Privacy Policy

1. Your Account

Starting a free trial or subscribing to AbleSH Pro requires signing in with your Google account. We use this sign-in solely to run AbleSH Pro as a subscription and to prevent trial abuse - it has nothing to do with, and no access to, your servers, keys, or snippets, which remain entirely on your device whether or not you have an account.

When you sign in, we receive and store:

• Your email address
• A stable Google account identifier (not your Google password - Google handles authentication itself, and we never see or receive your password)
• Your AbleSH Pro subscription status (trial, active, expired, or cancelled) and renewal date

We do not request or store your name, profile photo, contacts, or any other Google account data beyond what's listed above.

This account data is stored on servers we operate, built on Cloudflare Workers and MongoDB Atlas, located in the United States or other countries where these providers operate. See Section 9 for the full list of service providers involved.

What we still don't collect

Beyond the account data described above, we do not collect, and have no way to collect:

• Analytics or usage statistics
• Advertising identifiers or data used for ad targeting
• Crash or diagnostic reports sent to us or to any third-party service
• Your location
• Contacts, photos, or any other data on your device beyond what is described in Section 2

AbleSH does not contain any third-party analytics, advertising, or tracking software development kits (SDKs).

Free-trial abuse prevention

AbleSH's free trial is limited to once per Google account. As a second, device-level check on Android, the first time you start a trial the App also sends a one-way cryptographic hash (SHA-256) of your device's Android ID to our server, solely to check whether that device has started a trial before under a different account. We never send the raw Android ID itself, only its hash, and this check stores nothing else about you beyond the hash and a timestamp - no app data, no server/key/snippet content. This device-level check does not run on iOS, where the same protection is achieved entirely on-device.

2. Information Stored Only On Your Device

To function as an SSH/SFTP client, AbleSH stores the following locally on your device, inside the App's own private storage:

• Server connection details you add (hostnames, ports, usernames)
• SSH keys and credentials you add or generate
• Command snippets and custom toolbar keys you create
• Known SSH host keys, used to warn you if a server's host key ever changes
• Your app PIN (stored as a cryptographic hash, never in plain text) and whether biometric unlock is enabled
• App preferences (theme, terminal font size, multiplexer settings, etc.)

None of this data is ever transmitted to Veltrix Solutions. We do not operate any server that receives, stores, or has visibility into this information. If you delete the App, this data is permanently erased along with it.

Biometric authentication

If you enable Face ID, Touch ID, or fingerprint unlock, that authentication is handled entirely by your device's operating system. AbleSH only receives a yes/no result ("authenticated" or "not authenticated") from the OS. Veltrix Solutions never receives, stores, or has access to your biometric data (your fingerprint or face data never leaves your device's secure hardware).

Camera

AbleSH requests camera access solely to let you scan a QR code containing a server's connection details, if you choose to use that feature. The camera feed is processed in real time on your device to read the QR code; no image, video, or camera data is ever saved, stored, or transmitted anywhere by AbleSH or Veltrix Solutions.

Encrypted backups

Where available in your version of the app, AbleSH lets you export an encrypted backup of your data, protected by a password you choose. You decide where that backup file is saved or shared (your device's storage, your own cloud drive, AirDrop, email, etc.) - Veltrix Solutions never receives a copy of this file and, because it is encrypted with a password only you know, could not read it even if we did. (This entry point is temporarily disabled in some builds while it's being hardened for on-device reliability; the description above applies whenever it's present.)

3. Your SSH Connections

When you connect to a server using AbleSH, the App opens a direct connection from your device to the server you specified. Veltrix Solutions is not a party to that connection, does not proxy or relay it through any server we operate, and has no visibility into anything transmitted between your device and your own server - commands you run, files you transfer, or output you see.

4. In-App Purchases

AbleSH Pro (a monthly or yearly subscription, each with a 14-day free trial) is billed entirely by the Apple App Store or Google Play Billing - Veltrix Solutions never receives your payment card number, billing address, or any other payment details.

To determine whether a purchase is valid and which features it unlocks, AbleSH uses RevenueCat, a subscription-management service, as a processor. When you purchase or restore AbleSH Pro, RevenueCat receives purchase/subscription data (the product purchased, purchase and transaction identifiers) directly from the App Store or Play Billing to validate the purchase, along with the Google account identifier described in Section 1 - this is what lets your subscription be recognized if you sign in on a different device. RevenueCat does not receive your payment card details, your email address, or any of AbleSH's on-device app data (servers, keys, snippets, or anything described in Section 2). See RevenueCat's Privacy Policy for how they handle the data described here.

5. Children's Privacy

AbleSH is a technical tool for connecting to servers, and is not directed at or marketed to children. The data described in Section 2 (servers, keys, snippets) never leaves your device regardless of age. For the account described in Section 1, sign-in is handled entirely by Google, so we rely on Google's own account age requirements rather than collecting or verifying age ourselves. We do not knowingly collect account data from anyone below the minimum age Google itself requires for an account in their jurisdiction. If you believe a child has created an AbleSH account, contact us at info@ablesh.app and we will delete it.

6. Your Rights

For the data described in Section 2 (your servers, keys, snippets, and settings), there is nothing for us to access, export, correct, or delete on your behalf - it already sits on your own device, under your own control, via the App's Settings or by deleting the App entirely.

For the account data described in Section 1 (your email address, Google account identifier, and subscription status), you can request export or deletion at any time by contacting info@ablesh.app, or by deleting your account directly from the App's Settings, where that entry point is available. We will delete this data within 30 days of your request, except where we're required to retain transaction records for tax, accounting, or fraud-prevention purposes.

If you have any other privacy question or request, including rights available to you under GDPR, CCPA, or similar laws, contact us at info@ablesh.app and we will respond promptly.

7. Data Retention

Data described in Section 2 remains on your device for as long as you keep the App installed, or until you delete it yourself. Uninstalling AbleSH permanently erases this data; because nothing is stored remotely, this cannot be undone by Veltrix Solutions.

Account data described in Section 1 is retained for as long as your account remains active, and is deleted within 30 days of account deletion or a verified deletion request (Section 6), except where retention is required for legal, tax, or fraud-prevention purposes.

8. Security

AbleSH uses your device's platform-level secure storage, a PIN and/or biometric lock, and industry-standard password-based encryption for exported backups to protect your data. No method of storage is 100% guaranteed secure, and you are responsible for choosing a strong PIN/backup password and keeping your device itself secure (e.g., its own lock screen).

Account data (Section 1) is encrypted in transit and protected by access controls on our database. We never see or store your Google password: sign-in is handled entirely by Google's own authentication system, and we only receive a token proving your identity, not your credentials.

9. Service Providers

We share data with the following service providers, each only to the extent needed to provide AbleSH Pro:

• Google (Sign-In) - handles authentication; we receive your email address and account identifier after you sign in
• RevenueCat - purchase/transaction identifiers and your account identifier, for subscription validation
• Apple App Store / Google Play Billing - payment details, handled entirely by Apple/Google, never by us
• Cloudflare - account data in transit and at rest, for API hosting
• MongoDB Atlas - account data at rest, for database hosting

None of these providers receive the on-device data described in Section 2 (your servers, keys, snippets, or settings) - that data has no path to any server, ours or theirs.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be reflected by updating the "Last updated" date above, and, where appropriate, by a notice within the App.

11. Contact Us

Veltrix Solutions
Website: veltrixsolutions.com
Privacy questions: info@ablesh.app
General support: support@ablesh.app