RemoteGate — Privacy Policy
Related document: RemoteGate Terms of Service.
RemoteGate (“the App”) is an SSH terminal client published by RareGleam Co., Ltd. (“we”, “us”). This policy explains what data the App handles, where it is stored, and what is sent to us or to third parties.
1. Summary
- Every piece of SSH connection data the App handles — hosts, usernames, authentication keys/passphrases, host fingerprints, terminal preferences — is stored only on your device.
- We do not operate any RemoteGate backend. The App does not send your terminal sessions, keystrokes, host information, or credentials to RareGleam.
- The App does not include analytics, tracking, advertising, or crash-reporting SDKs.
2. Data stored on your device
| Data | Where it is stored | Why |
|---|---|---|
| Host records (alias, hostname, port, username, optional startup script) | Local SQLite database (sqflite) | Listing and connecting to your saved servers. |
| SSH host-key fingerprints | Local SQLite database, alongside the host record | TOFU (trust-on-first-use) verification on every connect — mismatches hard-block the connection. |
| Imported PEM private keys and their passphrases | OS-level secure storage (iOS Keychain / Android Keystore) via flutter_secure_storage | Authenticating to your servers. |
| Hardware-backed keys generated by the App | iOS Secure Enclave / Android StrongBox | Authenticating to your servers. The private-key bytes never leave secure hardware. |
| Daily SSH connection counter | Local key-value store (SharedPreferences / UserDefaults) | Enforcing the free-tier daily quota. Resets at 00:00 UTC. |
| Subscription entitlement snapshot | Local key-value store | Remembering whether you have an active subscription between launches. |
You can erase all of this data by uninstalling the App.
3. Data transmitted off your device
When the App connects to a server you configure:
- Your username, authentication material (key signature or password) and terminal-session traffic are sent directly to the SSH server you choose. RareGleam is not on the network path.
- No third party sees that traffic.
When you make an in-app purchase or subscribe:
- The transaction is processed by Apple (App Store / StoreKit) on iOS and Google (Google Play Billing) on Android. Payment details (card data, store account) are handled entirely by Apple or Google under their own privacy policies. RareGleam does not see card or billing details.
- The App receives only an entitlement receipt indicating which product (
monthly/yearly/lifetime) is active and when it expires. That receipt is stored on your device.
The App does not call any RareGleam server.
4. Third-party services
- Apple App Store / StoreKit — payment, subscription state, receipt validation. Subject to Apple’s privacy policy.
- Google Play / Play Billing — payment, subscription state, receipt validation. Subject to Google’s privacy policy.
- Your SSH server — whatever you type into the terminal is sent there.
5. Children
The App is not directed at children under 13. We do not knowingly collect data from children.
6. Security
SSH credentials never leave your device except as required by the SSH protocol itself, to the server you choose. PEM-imported keys and passphrases live in OS-encrypted secure storage. Hardware-generated keys are bound to the Secure Enclave / StrongBox — the App can request signatures but cannot extract the private key. The App does not silently override host-key changes; a fingerprint mismatch blocks the connection.
7. Your rights
Because we do not collect personal data on any RareGleam server, we have no record to disclose, correct or delete on request. To remove the App’s on-device data, uninstall the App. To manage or cancel an auto-renewable subscription, use your Apple ID or Google Play account settings.
8. Changes
We may update this policy. Material changes are reflected by updating the “Last updated” date and, where practical, surfaced in the App.
9. Contact
RareGleam Co., Ltd.3rd Floor, Marion Iijima, 5-8-3 Higashi Ueno, Taito-ku, Tokyo, Japan
Email: info@raregleam.com