Privacy Policy — Conch

Last updated: 2026-08-27 · App: Conch (Android, ai.eight24family.conch), version 0.4.x · Distributor / maintainer: Eight 24 Family LLC · nikita@eight24family.ai

Conch is an Android client that lets you SSH into your own servers and drive the Claude Code, Codex, or Gemini CLI tools that live there. Everything in this policy stems from one design rule: we don't want copies of your data and we never run intermediary servers between your phone and your hosts.

What we do NOT collect

• No accounts. We don't ask you to register.
• No chat contents. Prompts and replies travel directly between your phone and your SSH server.
• No SSH credentials. Passwords, private keys, and FIDO security-key credential handles stay on your device, encrypted at rest with androidx.security.crypto (AES-256, hardware-backed via Android Keystore where available).
• No advertising IDs. No GAID, no device fingerprint.
• No location, contacts, calendar, microphone, or camera.

What we DO collect

Nothing. There is no analytics, no crash reporting and no telemetry in Conch, and no backend of ours for any of it to reach. The only network connections the app opens are the SSH connections to the servers you add yourself — plus, for the local-models feature only: a plain file fetch of a model you tap "download" on (from Hugging Face, a public file host), and, when you open the model store screen, read-only fetches of the model catalog (from Conch's public GitHub repository) and of public download/like counts (from Hugging Face's public API). These requests carry nothing about you beyond what any anonymous web request carries. If you choose to connect a Hugging Face account (Model store → hugging face → connect), so that gated models such as Llama or Gemma can be downloaded, requests to huggingface.co carry your own access token: it is stored encrypted on this device, it is never sent anywhere else — not even to the download CDN Hugging Face redirects to — and “forget” removes it. Everything the store learns about your phone — its RAM and chip, measured model speeds, your ratings — stays on the phone; the app never uploads it, and downloaded models run entirely on your phone, offline. There is one way that information can leave, and you perform it: “share these measurements” in the device sheet shows you the exact text — your chip model, RAM, CPU features, GPU name and the model speeds measured here, and nothing else: no ratings, no written reviews, no file paths, no account, no identifier — and then hands it to an app you choose. Conch opens no connection of its own to send it, and if you never tap it, nothing is ever prepared or stored.

Versions up to and including 0.4.0 sent crash reports and a small set of feature-usage events to Sentry, with an opt-out toggle in Settings. 0.4.1 removed that entirely — the SDK, the Gradle plugin, the initialisation code and the toggle are all gone from the source. Nothing replaced it.

Two consequences worth stating plainly:

• No approximate location. Earlier versions had to declare it, because Sentry derived a country and city from the request IP at ingestion. With Sentry gone there is no request, no IP and no geolocation of any kind. Conch holds no location permission and cannot read your GPS.
• When Conch crashes on your device, we do not find out. That is the trade. If something breaks, please write to the address at the bottom of this page — it is now the only channel there is.

What stays on your device only

• All SSH keys and passwords (PEM private keys, FIDO key handles). Never included in any backup or transfer — they are encrypted with a hardware-bound key that cannot leave the device, so a copy would be unreadable anywhere else.
• All chat messages.
• Locally-cached copies of your AI session JSONL files.
• Downloaded local-model files, and everything you say to a local model — local inference never leaves the device.

Moving to a new device (Android Backup)

Since 0.4.0, Conch supports Android's standard backup and device-to-device migration so a new phone doesn't start empty. This is controlled entirely by your Android system backup setting (Settings → Google → Backup) — if it's off, nothing is backed up.

• What transfers: your server list (hostnames, ports, usernames, key references) and app settings.
• What never transfers: passwords, private keys, FIDO credential handles, and chat history. Credentials must be re-added once on the new device.
• Cloud backups are end-to-end encrypted: the server list is only ever included in a Google cloud backup when the backup is client-side encrypted with your device's lock-screen secret (Android 9+). Direct device-to-device transfer never touches the cloud.

Data on your servers

Anything stored on the servers you connect to is governed by your server, your AI account, and the agent's policy (Anthropic for Claude, OpenAI for Codex, Google for Gemini). Conch doesn't read or proxy that traffic — it's just a terminal in your pocket.

Third-party services

• Anthropic / OpenAI / Google — only via the CLI tool you choose to run on your server, with your credentials. We are not a party to that traffic.

That is the whole list. We do not use Sentry, Google Analytics, Firebase Analytics, Crashlytics, AppsFlyer, Adjust, Branch, or any analytics, crash-reporting, advertising or attribution SDK.

Hardware security keys (FIDO / CTAP2)

If you import a hardware security key for SSH authentication, the app uses Android NFC and USB-host APIs to talk to the key over CTAP2. The credential handle is stored encrypted on the device. We do not collect biometric data. A "touch" is the physical-presence check the FIDO standard requires — a cryptographic signature, not an image or fingerprint template.

Permissions the app requests

• Internet — to reach the SSH servers you add, and to download local-model files from Hugging Face when you tap download. Nothing else.
• Foreground service + persistent notification — to keep agent sessions alive while the screen is locked or the app is backgrounded.
• Notifications — to show approval prompts and connection status.
• NFC / USB host — only when you tap to use a hardware security key.

We do not request location, contacts, calendar, microphone, camera, SMS, or call-log permissions, and the app does not declare any of them.

Children

Conch is designed for software developers and is not directed at children under 13. We do not knowingly collect data from children.

Your rights / data deletion

• Nothing to opt out of. There is no collection to disable, so there is no toggle.
• Right to erasure (GDPR Art. 17): Settings → Privacy → Delete all my data. Removes the encrypted server registry, all stored keys (including hardware-key credential handles), all session caches, the on-device upload cache, all preferences, and the Android Keystore master key, then terminates the app process. Because nothing ever leaves the device, there is no copy anywhere else for us to delete.
• Right of access (GDPR Art. 15): email below. We hold no data about you at all, so there is nothing to return.

International transfers

None. No data about you crosses any border, because none of it leaves your phone.

Changes to this policy

If we change what the app collects, we'll update this page and bump the Last updated date. Material changes will also be surfaced in-app on first launch after update.

Contact

Questions, opt-out requests, deletion requests, or compliance inquiries: Eight 24 Family LLC · nikita@eight24family.ai