OpsPocket privacy policy

Effective 8 November 2026

The short version

Who we are

OpsPocket is made by Mt7 Private Limited, Adnan Complex, Bahraich, Uttar Pradesh 271801, India ("we" or "us"). You can reach us at developer@mt7.in.

Very little personal data ever reaches us: the emails you send us, the AI answers you report to us, and the order records Google or Apple give us if you buy OpsPocket Pro, and, in versions that check Pro with our server, what that check needs. For those, we are the "data fiduciary" under India's Digital Personal Data Protection Act 2023 and the "controller" under the GDPR. Everything else stays on your phone or goes where you send it.

What stays on your phone

OpsPocket keeps these on your phone only:

On an iPhone, your servers, passwords, keys and settings are kept in the Keychain for this iPhone only, never synced to iCloud. On Android they're encrypted with a key held by the Android Keystore. The audit log is a file in the app's own storage, and chats with the agent are kept there too, encrypted (AES-256-GCM) with a key from the same secure storage. None of it moves to a new phone by itself, or into the phone's own backups. To move to a new phone you can make an OpsPocket backup yourself (Settings → Move to a new phone): one file, encrypted (AES-256-GCM, with a key made from a passphrase you choose using Argon2id), saved or shared where you choose. It holds your servers, their fingerprints and your settings (your name and Strict privacy among them), and your SSH keys, saved passwords, AI key or join keys only if you switch each on. You can also export your servers as an SSH config file, without passwords or private keys. We never receive any of it, and without the passphrase nobody, us included, can open a backup.

Where data goes when you use the app

Your servers

Everything you do with a server goes over SSH, straight from your phone to that server, encrypted. That covers the terminal, health readings, processes, services, cron, files, conversations, the agent chat, IR remotes through LIRC, web pages you open from a server, and the checks behind alerts. Sign-in and security alerts run a read-only command that reads your server's sign-in log, users, login keys, open ports and running programs; it changes nothing there, and what it reads comes back only to your phone. A server you set to connect through a jump server is reached through that server of yours, still encrypted end to end between your phone and the server behind it. Nothing passes through us. Your server, and whoever hosts it, handle the data from there.

The app keeps a few files of its own in a folder called .opspocket in your home folder on the server: a copy of your crontab before each change the app makes to it, and, while a message to the agent runs, that message and the agent's answer, which the app deletes once it has read them back. Runs that were never read back are deleted the next time you message the agent, once they're more than 3 days old. Photos, videos and files you send to the agent are uploaded to .opspocket/uploads, in a folder only your account on the server can open. Once they're more than 7 days old (or 1 or 30, as you choose in Uploaded files), they're deleted the next time you message an agent on that server, unless it's set to read-only; you can delete them sooner from Uploaded files. You can delete the folder at any time.

The app reads your ~/.ssh/authorized_keys on a server when you open "Keys that can log in", and, once after it connects, to check this phone's own line there. It changes the file only when you ask it to (removing a key, or limiting where this phone's key works from), to move on the end date of this phone's own line when it connects, and to remove this phone's own line after too many failed unlocks (see below). Before each change it saves a copy next to the file, named authorized_keys.opspocket- and the time, and keeps the newest three. Every line it doesn't change stays exactly as it was. All of this happens over SSH between your phone and your server.

The Assistant and your AI provider

The Assistant works only after you set it up in Settings, Assistant, with your own API key. You choose the provider: Anthropic (Claude), OpenAI, OpenRouter, or an address you type in, such as Ollama on your own server.

Before the first request to a provider, the app shows what it will send and asks you. It asks again if you change the provider or its address. Nothing goes until you tap Allow, and you can turn it off at any time in Settings, Assistant.

