Privacy Policy

Last updated: 12 November 2026

This policy covers Herdr Pocket (bundle ID com.vmm.herdrpocket), a native iPhone and iPad companion for herdr, and this website. Herdr Pocket is based on the open-source app Heeler. It is an independent app and is not made by the herdr project.

Short version

• Herdr Pocket connects only to computers you choose (your "Hosts"), over SSH.
• We run no server for the app. There are no accounts, no advertising, no analytics and no tracking.
• Your SSH keys, terminal output, prompts, files and Agent sessions never pass through anything we operate. We cannot see them.
• We only receive what you choose to send us: an email, or feedback and crash reports you submit through TestFlight.

Who is responsible

The data controller for the limited data described in "Data we receive" is Vision Music & Media Limited, the publisher of Herdr Pocket. Contact: [email protected].

Data that stays on your device

• SSH keys and passwords. The Device Key (Ed25519) is generated on your device. Its private half stays in the iOS Keychain and never leaves the device. For a Host that requires RSA-SHA2-512 you can use the optional RSA Key instead, a 3072-bit key also generated on the device, with its private half kept in the Keychain. A Host password you choose to save is also kept in the Keychain. Host fingerprints are stored locally.
• Connect a Computer password. When the guided setup asks for your computer's login password, it is used once to add this device's key to that computer and is never saved.
• Hosts and settings. Your Host list and app settings are stored in the app.
• Chat cache. When you open Chat, the conversation read from your Host (without tool output) is cached on the device. The cache uses iOS Complete file protection, so it cannot be read while the device is locked, is excluded from backups, holds at most 300 MB, and drops a conversation not opened for 30 days.
• Overlay network secrets. Tailscale auth keys, EasyTier network secrets and the ZeroTier identity are stored in the Keychain; Tailscale's node state is stored in the app's container, excluded from backups.

Data exchanged with your own Hosts

Everything below travels only over the encrypted SSH connection between your device and a Host you added. Your Hosts are your computers, not ours.

• Agent activity. Terminal output, prompts and pane contents, through herdr on the Host (or Herdr Core, the herdr project's standalone hc runtime, if that is what the Host runs).
• Changes. For Agents in the list, the app asks git on the Host for the checkout's branch, ahead/behind counts, latest commit subject and time, and changed file names and line counts; file contents and diffs when you open them. These are kept in memory only.
• Chat. For supported Agents (Claude Code, Codex, Pi, Oh My Pi, Grok Build, OpenCode), the app reads the conversation that the Agent's own program records on the Host. For OpenCode it runs a short read-only query that reads only that conversation, never settings or credentials. It never changes or deletes the transcript. For Grok Build, right after you send, it reads recent lines of that folder's prompt history to confirm delivery and discards lines from other sessions without storing or showing them.
• Attachments. Photos, clipboard images and files you attach are copied to the Host over SFTP. The app needs no access to your photo library; you pick each item.
• SSH key enrollment. Adding a Host puts the public line of this device's Device Key or RSA Key, with a comment naming the device, in the Host's ~/.ssh/authorized_keys.
• Setup. If you tap Install for Me, your Host downloads Herdr Core from the herdr project's release server. That request comes from your Host, not from us.

Notifications

This beta sends no push notifications and registers no push token; alerts appear only while the app is open. That in-app alert involves no server.

Overlay networks (optional)

If you add a Tailscale, ZeroTier or EasyTier network, the app runs that network's software to reach your Hosts. We operate none of these services. The provider and servers you choose process connection data under their own privacy terms. SSH still encrypts everything between your device and Host, so they see encrypted packets and network metadata, never terminal content or SSH credentials.

