Privacy policy

Your machines stay yours.

Last updated: October 23, 2026

Legio is an SSH client for iPhone. It connects your phone straight to your own machines. We do not run a server between your phone and your machines, we have no accounts, and we do not see your terminals, your files or your keys. This policy says what little data does leave your phone, where it goes, and why.

The short version

• Your connections, passwords, SSH keys, snippets and settings stay on your iPhone. Passwords and keys are kept in the iOS Keychain.
• Your terminal sessions, files, containers, git diffs and web pages go straight from your phone to your machine over SSH. They never pass through us.
• If you turn on push notifications, our push relay keeps your phone's push token and your notification rules, and passes each notification on to Apple. It does not keep the notifications.
• Apple handles every payment. We never see your card or your Apple ID.
• The app has no analytics, no advertising and no tracking.

Data that stays on your iPhone

Legio keeps these on your phone only. We cannot read them.

• Connections: the name, host, port and user name of each machine you add, and the host key Legio checked for it.
• Credentials: passwords and SSH private keys. They are kept in the iOS Keychain.
• Snippets, key bar layout, notification rules and display settings.

If you delete the app, iOS deletes this data. Keychain items can stay on the phone until you erase it, as is normal on iOS.

Data that goes to your own machines

Everything you do in a session — the commands you type, the output you read, the files you browse, preview, download or upload, the containers and ports you look at — goes over an encrypted SSH connection between your phone and your machine. It does not go through any server of ours.

When you pair a machine or turn on notifications, Legio also tells that machine your phone's name and a device secret, so the machine's legio tool can send you notifications. They are stored on that machine, which you control.

Push notifications and the relay

Push notifications are optional. If you allow them, Legio uses a small relay that we run at legiorelay.jrobe.cloud, because only the relay can talk to Apple Push Notification service for the app.

What the relay keeps:

• Your phone's push token, which Apple gives the app.
• A hash of the device secret that lets your machines send to your phone. The relay does not keep the secret itself.
• Your notification rules: which statuses you want to hear about, the minimum task time, and the random IDs of the connections that have their own rule.

What passes through and is not kept: each notification your machine sends — its title, its text, the name of the agent, the pane and the status. The relay checks it against your rules and hands it to Apple. It does not store or log it.

The relay deletes your phone's entry when Apple says the push token is no longer valid, for example after you delete the app. You can also ask us to delete it at any time.

Subscriptions

Legio Pro is sold through Apple's In-App Purchase. Apple processes the payment and keeps the purchase history for your Apple ID. The app checks your subscription with Apple on your phone. We do not receive your name, your email, your payment details or your Apple ID. See Apple's privacy policy for how Apple handles this data.

Camera

Legio uses the camera only to read the pairing QR code that legio pair shows. It reads the code on the phone. It does not take or keep photos or video.

Local network

Legio asks for local network access so it can reach machines on your own network. It does not scan your network or report what is on it.

Crash reports

If you share crash data and app analytics with app developers in iOS Settings, Apple may send us anonymous crash reports. They do not identify you. You can turn this off in Settings › Privacy & Security › Analytics & Improvements.

This website

This website uses a self-hosted Umami instance to count page views. Umami does not use cookies and does not collect personal data. If you join the launch waitlist, we keep your email address with our email provider, Resend, only to tell you when Legio launches. You can unsubscribe from any email, or ask us to delete your address.

Sharing and selling

We do not sell your data, share it for advertising, or track you across apps and websites. The only parties that handle data for Legio are Apple (push notifications and payments), the host that runs the relay, and Resend (the waitlist).

Children

Legio is a tool for developers and is not directed at children under 13. We do not knowingly collect data from children.

Your rights

Most of your data is only on your phone and your machines, so you control it directly. To remove the relay's copy, delete the app, or email us. For anything else — a question, or a request to see or delete data — email us at privacy@legioapp.cloud. Depending on where you live, you may have the right to access, correct, delete or object to the use of your data, and to complain to your data protection authority.

Changes

If we change this policy, we will update it on this page and change the date at the top. If a change affects how the app handles your data, we will also say so in the app's release notes.

Contact

privacy@legioapp.cloud