Depending on where you ask, the app sends:

Before anything goes, the app takes out passwords, tokens and keys it recognises, from attached text files too. It can't take them out of photos or PDFs, so check what you attach. Where a photo was taken (its GPS location and place names) is removed before it goes. It can't spot every secret, so check what you ask about. IP addresses go too, unless you turn on "Hide IP addresses too". Files that hold sign-ins or keys, such as AI tools' sign-in files, SSH private keys and .env files, are never sent.

Requests go straight from your phone to the provider over HTTPS. If you type an address that starts with http://, they travel unencrypted, and the app tells you so first.

The provider handles your requests under your account with it, and under its own terms and privacy policy. We never receive them. See the policies of Anthropic, OpenAI and OpenRouter, or of the service you entered.

The agent on your server

The agent chat talks to a coding agent that is already on your own server, such as Claude Code, Codex or Gemini CLI. Your messages go over SSH to your server. The agent runs there under your account, and sends your messages, and what it reads while it works, to its own AI provider (Anthropic, OpenAI or Google) under your own sign-in. The agent may also keep its own history on your server, under its own settings. The app asks once before your first message.

You can attach photos, videos and files to a message. They're uploaded over SSH to your server (see "Your servers" for where they're kept and for how long), and the message names them so the agent can open them. The agent sends what it reads of them to its provider, like any file it reads. Where a photo or video was taken is removed on your phone before the upload. If you ask for key frames of a video, your server makes a few pictures from it with ffmpeg, next to the video. The app asks once more before you first send files, naming them. Files that hold keys or passwords, such as .env files and private keys, can't be attached. A server set to read-only gets no files.

The chats are kept on your phone, encrypted. They're never sent to us, or to the Assistant's provider, unless you report one of the agent's answers (below).

Reporting an AI answer

Under each answer from the Assistant or the agent there is Report this answer. If you send a report, it comes to us over HTTPS (at opspocket.mt7.io) with the answer, the reason you chose, your note if you wrote one, whether it came from the Assistant or the agent chat, and the app's version. Before it goes, the app takes out passwords, tokens, keys and IP addresses it recognises. Nothing about you, your phone or your servers is added. We use reports only to look into them and to make the Assistant's answers safer, and delete them within 12 months.

No analytics, no tracking

OpsPocket doesn't count, record or send how you use it. It has no analytics, advertising, tracking or crash-reporting code, from us or anyone else. Because we don't watch how the app is used, we rely on you to tell us what's broken or missing: Send feedback and Report a problem in the app open your own email app or share sheet.

Buying OpsPocket Pro

Some versions of OpsPocket sell OpsPocket Pro, a subscription that adds more servers, alerts, home screen widgets and live status for more than one server. You buy it through Google Play or the App Store, with your account there. They take the payment under their own terms and privacy policies, and we never see your card details, name, email or account.

To turn Pro on, the app asks Google Play or the App Store on your phone whether your account has the subscription. On an iPhone, the App Store checks the purchase's signature on the phone. The app keeps only the subscription's state on your phone, in its encrypted storage: whether you have Pro, which plan, when it ends if the store says, and when it last checked. That lets Pro keep working when you're offline. There's no subscription service in between. In versions without our Pro check (below), the app sends nothing about your purchase anywhere.

Google and Apple tell us about sales so we can do our accounts, pay tax and help with refunds: for example the order number, the plan, the price, the country and the dates. What they tell us, and what else they keep, is under their own terms and privacy policies (Google's privacy policy, Apple's privacy policy).

"Restore purchases" asks your store account for your earlier purchases, so Pro works on a new phone. To cancel, use Google Play or your Apple Account's subscriptions: deleting the app doesn't cancel it.

Checking Pro with our server

Some versions of OpsPocket also check Pro with a small server of ours, so a changed copy of the app or a faked purchase can't turn Pro on. It runs only if you have Pro, when you buy or restore, and then a few times a week. With Strict privacy on, it runs only when you tap Check once (see "Network activity and Strict privacy"). Each time, the app sends our server:

Our server asks Google or Apple whether the subscription is paid for, then sends back a short signed note saying "Pro until this date, for this install", with when the period you paid for ends, which the app keeps. It never receives anything about your servers, keys, files or chats, and no name, email, phone number or location.

