Last updated 21 October 2026
Shellway is made by Nicholas Xerri, an independent developer in Malta ("I", "me"). I'm the data controller for the little that this policy covers.
Your vault
Hosts, keys, passwords, snippets and settings are stored in one file that's encrypted on your device with your vault password. If you choose iCloud Drive, Apple stores that encrypted file in your iCloud account under Apple's privacy policy. I can't read it, and I don't receive a copy.
Connections
When you connect, Shellway talks directly to the servers you add. I don't see, relay or log that traffic.
What leaves your device
| Data | Goes to | When |
|---|---|---|
| The encrypted vault file | iCloud Drive (Apple) | Only if you keep the vault in iCloud Drive |
| Your SSH and SFTP traffic | Your own servers | When you connect |
| The question you type and your server's operating system and shell | Anthropic | Only when you use AI command help, which is off by default |
| Purchase receipts | Apple | Buying or restoring Shellway Pro on iPhone and iPad |
| Licence key and an anonymous installation name | Lemon Squeezy, my payment provider | Activating a licence key, and a check at most once a day |
AI command help
This is optional and off by default. If you turn it on and add your own Anthropic API key, the text you type into the AI box and your server's operating system and shell are sent to Anthropic to generate an answer, under Anthropic's own terms and privacy policy. Terminal output, host names, addresses, user names, keys and passwords are never sent. You can turn it off at any time in Settings.
Purchases
In-app purchases are handled by Apple, and I don't receive your payment details. If you activate a licence key bought directly from me, Shellway sends the key and an anonymous installation name to Lemon Squeezy to check it.
Support emails
If you email me, I use your email address and what you send only to answer you. I keep the conversation for as long as it's needed to help you and then delete it, and I never share it or use it for marketing.
Children
Shellway is a tool for managing servers and isn't directed at children.
Your rights
Under the GDPR you can ask me what personal data I hold about you, and ask me to correct or delete it. Since Shellway doesn't send me any, in practice this only covers support emails. You can also complain to Malta's data protection authority, the Information and Data Protection Commissioner.
Changes
If this policy changes, I'll update this page and the date at the top. If a change means Shellway would send anything new off your device, the app will tell you before it happens.