Dagon SSH — Privacy Policy

Effective date: 20 October 2026 · Applies to the Dagon SSH Android application (package com.alpaco_it.dagon_ssh).

Who we are

Dagon SSH is operated by Alpaco IT (Poland). Contact: contact@alpaco.it.

Data we collect and why

Account data — when you sign in with Google we receive your e-mail address, display name and a Firebase account identifier. Used solely to authenticate you and to sync your app settings between your devices.
Voice recordings: when you use voice dictation with the monthly AI allowance or a top-up pack, the audio clip is sent over TLS to our transcription server, converted to text and the audio is not retained after processing. With your own OpenAI key, the clip goes from your phone straight to OpenAI instead. Recording happens only while you hold or toggle the microphone button; never in the background.
AI usage counters: for each AI, transcription or read-aloud request handled by our servers we store the model name, token and audio-second counts, the number of characters read aloud and the estimated cost, summed per day and month. This is used to track the monthly AI allowance and top-up packs. It contains no prompts, answers or terminal content. Requests made with your own OpenAI key are not counted on our servers. If you delete your account, we keep the trial start date and the monthly AI cost totals under a keyed hash of your account ID, with no e-mail or name, so that deleting and re-creating an account doesn't reset the trial or the allowance.
Purchase records: when you buy a subscription, the Lifetime plan or an AI top-up pack in Google Play, we store the product, the Google Play order ID and purchase token, and the purchase time, to unlock what you paid for and to handle refunds. Payment details are handled by Google Play and never reach us. Purchase tokens are kept after account deletion, without your e-mail or name, so a single purchase can't be redeemed twice.
Synced settings — app preferences, snippets and, for each saved connection, its label, tags, toolbar/layout, and the optional automation command fields you configure (initial command, post-connect script, health-check command, and tmux session name) are stored server-side (MongoDB Atlas, EU/US cloud) so they follow your account across devices. Those command fields are free text you author — avoid placing secrets (tokens, inline passwords) directly in them, as they leave the device to sync. Everything needed to actually connect — host, IP, port, username, password and keys — is not part of this sync.
Crash and diagnostics data — crash reports and anonymous usage analytics (Firebase Crashlytics/Analytics, Sentry-compatible telemetry) to keep the app stable. These may include device model, OS version and app version. The app also sends small notification-timing events (event names, counters and timestamps — no terminal content, no file paths) to help us debug background notifications; these require a signed-in session and are automatically deleted after 7 days.

What we never collect

SSH passwords, private keys and passphrases never leave your device. They are stored in Android Keystore-backed secure storage.
Your OpenAI API key never reaches our servers. If you add one, it is kept only in Android Keystore-backed secure storage on your device. It is left out of settings sync, of the backup file you export, of Android's cloud backup and of the app's logs and crash reports. The app sends it only to OpenAI, with the requests you make on your own key, and those requests are handled under your own OpenAI account and OpenAI's terms.
Server hostnames, IPs, ports and usernames of your SSH connections are not uploaded — connection sync carries only labels, tags, layout and the automation command fields described above.
Terminal content (what you see or type in your SSH sessions) is not sent to us. SSH traffic goes directly from your device to your servers. The one explicit exception is the AI sheet: only when you switch on "Attach terminal" are the last 20–200 lines of visible output (your choice) sent over TLS together with your request, to generate a command or to diagnose what happened. Before sending, the app strips terminal control codes and masks recognisable secrets on the device (passwords, tokens, API keys, private keys), and shows you the exact text that will be sent. The text is processed in transit by our AI backend and not stored on our servers. Voice dictation and AI requests without that switch send no terminal content. In the AI sheet's Chat mode, each command you run with "Run & observe" sends the output of that command (masked the same way, last 4 KB) back to the AI as part of the conversation; the conversation is held on your device, sent whole with each turn, and not stored on our servers. The AI never runs a command by itself — every command is typed only after you tap it.
We do not sell or share personal data with third parties for advertising. The app contains no ads.

Data retention and deletion

Synced settings are kept while your account exists. You can request deletion of your account and all associated server-side data at any time — e-mail contact@alpaco.it from the address linked to your account; deletion is completed within 30 days. An in-app deletion option is available in Settings.

Third-party processors

Google Firebase (authentication, analytics, crash reporting)
MongoDB Atlas (settings sync storage)
Cloudflare (network transport/CDN)
Better Stack (application telemetry)
OpenAI (AI answers, read-aloud and backup speech-to-text for requests handled by our servers)
Google Play (purchases and refunds)

Your rights

Under the GDPR you have the right to access, rectify, export and erase your personal data, and to lodge a complaint with a supervisory authority (in Poland: UODO). Contact us at the address above to exercise these rights.

Changes

We will post any changes to this policy on this page and update the effective date above.