Effective November 2, 2026

Privacy policy

Mux Manager is an open-source SSH and tmux client for iPhone, iPad, and Mac, maintained by Kris Linquist. The app has no developer-operated backend, advertising, or analytics SDK. It does not automatically send your connection profiles, credentials, commands, or terminal output to the developer.

SSH and your computers

The app connects to hosts and optional bastions you configure. Those computers receive authentication traffic and, as appropriate, the commands and input you send. The app reads tmux session/window metadata and bounded terminal snapshots to display your work. SSH encrypts traffic between the app and each SSH endpoint. Operators of your hosts and programs running there control their own processing and retention.

The app does not call an OpenAI API. If you use Codex or another service on a remote computer, that service’s privacy practices apply separately.

Local Mac terminals

The Mac app includes a built-in This Mac connection. It starts the logged-in user’s shell and talks to local tmux directly, without SSH authentication. This entry is not saved in the connection library, Keychain, or CloudKit and is not synchronized to other devices. Local commands run with the Mac user’s permissions, subject to macOS privacy controls. The app uses normal desktop process and file access to run shell startup files and reach tmux sockets. As with remote sessions, terminal output stays in memory; local drafts, resize recovery, and optional notification settings stay on the device.

Saved connections and private iCloud sync

Connection profiles (including names, hostnames, ports, usernames, authentication references, and bastion relationships) and public-key metadata are saved locally. They sync automatically through your Apple Account’s private CloudKit database when available. This is not a public database, and the developer does not receive access to its records through the app.

Passwords, SSH private keys, and imported key passphrases are stored as synchronizable Apple Keychain items and can sync through iCloud Keychain according to your device and Apple Account settings. They are not stored in the CloudKit profile records. Apple’s platform terms and privacy policy apply to iCloud and Keychain.

Local drafts, output, and diagnostics

Unsent drafts, host-key trust decisions, and resize-recovery records stay local to the device and are not included in the app’s CloudKit sync. Drafts and resize records are saved in the app’s local storage; host trust uses local Keychain items. Terminal output is held in memory for display. The app does not create a persistent terminal transcript. Device backups and system behavior remain subject to your Apple settings.

Connection diagnostics are a bounded, in-memory log. They can include hostnames, IP addresses, usernames, paths, selected environment fields, tmux versions/sockets, and session/window names. The diagnostic logger excludes passwords, private keys, submitted input, and terminal contents. Logs are shared only if you choose to copy and send them. Review and redact a report before publishing it.

Optional local Codex notifications

If you enable Codex notifications on a device, the app reads current tmux screens across connected hosts to make a best-effort assessment of whether Codex is ready or waiting for input. Detection state stays in memory and is not a persistent transcript. Local notifications include the host/window names, a generic status, and the saved identifiers needed to reopen that window. They do not include terminal response text or credentials, and the app does not send them through a developer-operated server or remote push service. The preference is stored locally and is not included in CloudKit sync. Notification display, lock-screen visibility, and retention are controlled by your operating system and notification settings.

Retention and deletion

You can delete saved connections and unused SSH keys in the app. Deleting a connection removes its associated saved password; deleting a key removes its saved private key and passphrase. Deletion records retain profile or public-key metadata so deletion can propagate between devices; those records may remain in local storage and your private CloudKit database. Deleting an item is therefore not an immediate erasure of all synced metadata.

You can manage the app’s iCloud storage and iCloud Keychain using Apple’s account/device controls. Removing the app does not necessarily remove cloud records or Keychain items. Copies in backups, another device, or your remote computers are governed by those systems. Disconnecting does not stop or erase remote tmux sessions. Drafts and host trust decisions have no CloudKit sync and remain subject to local app storage and Keychain retention.

Support and this website

Support uses GitHub Issues. Information you voluntarily post there is public and is processed by GitHub. Never post credentials or unredacted private connection details. This site is hosted by GitHub Pages, has no added analytics, advertising, or tracking scripts, and is subject to GitHub’s privacy statement. GitHub may process ordinary web request information. Apple may separately process platform diagnostics according to your settings.

Changes and questions

Changes to this policy will be published here with an updated effective date. For privacy questions or requests, open a GitHub issue with a general description and no private data. The app’s data handling can also be reviewed in its source code.