Herdr Mobile Privacy Policy

Effective date: 2026-08-02 · Applies to: Herdr Mobile (iOS / Android mobile app) · Markdown source

Herdr Mobile (“the app”) is a mobile control center for Herdr that connects to your own server. This policy explains what data the app processes, where it is stored, and how it relates to you.

1. Data we process

1.1 Connection credentials (stored only on your device)

To establish SSH connections, the app stores the following locally on your device:

• SSH host address and port
• Login username
• Login password (the app supports password authentication only)
• The server's host key fingerprint (recorded on first connect and pinned for later connections — trust-on-first-use)

All of the above is kept in the device's native secure storage: iOS Keychain / Android Keystore-backed SecureStore (via expo-secure-store). None of it is sent to any Herdr server or third-party service — the app has no Herdr account system and we operate no backend server of our own.

1.2 Trial and purchase state

• Trial clock: the app offers a 7-day free trial; the trial start time is recorded in the device's local secure storage to decide whether the trial is still running. That decision happens entirely on-device — no network access is required.
• Purchase state: the Pro lifetime purchase (a USD 19.90 one-time non-consumable product) is completed through the Apple App Store / Google Play and managed by RevenueCat (the react-native-purchases SDK), which handles purchase receipts and restoring purchases. RevenueCat receives the store-issued purchase receipt and an anonymous app user ID so your purchase can be restored across devices signed in with the same Apple ID / Google account. The app does not collect your name, email address or payment details — payment is handled directly by the store.

1.3 Attachments you choose to upload

When you send an image or file through the composer's Photo / File action, the file is uploaded over SFTP to your own server, into a fixed directory, and its path travels with your message to the corresponding agent. Files pass through no third-party relay.

1.4 Logs and audit

• The bridge (herdr-mobile-bridge, which runs on your server) keeps a redacted JSONL audit log.
• The app's own logs contain no passwords, private keys or tokens.

2. Data we do not collect

The app:

• Contains no analytics / statistics / crash-reporting SDK (no Google Analytics, no Sentry, nothing of the kind)
• Contains no advertising SDK and shows no ads
• Performs no user-behavior tracking or profiling
• Has no account system — no sign-up, and it never asks for your name, email address or phone number
• Does not read your contacts, location, calendar or any other data unrelated to its function

3. Where data goes, at a glance

4. Third-party services

The only third-party components integrated into the app that touch data are:

1. RevenueCat (purchase-receipt management and cross-device restore): privacy policy at https://www.revenuecat.com/privacy
2. Apple App Store / Google Play (payment and purchase restore): each store's own privacy policy applies

The remaining components the app uses (such as the EAS Update OTA channel) exist only to deliver app updates to you and collect no personal data.

5. Retention and deletion

• Connection profiles (including passwords and host key fingerprints) stay on your device until you delete the profile in the app or uninstall the app.
• After deleting a saved connection profile you can immediately create a replacement.
• Uninstalling the app removes everything the app stored on the device.
• Your purchase records are retained by the store and by RevenueCat under their own policies so purchases can be restored; the app itself keeps no copy of them.

6. Security notes

• Every SSH session travels over an encrypted channel; the app records the server's host key fingerprint on first connect and pins it afterwards — a changed fingerprint is rejected before authentication.
• After authentication the app runs only fixed remote commands (an environment probe, a checksum-verified bridge install, and the bridge stdio session); it offers no arbitrary shell.
• Please note: the security of your own server (SSH service configuration, the bridge's audit logs, and so on) is yours to manage.

7. Children

The app is a tool for developers. It is not directed at children under 13 and does not knowingly collect data from children.

8. Changes to this policy

If this policy changes, the updated version will be published on this page and the “Effective date” at the top will be updated. Material changes will be surfaced in the app in a reasonable way.

9. Contact us

Developer / operating entity: Wild Walnut Technology

Contact email: [email protected]

This policy is written from the data-handling behavior actually implemented in the Herdr Mobile repository (credential storage, the trial clock, the RevenueCat purchase flow, SFTP attachment uploads, redacted audit logging); the code and the docs/ directory are the authoritative references.