Privacy

Herden is a native iOS console for the Herden Host. It connects to machines you control over SSH. Herden has no user accounts, advertising, analytics, or tracking. Your SSH credentials, terminal output, prompts, files, and live agent sessions do not pass through a service operated by Herden’s developer.

Agent Notifications use the limited-purpose Push Relay described below.

Data stored on your device and Hosts

• SSH credentials. The Device Key’s private half is generated on your device, remains in the iOS Keychain, and never leaves it. Host fingerprints are stored locally. Saved Host passwords are stored in the Keychain.
• Notification Keys. A separate key is generated on your device for each Host. It is stored in the shared Keychain and mirrored in the app’s shared container so Live Activities can be decrypted while the device is locked. The protected mirror is excluded from backups. Herden copies the key over SSH to that Host; the Push Relay never receives it.
• Host list and settings. Your Hosts and Herden settings are stored locally. Each Host stores its own notification registration and delivery preferences.
• Live agent activity. Terminal output, prompts, and pane contents travel only over the direct SSH connection between your device and your Host.

Agent Notifications and the Push Relay

Agent Notifications can tell you when an agent is blocked or done while Herden is backgrounded or closed. Apple Push Notification service requires an Apple credential authorized for this app’s bundle ID, so the TestFlight build uses a relay hosted by the developer at https://herden-apns.austrheim.ca7.fm.

The relay has no accounts, database, durable queue, retry queue, or message history. A Host encrypts notification details with its Notification Key, then the relay signs and forwards the request to APNs without receiving the key needed to decrypt those details.

Data processed by the Push Relay

For every notification request, the relay processes:

• the Apple push token needed to address your device;
• the encrypted notification envelope;
• the Host’s source IP address;
• request timing, frequency, and size; and
• the APNs environment and limited delivery-routing values.

For a Live Activity update, APNs must also receive these values in cleartext:

• aggregate counts of agents that are working, blocked, or done;
• the event, delivery priority, and event timestamp; and
• when present, stale and dismissal timestamps.

These values do not identify an individual agent. Project names, task titles, agent types and names, Host names, pane IDs, and per-agent details remain inside the encrypted envelope. If a notification cannot be decrypted, Herden shows a generic fallback instead of unverified content.

Purpose, retention, and providers

The relay uses this data only to validate requests, limit abuse, and deliver notifications to APNs. It does not use the data for advertising, analytics, tracking, profiling, or sale. It does not write device tokens, notification bodies, ciphertext, or request history to application-managed durable storage. Source IP addresses and Apple push tokens are held in volatile memory for one-minute rate-limit windows.

Notifications are delivered by Apple APNs, which may process network and delivery metadata under the Apple Privacy Policy.

Your choices and deletion

• You can decline or revoke notification and Live Activity permissions in iOS Settings.
• Removing a Host’s Notification Registration deletes this device’s token and Notification Key from that Host, then removes the local per-Host Notification Key.
• Removing a Host from Herden deletes its local Host record and any saved Host password.

Herden has no account or user-content database, so there is normally no server-side profile or content to retrieve or delete. For a privacy or deletion request, email ted@3loc.ltd. Do not include credentials, tokens, Host details, or other sensitive information in the first message.

Custom relay URL

The notification plugin and Herden accept a custom push relay base URL, so you can operate your own relay. A custom relay works only with an app you build and sign yourself and requires APNs credentials authorized for that app’s bundle ID. The maintained source is not currently published while Herden is in private beta.

Contact

For policy questions, email ted@3loc.ltd. Report suspected vulnerabilities to the same address with the subject “Herden security”, the affected version, and a minimal reproduction. Never include private keys, passwords, tokens, Host addresses, or user content.