Privacy Policy

Moray is provided by Bartłomiej Żabicki, a sole proprietor established in Poland, operating as BartStudio. For the purposes of the EU General Data Protection Regulation (GDPR), he is the data controller for the personal data described here.

Registered address: ul. Podgórska 3, 32-010 Baranówka, Poland · NIP: PL6821775165 · Contact: hello@bartstudio.io.

This policy covers the Moray apps for iPhone, iPad and Mac and the website at moray.bartstudio.io. Read it together with our Terms of Service.

Moray is unusual among SSH clients in that we operate no service for it to talk to. That single architectural decision is most of this policy:

• There is no Moray account. Nothing to register, so no name, email or password of yours exists on our side.
• No server of ours sits between you and your servers. The app connects directly. Your sessions, commands and transferred files never pass through us.
• Sync is your own iCloud. With Moray Pro, hosts, groups, snippets, command history and known host keys move through your private CloudKit database, which Apple does not let us read.
• Private keys and passwords stay in the Keychain, device-local by default, gated behind Face ID or Touch ID.
• No advertising and no tracking. The app sends crash reports and anonymous feature usage to Google Firebase so we can fix problems — never your hosts, usernames, commands, files or keys, and nothing that identifies you. One switch turns it off: Settings → Privacy → Share Crash Reports & Usage.
• The website sets no cookies and does not track you between visits. It counts page views with a privacy-preserving analytics beacon that stores nothing on your device.

Everything that matters, and we could not retrieve any of it if asked:

• Private keys — Ed25519 and RSA keys you generate or import live in the device Keychain, encrypted at rest and biometric-gated. They are never written to the app's own data store, never included in a backup export unless you explicitly ask, and never transmitted to us. They only sync between your devices if you turn on iCloud Keychain sync yourself.
• Saved passwords and passphrases — same store, same protection, scoped to the host you saved them for.
• Terminal output and scrollback — held in memory for the session and not persisted off-device.
• Command history — the commands you type, kept per host so you can search and re-run them. Anything typed at a password or passphrase prompt is never recorded, and a command that starts with a space is left out. It syncs only through your own iCloud, as described below.
• Files you transfer over SFTP — they move between your device and your server. Nothing is staged with us.
• Host fingerprints you have trusted — stored locally, and synced with your other devices only through your own iCloud.

If you have Moray Pro and turn sync on, Moray stores your metadata in the private database of its CloudKit container in your Apple account: hosts and their addresses, ports and usernames; groups and tags; snippets; port-forward definitions; trusted host keys; the names, types and public halves of your SSH keys (never the private key); the names of saved passwords (never the password); bookmarked folders; custom themes; and your command history. Private keys and passwords travel only if you separately turn on iCloud Keychain sync, and then through Apple's end-to-end encrypted iCloud Keychain, not CloudKit.

This is your data in your Apple account. Under Apple's CloudKit model a developer cannot read the contents of a user's private database — we can see aggregate, anonymous usage and error counts for the container in Apple's dashboard, and nothing about you or what you stored. Apple processes it under Apple's privacy policy.

Turn sync off and the data stays on the device. Delete the app's iCloud data from iOS Settings and it is gone; there is no second copy with us to purge. Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR).

Moray Pro is bought through Apple. We never see or store your payment card, billing address or Apple ID password.

To know whether a device is entitled to Pro, the app uses RevenueCat, which records the purchase against a pseudonymous app user id generated on your device: the product bought, the store, whether it is active, and when it expires. For App Store purchases that identifier is not linked to a name or an email address, because Moray never asks for either. Legal basis: contract.

So that Pro follows you, a paying device also stores that identifier in your iCloud Keychain, where your other devices and both versions of Moray for Mac can read it. It is end-to-end encrypted by Apple and never leaves your Apple account except as the pseudonymous id RevenueCat already has.

Sign in with Apple is optional and only moves Pro to a device your iCloud Keychain doesn't reach. Moray asks Apple for no name and no email address, only the stable identifier Apple issues for Moray; your device checks Apple's signature itself, and the identifier becomes your RevenueCat app user id. Our sign-in page passes Apple's answer back to the app and keeps nothing. Legal basis: contract.

If you buy Pro on our website for the direct download of Moray for Mac, checkout is run by RevenueCat and payment is processed by Stripe. They collect your email address, payment details and billing country so the payment can be taken, a receipt sent, VAT applied and fraud prevented; we can see your email address, what you bought and when, but never your full card number. We keep purchase records for as long as tax law requires (in Poland, five years from the end of the tax year). Legal basis: contract and legal obligation.

Apple also gives every developer aggregate App Store analytics — download counts, crash counts, territory breakdowns. These are statistics, not records about you, and they are not combined with anything else.

The app uses Google Firebase Crashlytics and Firebase Analytics. When Moray crashes it sends a crash report — the stack trace, the app version, the device model and OS version, free memory and disk space — and while it runs it counts which screens and features are used. Both are keyed by a random app-instance id that Firebase creates for your installation; it is not linked to your name, Apple ID, email or purchase, and resets if you delete the app.

What is never included: hostnames, addresses, usernames, commands or their output, file names or contents, keys, passwords or anything else about the servers you connect to. No advertising identifier is collected, advertising consent signals are set to denied, and nothing is used for tracking across other companies' apps or websites.

