Privacy Policy

Last updated: November 10, 2026

Waterm has no account, no analytics, no advertising and no tracking.
Your hosts, passwords, keys and terminal sessions stay on your device unless you turn on iCloud Sync or Herdr notifications, described below. SSH traffic goes only to the servers you connect to.
Some optional features send data to services you choose: iCloud Sync to your own iCloud account, Tailscale to Tailscale, cloud voice input to the speech provider you pick.
Herdr agent notifications (Pro, opt-in) pass through a small notification relay we operate. It stores your device's push token until you clear Waterm's data, and never stores message contents.

Who we are

Waterm is developed by 子良殷, an independent developer ("we", "us"), who is responsible for the personal data described in this policy and will appear as the seller on Waterm's App Store listing. For any privacy question or request, email support@waterm.app.

Data that stays on your device

Waterm stores your hosts, usernames, connection settings, trusted host keys, SSH keys, passwords, passphrases and session restoration state on your device. Secrets are stored in files protected by iOS data protection and are excluded from device backups. Terminal output, scrollback and clipboard content are not sent to us. The one exception is the short reply preview described under Herdr agent notifications, which your host sends through our relay only if you turn those notifications on.

When you connect, Waterm talks directly to the server you chose, using your network's DNS and, if you set it up, Kerberos/GSSAPI. Opening a link printed in the terminal hands it to your browser. HTML preview (Pro) shows a file from your server inside Waterm; if that file refers to images, styles or scripts on the internet, Waterm loads them directly from those sites.

"Clear All Data" in Waterm's Settings deletes this local data. Deleting the app also removes it from the device.

iCloud Sync (optional, off by default)

If you turn on iCloud Sync, Waterm stores your hosts (including saved passwords), SSH keys and passphrases, voice input credentials, settings and Home layout in your own private iCloud database, in a zone named Waterm. We cannot read it. Unless you turn on Advanced Data Protection for iCloud, Apple holds the encryption keys for this data. Apple's handling is described in Apple's Privacy Policy.

Tailscale sign-in state, host-key trust, notification pairing and session restoration are never synced. Turning sync off keeps your local data. "Delete iCloud Data" removes the synced copy; "Clear All Data" does not. After you delete an item, a small marker recording the deletion remains in your iCloud database so other devices delete it too.

Tailscale (optional)

Waterm includes a Tailscale client that runs inside the app, with no VPN profile. It joins your tailnet as a device of its own and only makes outgoing connections to the machines you choose. When you sign in, you authenticate with Tailscale and your identity provider in a system sign-in sheet; Waterm never sees that password. Tailscale Inc. receives your account identity, the device's Tailscale keys, its network addresses and the device name "waterm-iphone". When a direct connection isn't possible, encrypted traffic, including SSH, may pass through Tailscale's relay servers. Tailscale coordinates your tailnet under Tailscale's privacy policy. Waterm turns off Tailscale's log upload. Clear All Data signs the client out and removes its state from the device.

Voice input (Pro, optional)

Voice input records up to 60 seconds of audio while you hold the key. You review the transcript before anything is sent to your server.

Apple speech recognition: audio is processed by Apple and may be sent to Apple's servers, under Apple's Privacy Policy.
Doubao (Volcano Engine) or iFlytek: only if you add your own API credentials. Audio streams directly from your device to that provider's servers in mainland China, under your account with them and their privacy terms. We never receive the audio or your credentials.

Microphone and speech recognition access are requested only when you first use voice input and can be withdrawn in iOS Settings.

Herdr agent notifications (Pro, optional)

If you enable notifications for Herdr, Waterm pairs your device with a notification relay we run on Cloudflare at waterm-push.tuta.cc, and installs a plugin on the host you choose over SSH, with your confirmation. When an agent finishes or needs attention, the plugin on your host sends an event to the relay, which forwards it to your device through Apple Push Notification service. While paired, the plugin also contacts the relay about once a minute, and may test connections to Cloudflare addresses, to choose a network route. These checks carry no message content.

