Privacy Policy
Data we collect
Sigmux has no user accounts and contains no analytics, advertising, or tracking SDKs. The only data that reaches a server of ours is what the optional notification relay needs to deliver push notifications to your phone: a random device identifier, a hashed secret and your Apple push token, as described under Notifications and the Sigmux relay. Nothing is sold or shared, and nothing is used for tracking.
Data stored on your device
- Host profiles — hostnames, ports, usernames, and connection settings are stored locally on your device only.
- Credentials — SSH private keys, passwords, and passphrases are stored exclusively in the iOS Keychain with device-only accessibility. They are never synced to iCloud and never leave your device.
- Terminal content — scrollback and session output are held in memory only and are not persisted to disk.
Network connections
Sigmux connects directly from your device to the SSH servers you configure. Your terminal traffic flows only between your device and your server, encrypted end to end by the SSH protocol; no server of ours is in that path. The one service we operate is the optional notification relay described next.
Notifications and the Sigmux relay
Sigmux can show you a notification when a coding agent on your server
finishes or waits for an approval. Your server cannot talk to Apple's push
service by itself, so Sigmux runs a small relay (push.acmore.dev,
a Cloudflare Worker with a Cloudflare D1 database) that forwards those
notifications to Apple. You opt in: nothing is sent to the relay until you
turn on notifications in Settings → Agents and install the hook on a server
from your phone. If you choose Bark, ntfy or a webhook instead, the relay
is not involved at all.
What the relay receives. Each notification arrives at the relay as an envelope encrypted on your server with a key that only your phone and that server hold. The relay cannot read the title, the text, the host name or the project; it forwards the envelope to Apple, and the Sigmux notification extension on your phone opens it. The fallback text Apple shows if the envelope cannot be opened is a fixed sentence ("Open Sigmux to read this notification.").
What the relay stores.
- For your phone: a random device identifier, the SHA-256 hash of the secret that proves the phone owns that identifier, the Apple push token for Sigmux on your phone (and whether it is a sandbox or production token), whether delivery is enabled, and the times the row was created and last updated.
- For each server you installed the hook on, and for the phone's own "send a test notification" route: a random key identifier, the SHA-256 hash of the token the server uses to send, the creation time, and two rate-limit counters (notifications in the current minute and day).
The relay never stores a notification, a server name or address, a username, a project path, or anything you typed. It has no user accounts and no analytics. Secrets are stored only as hashes; the keys that open the envelopes exist only on your phone and your servers. Rate limits are per server (30 notifications a minute, 2,000 a day) so one runaway script cannot flood your phone.
Where. The Worker and the database run on Cloudflare's network. Logs on Cloudflare are the Worker's own error output only; the relay does not log request contents.
How long. Rows stay until you remove them. A push token Apple reports as no longer valid is cleared from the row at once; the row itself stays so your servers keep working after Sigmux refreshes the token.
Trial and purchase. When a trial ends without a purchase, Sigmux asks the relay to pause delivery for your phone. The rows stay so that a later purchase restores notifications without reinstalling anything on your servers; notifications sent meanwhile are refused, not queued. Buying or restoring Sigmux resumes delivery the next time the app runs.
How to stop it. Uninstalling the hook from a server in Sigmux, or deleting that host, removes the server's route from the relay, so nothing from that server reaches the relay any more; this is always available, with or without a purchase. Your phone's own row (the random identifier, the hashed secret and the push token) stays so that a server you set up later works without a new registration. To have it deleted, write to the contact address on this page from the mail account you use with the App Store, and say roughly when you installed Sigmux; we delete the matching rows and confirm.
Other push services. If you choose Bark, ntfy or a webhook instead of the Sigmux relay, notifications go from your server to that service directly. Their handling of your data is governed by their own policies; Sigmux never sees them.
Face ID and Touch ID
Biometric authentication is handled entirely on-device by iOS. Sigmux never receives, stores, or transmits biometric data; it only learns whether the system reported the check as passed.
Beta builds (TestFlight)
If you use a beta version of Sigmux through TestFlight, Apple may collect crash logs, usage statistics, and feedback you choose to submit, and share them with us under Apple's TestFlight terms. We use this information solely to diagnose and fix bugs.
Changes to this policy
If this policy changes, the updated version will be published at this URL with a new effective date.
Contact
Questions about this policy: hezj07@gmail.com