IP addresses.

Retention and deletion

Settings provides controls to remove local application data and credentials and to delete CloudKit-synchronized records. Purchase history and entitlements are managed by Apple and are not removed when local data is deleted. Provider-side AI data must be deleted through the selected provider.

Contact and support

Support: https://dessli.github.io/lumenssh-support/

Do not include API keys, private keys, passwords, host names, IP addresses, or terminal output in a public support issue.