Our server keeps only what the check needs: a scrambled form of the purchase, with the install IDs that used it, for 30 days, so one purchase isn't shared by too many phones. On an iPhone it also keeps the App Attest key for 400 days, so it can check the next signature. For 10 minutes it keeps request counts, keyed by the install ID and by a scrambled form of your network address, to stop floods. It keeps nothing else, and writes no tokens or addresses to its own logs. It runs on Vercel, with its short-term data at Upstash, in the European Union. Like any web host, Vercel also keeps a short log of the requests it serves, with the network address each came from, under its own terms.

If the check can't reach our server, because you're offline or the server is down, Pro keeps working for at least a week and nothing changes. On the phone, the app also looks for signs that it was changed, such as being signed by someone else or hooked by a debugging tool. Those checks run only on your phone and send nothing anywhere. A failed check never locks or erases anything: Pro's extras pause, and Settings says why.

Notifications and widgets

Notifications are made on your phone. There's no push service, unless you turn on alerts with the app closed in a version that has them (see "Alerts with the app closed (optional)" below). Alerts come only after you turn one on, or agent chat notifications, and allow notifications. On Android, an ongoing notification also shows while the app keeps a terminal, an alert, live status or an agent chat running in the background (see "Running in the background" below).

By default they say only what kind of alert it is, such as "A server needs attention", "Security alert on a server" or "Your agent chat needs you", so nothing about your servers shows on the lock screen. Security alerts never show an address, a user name, a port or a program in a notification, even with details on; the app shows those once you unlock it. If you turn on "Show details in notifications", they also name the server and what changed, such as "web-1: Disk is 92% full" or "pg_dump finished after 4 min". A locked Android phone that hides sensitive notification content still shows only the kind. On an iPhone, set Notifications, Show Previews to "When Unlocked" for the same.

If you turn on live status (Settings, Live status), the app reads the servers you pick every 5, 15 or 60 seconds, over SSH, and shows their names, whether they're up and their CPU, memory and disk. On Android this is the ongoing notification, which is hidden on a lock screen with a PIN, pattern or password unless you turn on "Show on the lock screen". On an iPhone it's a Live Activity while the app is open; without that switch, its lock screen view names no server.

Home screen widgets show your servers' names, their status and CPU, memory and disk numbers, why one needs you (such as a full disk, or the name of a service that failed), your active alerts by their kind (such as "New admin user"), and on Android the name of a program running in a terminal, from what the app saved last. On an iPhone you can also put them on the lock screen.

To draw the widgets, the app keeps a small copy of what they show (server names, status words and numbers, never addresses) in its own storage on the phone, outside the encrypted vault, so the home screen can read it. On an iPhone that copy is in an App Group the app shares only with its own widgets. It isn't backed up, and Erase everything removes it.

Neither ever shows a server's address, the files and folders you work with, a command's arguments, output or logs, or your prompts and messages. A server whose name is its address shows as "Server 2" instead.

Alerts with the app closed (optional)

Some versions of OpsPocket can send alerts while the app is closed. It is off until you turn it on for a server. If you do, OpsPocket installs a small helper there: one program in your home folder, a line in your crontab and an opspocket-notify command, all removable from the app. Your server downloads the program from our relay's address and checks it matches the copy the app knows. The helper checks the server every minute and, when something needs you, encrypts the alert on the server with a key made on your phone. It sends it to our relay, which passes it to Apple Push Notification service (iPhone) or Firebase Cloud Messaging (Android) for your phone, which decrypts it.