It is on by default and off with one switch: Settings → Privacy → Share Crash Reports & Usage. Turned off, nothing further is sent. Crash reports are kept by Firebase for 90 days; usage data is kept for 2 months. Legal basis: legitimate interest in finding and fixing crashes and deciding what to improve, balanced by the fact that the data does not identify you and can be switched off at any time.

moray.bartstudio.io is a set of static pages. It sets no cookies, stores nothing on your device and loads no advertising scripts, trackers or pixels. There is no consent banner because nothing is stored on your device to consent to.

We do count page views, using Cloudflare Web Analytics. It is cookie-free by design: it sets no identifier, writes nothing to your browser’s storage, and cannot follow you to another site. What it records is the page you viewed, the referring page, your browser type and the country your request came from — aggregate figures that tell us which guides are worth writing more of. None of it identifies you, and none of it is combined with anything else we hold. Legal basis: our legitimate interest in understanding how the site is used (Art. 6(1)(f) GDPR).

• Waitlist form: your email address, held on a mailing list at Resend and used only to tell you when Moray ships. Every message includes an unsubscribe link. Legal basis: your consent (Art. 6(1)(a) GDPR), withdrawable at any time.
• Contact form: your name, email address, topic and message, emailed to us so we can reply. Legal basis: legitimate interest in answering people who write to us.
• Abuse prevention: both forms keep a short-lived, non-reversible record derived from your IP address so a single client cannot flood them. It expires within minutes.

Our hosting provider keeps standard access logs for a short period, for security and troubleshooting.

• No advertising, ad networks or ad identifiers.
• No App Tracking Transparency prompt, because there is no tracking across other companies' apps or websites to ask about.
• No advertising identifier, no user id and no profile: crash reports and usage counts are keyed only by a random id Firebase creates for each installation.
• No selling, renting or sharing of personal data.
• No reading of your sessions, commands, files or server contents — we cannot.
• No automated decision-making or profiling.

A short list, because there is little to process. Apple acts as an independent controller for your Apple account, iCloud and App Store purchases under its own policy; the others act on our instructions under a data processing agreement.

Website data is held on secured infrastructure within the European Union. Some providers above are established in the United States and may process limited data outside the European Economic Area; where that happens we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses or an adequacy decision.

We may also disclose data where required by law, court order or other lawful request; where necessary to establish, exercise or defend legal claims; or to protect the rights, safety and security of our users, the public or us.

• Your app data — for as long as you keep it. Deleting the app, or its iCloud data in Settings, removes it. We hold no copy.
• Purchase and entitlement records — retained while an entitlement is live, and afterwards as long as tax and accounting law requires (in Poland, five years from the end of the relevant tax year).
• Crash reports — 90 days. Anonymous usage data — 2 months.
• Waitlist email — until you unsubscribe or we announce the launch and close the list.
• Contact-form emails — up to 24 months, so a follow-up conversation still has its history.
• Aggregated or anonymised data — once it can no longer identify you, we may keep and use it without further notice.

Where you ask us to delete something rather than deleting it yourself, we act promptly and in any event within 30 days, except for records we must keep to comply with legal, tax or accounting obligations, to prevent fraud or abuse, or to establish, exercise or defend legal claims.

Under the GDPR you can ask us to:

• Access the personal data we hold about you, and get a copy. In practice this is a purchase record and any email you have sent us.
• Correct anything inaccurate.
• Erase it. Your app data you can delete yourself, without asking; for the rest, email us.
• Export your data. The app's JSON backup writes your hosts, groups and snippets to a file you control at any time.
• Restrict or object to processing based on legitimate interest, and withdraw consent — unsubscribe from the waitlist — without affecting what happened before you withdrew it.

Email hello@bartstudio.io and we will respond within one month. If you think we have handled your data badly you may complain to your local supervisory authority; ours is the President of the Personal Data Protection Office (UODO).

If you are in California, we do not sell or share personal information as those terms are defined by the CCPA/CPRA, and we do not discriminate against anyone who exercises their rights.

• SSH and SFTP traffic is encrypted by the protocol itself, end to end between your device and your server. Website traffic uses HTTPS/TLS.
• Private keys, passphrases and saved passwords are kept in the Keychain, the storage Apple provides for secrets, rather than in ordinary preference files.
• Moray never trusts a server silently. The first time you connect it shows the server's fingerprint and randomart key picture and waits for you to trust it; the key is then pinned, and if it ever changes the connection stops on a “Server identity changed” screen until you decide — the check that makes an interception attempt visible.
• A biometric app lock can gate the whole app, not just individual secrets.

No method of transmission or storage is completely secure. While we work hard to protect your information, we cannot guarantee absolute security, and you use Moray at your own risk. If a personal-data breach ever affects your rights we will notify the supervisory authority within 72 hours and inform you directly where the law requires it.

Moray is a professional tool for people who administer servers. It is not directed at children, and we do not knowingly collect personal data from anyone under 16. If you believe a child has given us data, write to hello@bartstudio.io and we will delete it.

This is version 6. When we change it materially we bump the version number and update the date above, and where appropriate we will tell you in the app or by email. Your continued use after a change means you accept it; if you don't, stop using Moray and delete it.