Outrigger outrigger App Store
❯ cat privacy.txt

Where your data goes.

Your SSH data goes directly to the servers you configure. Cloud assist data goes directly to the provider you choose, only after you opt in. Apple handles StoreKit and system services; Outrigger has no app backend.

Last updated 21 September 2026 · applies to Outrigger for iPhone, all versions; sections marked 1.1 apply to version 1.1 and later

data flow
your iPhone
keys · hosts · snippets
scrollback · summaries
ssh
your servers
everything you type and everything they answer — traffic we never see
opt-in · your key
your AI provider · opt-in
only the output you ask about, straight to Anthropic, OpenAI, or your own endpoint — off by default
nothing, ever✕
us
no servers this app talks to · no account · no sync · no analytics SDK

What stays on the device

SSH keys, saved host passwords, and assist API keys are stored on this device only and do not migrate to another device through backup. Host entries and snippets are stored in the app container under iOS file encryption. Outrigger does not intentionally persist terminal scrollback or ✦ assist summaries; they live in memory and leave with the session. Before iOS snapshots the app for its task switcher, Outrigger covers the interface so visible terminal data is not captured. How keys are generated and encrypted is covered on the security page.

In its default mode, the ✦ assist runs entirely on device and scrollback is never uploaded anywhere. The opt-in cloud mode is covered below.

What leaves the device

SSH traffic goes to the hosts you configure, including your public key, as SSH requires. So do files you choose to send with +file (1.2). If you switch the ✦ assist to a cloud provider and add your own API key, the terminal output you ask about goes directly from your phone to Anthropic, OpenAI, or the server you configured; it does not pass through us. Apple system services may connect for StoreKit purchases, entitlement checks, and diagnostics governed by your iOS settings. Outrigger has no service of its own to contact.

Purchases go through the App Store. Apple handles the payment and tells the app a purchase happened; we never see your name, card, or email, only anonymous aggregate sales counts. There is no per-person data on our side.

Commands Outrigger runs on your server (1.1)

In version 1.1 and later, tapping a host signs in and shows a screen listing the shells open in Outrigger and the tmux sessions on the server. No shell starts on the server until you pick one.

To build that screen, for scrolling and catch-up in tmux, to tell the ✦ assist where you are, and to move files you choose, Outrigger runs commands on your server over the SSH connection that is already signed in. Each one uses an additional channel on that same connection; there is no new login. These are the commands:

query Read-only tmux queries: listing tmux servers, sessions, windows, panes, and clients, and a pane's history length. They run when the entry screen, scrolling, or catch-up need them.
history tmux capture-pane, to fetch recent tmux history (up to the last 1,000 lines) for scrolling and for catch-up.
action tmux actions, only when you tap them: attach, new session or window, split, rename, end a session, window, or pane, stop a tmux server, and switch window or pane.
assist The optional --help and ls lookups the ✦ assist uses when drafting a command. They are off unless you turn them on.
sftp In version 1.2 and later, only when you send or get a file: the server's SFTP service, to check the destination folder, write or read the one file you chose, and rename or remove it. An upload is written under a temporary name and renamed when complete.
context Read-only queries run each time you use the ✦ assist: the server's name and OS version, your shell's current directory, and the name of the program running in it. Inside tmux, the session, window, and pane you're in. They use hostname, ps, lsof on macOS, and tmux display-message.

These commands add common tmux install locations (/opt/homebrew/bin, /usr/local/bin, /opt/local/bin, /snap/bin) to the end of the command search path. Outrigger never installs software on your server. There is no Outrigger server or account, and none of this is sent to the developer.

The shell identifier (1.1)

In version 1.1 and later, each shell Outrigger opens is given an environment variable, LC_OUTRIGGER_SHELL, set to a random 8-character value generated for that shell. It is not tied to you, your device, or any account. It is used only to tell which Outrigger shell a tmux client is running in (for example when tmux was started by hand), and which shell the ✦ assist should describe. To find it, Outrigger reads the environment of the tmux client processes on your server (through /proc on Linux, and ps -E on macOS). macOS does not show the environment of its built-in programs, such as /bin/zsh, so on a Mac the assist instead picks the login shell whose start time matches when Outrigger opened it. If the server's SSH configuration does not accept the variable, Outrigger cannot recognize tmux started by hand; nothing else changes.

What the ✦ assist is told (1.1)

In version 1.1 and later, Explain, Catch me up, and Draft a command include a short note of where you are, alongside the terminal text: the server's name, its OS and shell, your current directory, the name of the running program, and the tmux session, window, and pane if you're in one. Program arguments are never included, because they can contain passwords. The note goes to the same assistant as the terminal text: the on-device model, or the cloud provider you chose.

tmux history and Catch me up (1.1)

In version 1.1 and later, tmux history fetched for scrolling or catch-up is held in memory only. It is not written to storage, and it is discarded after use.

In a tmux session, Catch me up can fetch from the server the tmux history added since you last looked at the session, including output produced while the phone was disconnected. When you leave the session, Outrigger asks the server for the pane's current history length (a read-only query), and later fetches only the lines added since. If that position can't be trusted, it fetches the last 1,000 lines and says so. The brief states where its text came from: tmux history, or only output received while connected. Catch me up runs only when you tap it.

The text goes only to the assistant you selected: the on-device model, where it never leaves the phone, or, if you added your own cloud provider key, directly to that provider under the same consent disclosure as other cloud assist requests.

Files (1.2)

In version 1.2 and later, +file sends a file you pick to the server you are connected to, or gets a file from it. Files go only between your phone and that server, over the SSH connection that is already signed in. They do not pass through us, and they are not sent to the ✦ assist.

To send a file, Outrigger copies it into its own temporary storage on the phone and deletes the copy when you close the sheet. A file you get is held the same way until you save or share it and close the sheet. Choosing a photo uses the system photo picker, which gives Outrigger only the photos you pick, not your library.

By default, photos have their location removed before they are sent. The rest of the photo, including the image and the other details the camera recorded, is unchanged. You can turn this off in Settings › Files › Remove photo location. Files you pick from the Files app are sent as they are.

Outrigger appears in other apps' share sheets. A file shared to it is copied into Outrigger, and is sent only after you pick a host and send it. Cancelling deletes the copy.

Things we are asked about

no No analytics, no crash-reporting SDK, no attribution SDK, no A/B framework. Apple's own system diagnostics follow your iOS privacy settings and go to Apple, not us.
no No cookies on this website. No trackers, no third-party fonts, no embedded video.
no No data broker relationships and no ad networks.
yes iCloud device backup includes your host list and snippets if you have backup enabled; you can exclude the app in Settings. Secret Keychain items are marked this-device-only, so they do not migrate to another device when a backup is restored.

Deleting your data

Deleting the app destroys hosts, snippets, and settings with its container. Device-only Keychain entries can outlive an uninstall and may become available again to a reinstall signed as the same app. Use Settings › Erase everything before uninstalling to remove those entries and their Enclave wrapping keys immediately, then remove matching public keys from your hosts' authorized_keys. There is no server-side account to close.

Changes and contact

If this policy changes, the change is described in the app's release notes. If a future version needs to talk to a server of ours, it will be opt-in and explained here before it ships.

Questions or corrections: [email protected].

© Paul Miller [email protected] home docs privacy security open source EOF