Data	Source	What the relay does with it
Device push token, environment, and a hash of the sending key	Your device	Stored until you choose "Clear All Data" in Waterm or Apple reports the token invalid.
Host, space and tab names; agent type (Claude Code or Codex); status	Your host	Forwarded to Apple for delivery. Not stored.
A hash of the agent session, and opaque IDs for the route, space, tab, pane and terminal	Your host	Forwarded to Apple in the notification so Waterm can group alerts and open the right pane. Not stored.
A preview of up to 120 characters of the agent's latest reply	Your host	Forwarded to Apple as the notification text. Not stored.
Event IDs and times	Your host	Up to 128 recent IDs are kept to drop duplicate events. IDs older than 24 hours are removed when a later event is accepted; otherwise they stay until you choose "Clear All Data".
IP address of the device or host making a request	Network	Used for rate limiting. For the plugin's route check, Cloudflare derives your host's country and nearest Cloudflare data center from it, and the relay returns them to your host. Not stored by us.

The relay doesn't log message contents, tokens or keys, and request logging is turned off. Because the relay handles messages in transit, its operator could technically see them while they pass through; we don't record them. Cloudflare hosts the relay under Cloudflare's privacy policy, and Apple delivers the notification.

"Clear All Data" in Waterm revokes the pairing for every host using it and deletes the stored token. After that, the relay keeps only a marker that the pairing was revoked, so it can't be reactivated. "Uninstall Plugin" stops a single host from sending. Deleting Waterm can't revoke the pairing, so clear its data first if you want the token removed. Plugin files on your hosts stay there until you uninstall the plugin from Waterm or remove them yourself.

Purchases

Waterm Pro is sold through the App Store. Apple processes payment under Apple's Privacy Policy. Waterm checks your purchases and free-trial dates on your device with Apple's StoreKit; we have no server that records them. We receive Apple's standard sales reports, which don't identify you.

Diagnostics

Waterm contains no crash-reporting or analytics SDK. Diagnostic reports are created on your device and leave it only if you share them yourself, for example by email to us. If you choose to share crash data with app developers in iOS Settings, Apple may provide anonymized crash reports to us.

This website

This site uses no cookies, analytics or third-party scripts. It's served by Cloudflare, which processes your IP address and request details to deliver the page and protect against abuse.

Email to us

Mail sent to support@waterm.app is stored by NetEase, our email provider, in mainland China. We use your address and message only to answer you, keep them only as long as that takes, and delete them on request.

We don't sell or share personal data, and we don't use it for advertising. The only third parties involved are those described above, each acting for the feature you use: Apple, Cloudflare, Tailscale, the voice provider you choose, and NetEase for email. These services may process data in the United States, mainland China or other countries.

Children

Waterm is a tool for managing servers and isn't directed at children under 13. We don't knowingly collect information from children.

Your choices and rights

Because Waterm has no accounts, we hold almost nothing that identifies you. You control your data directly in the app: Clear All Data (which also revokes notification pairing), Delete iCloud Data, Uninstall Plugin for each host, and removing voice credentials. We use the relay data above only to deliver the notifications you turn on, and IP addresses only to route notifications and protect the relay and this website from abuse, which is our legitimate interest in keeping them working and secure. You don't have to provide any of this data; without it, Herdr notifications can't work. We make no automated decisions about you. Cloudflare and Apple process relay data for us under their own data processing terms, and we use only providers whose terms protect it at least as well as this policy. Depending on where you live, you may have rights to access, receive a copy of, correct, delete, restrict or object to processing of personal data, to withdraw consent at any time without affecting earlier processing, and to complain to your data protection authority. To make a request, email us; we will answer within 30 days.

Changes

If we change this policy, we will update this page and its date. If a change affects what Waterm sends off your device, we will also say so in the app's release notes.