Contact
Effective date: 8 October 2026
Shepherdr - Client for Herdr (“Shepherdr”, “the app”) is an app for Android and iOS (iPhone and iPad). It is published on Google Play by Imperial AI Limited and on the Apple App Store by Techarge Limited (each “we”, “us” for its store). This policy explains what the app does with your information.
Shepherdr is an independent client for herdr (https://herdr.dev), a terminal workspace manager for AI coding agents that runs on your own servers. Shepherdr is not affiliated with or endorsed by herdr.dev. It connects to your servers over SSH so that you can see and use your herdr workspaces from your phone.
None. We do not receive, collect, log, share or sell any personal or usage data. The app does not talk to any server of ours, and it contains no third-party analytics, advertising, tracking or crash-reporting SDKs. Its dependencies are open-source libraries for SSH (dartssh2), the terminal display (xterm), state management (flutter_riverpod), secure storage (flutter_secure_storage), device authentication (local_auth), local settings storage (shared_preferences), identifier generation (uuid) and key cryptography (pinenacl), opening links in other apps (url_launcher), QR code display (qr_flutter) and scanning (mobile_scanner), sharing text (share_plus), reading the clipboard image (pasteboard), choosing a photo (image_picker), resizing images (image), reading the app version (package_info_plus), and in-app purchases (in_app_purchase, which uses Google Play Billing on Android and StoreKit on iOS). None of these sends data to the developer.
On Android, the QR scanner uses Google’s ML Kit barcode-scanning library, which runs on the device and does not upload camera images. As described in Google’s ML Kit data disclosure, the library may send technical diagnostics (such as device and app information, device or other identifiers, and performance metrics) to Google. We do not receive this data. On iOS, scanning uses Apple’s Vision framework and no Google library.
The app stores the following on your device only:
Android backup is disabled for the app, and it is excluded from cloud backup and device-to-device transfer, so this data is not copied off your device by Android backup. Because secrets are bound to the device’s Keystore, they are not restored on another device. On iOS, secrets are kept in the device Keychain and are not synchronised to iCloud Keychain by the app. By default they are stored as “this device only”: they are excluded from device backups and are never restored to another iPhone or iPad. If you turn on “Include secrets in device backups” in Settings, they are included in your encrypted device backup instead. Keychain items can remain on the device after the app is uninstalled until you remove them in the app or reset the device.
Terminal content that you view is shown on screen and held in memory while you use the app. The app does not write it to storage. When a connection fails, the app may write a short, sanitised error line (server name and failure reason, never passwords or keys) to the device log (Android logcat or the iOS system log), which stays on your device and is not sent to us.
The app sends data only to the servers you configure, using SSH (an encrypted connection). This includes your login credentials (password or key-based authentication), the commands the app runs to talk to herdr on that server, and the keystrokes you type in a terminal. That data goes directly from your device to your server. We never see it. What your server does with it is governed by you and your server’s operator.
The app verifies each server’s host key, and asks you to confirm a server the first time you connect and whenever its key changes.
If you use Paste image or Insert image in a terminal (Shepherdr Pro), the app reads the image from the clipboard or the photo picker only at that moment. It shrinks the image and uploads it over the same SSH connection to the /tmp folder of your own server, readable only by your user, and types the file path into the terminal so that tools on your server can open it. The image goes only to your server and never to us. Uploaded files older than 7 days are deleted from /tmp the next time you connect.
If you export a private key (Shepherdr Pro), the key is first encrypted with a passphrase you choose and is then shown as a QR code or saved or shared as a file, only at your request. Theme share codes are shared the same way. Where they go afterwards depends on the app or person you share them with.
If you use a copy action (for example copying a public key, or a connection report from the connection details screen), the text is placed on the system clipboard at your request. Other apps on your device may be able to read the clipboard.
If you tap a web address (URL) shown in a terminal, the app asks you to confirm and then hands that URL to your device’s browser or another app that handles it. The full URL, including any path, query parameters or tokens it contains, then goes to that app and to the website it points to, under their own privacy policies. Nothing is opened without your confirmation, and the app never sends the URL to us.
Shepherdr is free for one saved server. A one-time, non-consumable in-app purchase (“Shepherdr Pro”) unlocks unlimited servers, private key export, custom themes and image pasting. The purchase is processed entirely by Google Play Billing on Android, or by Apple’s App Store (StoreKit) on iOS, under Google’s or Apple’s terms and privacy policy. We, the developer, do not receive your payment details or card number. The app only asks Google Play or the App Store, on your device, whether the unlock has been purchased on your Google or Apple account, and keeps a local yes/no flag on your device so the unlock still works offline. The app has no accounts and no backend, so we do not receive or store your purchase history. Google or Apple handles it.
Choosing a photo with Insert image uses the system photo picker, which gives the app only the photo you pick and needs no storage or photos permission on Android. Reading an image from the clipboard needs no permission.
The app also contains an internal, signature-level permission added by AndroidX (DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION) that only the app itself can use and that is not user-facing. The app requests no location, contacts, microphone, storage or phone permissions, and it runs no background or foreground service: connections are not kept alive while the app is in the background.
On iOS, the app may ask for four permissions: Face ID (NSFaceIDUsageDescription), used only for the optional app lock, where iOS returns only success or failure and the app never sees your biometric data; Camera, used only to scan QR codes; Photo Library, used only when you choose Insert image, to read the photo you pick; and Local Network access, used only so the app can reach SSH servers on your local network. In-app purchases use the App Store and need no extra permission.
If you turn on the app lock, the app asks you to authenticate when you open it, and it blocks screenshots and hides its content in the recent-apps view (the Android secure-window flag). On iOS, the app covers its window when it is inactive so that the app switcher does not show terminal contents; iOS does not allow an app to block screenshots.
We hold no data, so there is nothing for us to delete. To delete the data on your device, remove individual servers, keys and saved passwords in the app, or clear the app’s storage or uninstall it in Android or iOS settings. Uninstalling removes everything the app stored.
The app is a technical tool for developers and system administrators. It is not directed at children, and we do not knowingly collect information from anyone, including children.
We may update this policy, for example if the app’s behaviour changes. The latest version will be published at the same location with a new effective date. Material changes will be noted in the app’s release notes.
Google Play (Imperial AI Limited): support@imperialai.ai
Apple App Store (Techarge Limited): support@techarge.co.uk