• Tailscale: the coordination server (Tailscale's, or one you enter such as Headscale) registers the device with its name, keys and addresses; a DERP relay learns its IP address and may carry traffic until a direct path works. Tailscale's log upload is turned off.
• ZeroTier: root servers, any custom roots or moons, and the network controller learn the device's ZeroTier node ID, networks, public IP address and port. One ZeroTier node serves every ZeroTier network in the app, so each set of roots may also learn which ZeroTier addresses the device looks up on the other networks. The app may ask your router for a port mapping (UPnP or NAT-PMP).
• EasyTier: peers you enter, or a Config Server and the peers it assigns. A Config Server knows the network secret and receives the device's machine ID, name and network state; entering only a user name uses EasyTier's public server at config-server.easytier.cn. Members of the network learn the device's name and IP addresses. To find direct paths, EasyTier queries public STUN servers, EasyTier's own and third-party ones such as Xiaomi's, Bilibili's, Cloudflare's and Twilio's, which learn the device's public IP address.

Deleting a network, or signing out of Tailscale, in the app deletes its secrets and state but does not remove the device from the provider. Remove it in the provider's admin console.

Data we receive

For the App Store and TestFlight, Apple shares crash and usage data with us only if you allow it under iOS Settings › Privacy & Security › Analytics & Improvements › Share with App Developers, and usage data only in aggregate.

We do not sell this data, use it for advertising or profiling, or combine it with other data. Our legal basis for emails is your request (to answer you) and our legitimate interest in supporting the app. TestFlight feedback and crash data reach us only when you choose to send them, so the basis is your consent, together with our legitimate interest in fixing bugs; you can withdraw consent by no longer sending them and asking us to delete what we have. Emails are stored with our email provider for as long as we keep them, as set out above. Apple handles TestFlight data as an independent provider under Apple's Privacy Policy; App Store and TestFlight downloads are also handled by Apple.

This website sets no cookies, loads no scripts or third-party resources and has no analytics. Our hosting provider, DigitalOcean, processes standard request data such as IP addresses to serve the pages, and keeps request logs for a limited time under DigitalOcean's Privacy Policy. We do not use them for analytics.

International transfers

Apple (TestFlight and App Store Connect), DigitalOcean (website hosting) and our email provider may process the data above outside Switzerland, the EU and the UK, in particular in the United States. Such transfers rely on an adequacy decision, including the EU-US Data Privacy Framework and its UK and Swiss extensions where the provider is certified, or otherwise on standard contractual clauses.

Your choices, deletion and withdrawing consent

• Permissions. Turn local network access on or off at any time in iOS Settings.
• Remove a Host. Deletes its record, any saved password and its cached Chat conversations from the device. To revoke the device's access to a computer, delete its line (it ends with a name such as herdrpocket-iphone-…) from ~/.ssh/authorized_keys on that computer.
• Remove a network. Deletes its secrets and state; remove the device at the provider too.
• Delete the app. Removes its data from the device. iOS may keep Keychain items after an app is deleted: saved passwords, the Device Key, the RSA Key and overlay network secrets. Removing a Host does not delete the Device Key or RSA Key, which every Host shares.
• Leave the beta. Stop testing in the TestFlight app.
• Data we hold. Email [email protected] to access it, correct it, delete it, restrict or object to its use, receive it in a portable format, or withdraw your consent. We reply within one month, as data-protection law requires. Depending on where you live, under the GDPR, the UK GDPR or the Swiss Federal Act on Data Protection (FADP), you may also complain to your data protection authority, such as your EU supervisory authority, the UK Information Commissioner's Office or the Swiss Federal Data Protection and Information Commissioner (FDPIC).

Children

Herdr Pocket is a developer tool and is not directed at children. We do not knowingly receive data from children under 13 (or the minimum age in your country). If you believe a child has sent us data, email us and we will delete it.

Security

SSH encrypts all traffic with your Hosts, private keys and secrets stay in the Keychain, and host keys are confirmed by fingerprint before the first connection and checked on every later one.

Changes to this policy

We will update this page when the app's handling of data changes, and change the date above. If we ever operate a push relay or any other service, this policy will be updated before it is turned on.

Contact

Vision Music & Media Limited · [email protected]. Please don't send passwords, keys or other secrets by email.