Get Moshi

Privacy Policy

Last updated: August 2026

Overview

Moshi is designed with privacy as a core principle. Your terminal sessions, SSH keys, and credentials stay on your device. We don't have access to your servers or what you do on them.

Data We Collect

Data stored on your device or iCloud

  • SSH connection details (host, port, username)
  • SSH private keys (stored in iOS Keychain)
  • Terminal session data and screenshots
  • App preferences and settings
  • Voice dictation models (downloaded on-device)

This data is stored locally or in your Apple iCloud account when sync is enabled. It is not stored on Moshi servers.

Data we may collect

  • Notification and webhook tokens: If you enable notifications, we store tokens needed to route alerts to your devices.
  • Agent events: If you use Moshi's agent inbox, we cache recent inbox rows for up to 24 hours so they can sync across your devices. We don't analyze inbox content, sell it, or share it with third parties.
  • Cloud dictation audio: Local dictation engines process audio on your device. If you choose cloud dictation, audio is sent to remote transcription models. We don't cache the audio request or the transcription response.
  • Basic analytics: App and website usage statistics like app opens, feature usage, and purchase state. We don't include terminal content, SSH keys, passwords, or inbox message text.

Third-Party Services

  • Expo and Apple Push Notification Service: For delivering push notifications and Live Activity updates.
  • OpenAI: For cloud dictation when you choose that engine.
  • Apple and Google: For app distribution, purchases, subscription checks, and purchase status updates.
  • Google Analytics: For basic app and website analytics.
  • Cloudflare: For hosting our backend and sending license recovery and verification emails.

The moshi-hook Agent Bridge

moshi install registers hooks inside the coding agents you already run (Claude Code, Codex, Cursor CLI, OpenCode, and others). At each lifecycle boundary the agent writes one JSON line to a local, owner-only Unix socket owned by the moshi-hookdaemon running as your user.

What leaves your machine

  • Agent events: six normalized categories (approval required, task complete, session started/ended, tool running/finished) plus session, project, multiplexer pane, model, tool and account labels. The event title and message are the text you read on your phone, so an approval includes the command being approved — that is the whole point of the prompt and cannot be redacted. Push bodies are truncated.
  • Usage snapshots (optional, on by default): percentage used and reset times per agent rate-limit window, plus the host's display name. Disable withmoshi-hook set usage-collection off.
  • Surface presence: counts of discovered dev servers or simulators only — no URLs or content.

What never leaves your machine

Transcripts, terminal screen text, diffs, file contents, source code, and agent API keys. Those are served by a loopback-only gateway that your phone or Mac reaches through your own SSH local forward — device to host, with no relay through us.

Storage and retention

Locally: a state directory with logs, settings in your config directory, and pairing secrets in the macOS Keychain (or a 0600 file on Linux). Pending approvals live in memory only. On our servers, retention is short and swept automatically: inbox events expire after 24 hours, surface presence after 30 minutes, and approval routing rows at the action's expiry.

Controls

moshi-hook set usage-collection off, set always-on-discovery off, set scan-ports none, set suppress-push-while-unlocked on, set suppress-nested-agent-push on. moshi-hook uninstall removes the agent hooks, and moshi-hook unpair deletes the host secret and server registration.

Data Security

  • SSH keys are stored in iOS Keychain with biometric protection
  • All network connections use encryption (SSH/Mosh protocols)
  • No passwords or keys are ever transmitted to our servers

Your Rights

You can:

  • Delete all app data by uninstalling the app
  • Disable crash reporting in iOS Settings
  • Disable push notifications at any time
  • Request deletion of any server-side data by contacting us

Contact

Questions about privacy? Email us at [email protected] or reach out on Twitter/X.