Our relay receives your phone's push address (a token from Apple or Google), the encrypted alert, and your server's network address, as with any web request. It can't read the alert. It keeps no alerts and no push tokens. To limit how many alerts can be sent and to stop repeats, it keeps one-way hashes for up to a day. When a pairing with a server ends, because you turned it off, removed the server, or the app replaced its keys (it does that after a week, the next time it connects to that server), the relay keeps a one-way hash of the old pairing until it would have run out (30 days at most), so it can't be used again. Our host keeps a short log of requests with your server's address (an hour to a day).

On Android, Firebase Cloud Messaging gives the app an installation ID, which Google keeps until the app deletes it. OpsPocket deletes it when you turn the feature off on every server, and when you erase the app. Apple and Google handle push under their own privacy policies. Your phone contacts our relay only to cancel a server's alerts.

Strict privacy turns this off. Without it, notifications still say only the kind of alert unless you turn on "Show details in notifications".

Send from a computer

When you turn it on, your phone runs a small web page on your Wi-Fi or tailnet, so a computer there can send files to your server through the phone. The page needs a random link, you approve each computer on the phone, and it stops after 10 minutes with nothing coming in. Files go straight on to your server over SFTP and aren't kept on the phone.

The page uses plain http on your own network. When the phone is on Tailscale, only devices on your tailnet can connect, and Tailscale encrypts the connection. On a shared Wi-Fi, use a private network such as Tailscale.

Web pages from your servers

"Open a web page" sends a page that runs on your server through that server's SSH connection. While it's open, the phone listens on its own loopback address (127.0.0.1), which only apps on this phone can reach, and your browser opens the page from there. What the page sends and shows goes only between your browser and your server, and the app doesn't read, log or keep it. The audit log notes only that a port was opened or closed. Your browser keeps the page's cookies and history under its own settings.

IR remotes

The IR code list is part of the app. On a phone with an IR blaster, codes go out as infrared light. Through LIRC, they go over SSH to your server. Nothing goes to us.

Dictation

The microphone button in the terminal's typing box and in agent chat turns what you say into text in the box, so you can fix it before you send it. Your phone's own speech service does this: Android's speech recognizer or Apple's speech recognition. On an iPhone your voice never leaves the phone: an iPhone that can't recognize your language on the device doesn't offer dictation. On Android 12 and later, where the phone can turn speech into text on the phone itself, the app uses that, and your voice stays on the phone. Where it can't, the app says once, before the first use, "On this phone your voice goes to Google's speech service" (or the phone's own speech service), and starts only if you agree. That service may then send your voice to its servers, under its own privacy policy. You can turn that off in Settings, Privacy, and Strict privacy turns it off too. Listening stops when you tap the microphone again, after a few seconds of silence, or when you leave the app. OpsPocket never keeps or sends the recording. The text goes only where you send it, like anything you type.

What you send from the typing box is listed under "Sent before" until the app closes, so you can send it again. It's kept in the phone's memory only, never saved, and text that looks like a password, key or token isn't listed.

"Get a server" opens Hostinger's VPS plans in your browser, with our partner code in the link. If you buy a plan, Hostinger may pay us a commission. The app tells Hostinger nothing about you; it only picks Hostinger's India page or its international page from the country in your phone's language settings, such as English (India). On Hostinger's site, Hostinger's privacy policy applies.

Other links, such as the pages and app store listings of private network apps like Tailscale, this policy and our terms, open in your browser or app store, under those sites' own policies.

"Contact support" opens your email app. "Report a problem" takes a picture of the app's own screen, shows it to you first, lets you leave it out or cover parts of it, and then opens your phone's share sheet or email app with the app version, your system and phone model. The picture is made in the phone's memory. Only if you share it is it saved, in the app's private storage on the phone, while your share sheet takes it. On Android the share sheet keeps that copy until your next share; Erase in Settings removes it. The app sends nothing itself: you choose where it goes. If you write to us, we get your email address and what you write. We use them only to answer you, and keep them for up to 2 years after your last message.

