Here is exactly where your data goes.
It goes to the servers you connect to — and nowhere else, unless you opt the ✦ assist into a cloud brain of your own. That's the whole policy; the rest of this page is us showing our work.
Last updated 12 September 2026 · applies to Outrigger for iPhone, all versions
scrollback · summaries
What stays on the device
The default SSH key is generated inside the Secure Enclave and is non-extractable — no code path exists, in our app or anyone's, to copy it out. The optional ed25519 key (for servers that require it) is a software key by necessity, and we say so plainly; at rest it is encrypted to a Secure Enclave key that refuses to unseal without Face ID. Saved host passwords and assist API keys get the same treatment: Enclave-encrypted, sealed to this one device. Host entries and snippets are stored in the app container under iOS file encryption. Terminal scrollback and ✦ assist summaries live only in memory — never written to disk, gone when the session ends.
In its default mode, the ✦ assist runs entirely on device: scrollback is never uploaded anywhere to be summarised, because the summarising happens on the phone in your pocket. The opt-in cloud mode is covered below — it exists only if you switch it on and bring your own key.
What leaves the device
SSH traffic to the hosts you configure. Your public key is sent to those hosts, as SSH requires. One opt-in exception: if you switch the ✦ assist to a cloud brain and add your own API key, the terminal output you ask about goes directly from your phone to the provider you chose — Anthropic, OpenAI, or a server of your own — and never through us. The default on-device assist sends nothing anywhere. Beyond that, the app makes no other network connections — you can verify this with a proxy or a packet capture, and we'd rather you did.
Purchases go through the App Store. Apple handles the payment and tells the app a purchase happened; we never see your name, card, or email. The most Apple ever shows us is anonymous, aggregate sales counts. There is no per-person data on our side at all — because there is nowhere to keep it.
Things we are asked about
Deleting your data
Delete the app: hosts, snippets and settings are destroyed with its container. For key material we will be precise, because iOS is: keychain entries can outlive an app deletion, but they remain sealed to this device and this app's identity — unreadable by any other app, ever, and unusable without your Face ID. If you want explicit, immediate destruction, delete your keys in Settings › Identity keys first; that destroys the sealed private key on the spot. There is no server-side account to close, because there is no server and no account. Remove the matching public keys from your hosts' authorized_keys when you do.
Changes and contact
If this policy ever changes, the change is described in the app's release notes rather than quietly swapped on this page. If a future version ever needs to talk to a server of ours, it will be opt-in, and it will be explained here before it ships.
Questions, corrections, or a packet capture that contradicts any of this: [email protected]. A real person reads it.