Network activity and Strict privacy

Settings, Privacy, Network activity lists the connections the app made in the last 7 days, up to the newest 1,000, kept only on your phone (see "What stays on your phone"). It opens only after you confirm it's you, with Face ID, a fingerprint or your passcode (on a phone without a screen lock, by typing CONFIRM), and hides your servers' addresses, and an AI address you typed in, until you tap them. Google Play, the App Store, Play Integrity, App Attest and the speech service are reached by your phone's own apps, so the list shows their names without sizes, and the store's answer on whether you have Pro at most once an hour.

Strict privacy, in the same place, stops every connection the app makes but SSH to your own servers, the store on your phone and a Pro check you allow. While it's on, the Assistant, reports on AI answers, online dictation and the Pro check with our server stop before anything is sent. Pro keeps working from your last check for up to 30 days while the store says you have it, then asks you to allow one check. Check once sends only that check, with its one-time proof from Google Play or Apple, and Strict privacy stays on; Network activity marks it "Allowed once". With no check yet, Pro works for up to a week, then waits for a check. The app still asks Google Play or the App Store on your phone whether you have Pro, purchases and Restore purchases you start still go through them, Send from a computer still works between your own computer and your phone while you have it open, and Send feedback still opens your email app.

What OpsPocket connects to

This is everything the app connects to, by kind of service and domain name. The app itself connects to nothing else: no analytics, no ads, no crash reporter and no update checks. Links you tap, such as this policy, support or Get a server, open in your browser.

You can check this yourself. On Android, PCAPdroid (a free app) lists every connection an app makes, without root. On any phone, a DNS log such as NextDNS shows the domains your phone looks up through it, OpsPocket's among them. The app's own list is in Settings, Privacy, What OpsPocket connects to.

The app stores

Google Play and the App Store handle downloads, updates and payments under their own privacy policies. If your phone's settings allow it, Google and Apple share crash reports and install statistics with app makers. We use them only to fix problems. OpsPocket has no crash reporter of its own.

What the app asks your phone for

OpsPocket doesn't use your location, contacts or advertising ID. It uses the microphone only while you dictate, and the camera only when you take a photo to attach.

What we don't do

Children

OpsPocket is a tool for adults who run servers. It isn't meant for anyone under 18, and our terms ask users to be 18 or older. We don't knowingly collect personal data from children. If you think a child has sent us personal data, write to developer@mt7.in and we'll delete it.

How the app protects your data

No app can be perfectly secure. Keep your phone's own lock on, and keep its system up to date. If we learn of a problem that puts your data at risk, we'll fix it, say so in the app's release notes, and tell the authorities where the law requires it.

How long data is kept, and how to delete it

Your rights

Depending on where you live, you have rights over the personal data we hold about you: to know what we have, get a copy, have it corrected or deleted, withdraw your consent, object, and complain. Almost everything OpsPocket keeps is on your phone, where you can see, change and delete it yourself. For the rest, write to developer@mt7.in. We may ask you to confirm the request is yours. We answer within 30 days, or sooner if your law asks for it.

India

Under the Digital Personal Data Protection Act 2023 (the DPDP Act) and the DPDP Rules 2025, you can:

For grievances, write to our Grievance Officer, Addy, at developer@mt7.in. We answer within 30 days.

European Union, EEA and United Kingdom

Under the GDPR and the UK GDPR, Mt7 Private Limited is the controller of the data that reaches us.

California

If you live in California, you have the right to know what personal information we collect and why, to have it deleted or corrected, and not to be treated differently for using these rights. In the last 12 months, the only personal information we may have collected is your email address and what you wrote, if you emailed us, a report on an AI answer, if you sent one, and the store's order record (order number, plan, price, country and dates), if you bought OpsPocket Pro, along with the Pro check's purchase proof and random install ID, in versions that check Pro with our server. We don't sell or share personal information, and we don't use sensitive personal information.

Changes to this policy

When we change this policy, we'll publish the new version here with a new date. If a change means the app sends something new, the app will ask you before it sends it.

Contact