Privacy Policy

Who this is from

MangoSSH publishes this website and the MangoSSH, MangoScreen, MangoFly, MangoWiFi and MangoDock applications. For anything in this policy, write to contact@mangossh.com.

The website

Every page here is a static file. There is no database behind it, no session, and nothing that identifies a returning visitor.

The site is served through Cloudflare, which — like any web server — processes the information a browser necessarily sends in order to deliver a page and to protect the service from abuse.

• What that is — Your IP address, the page requested, the time, your browser's user-agent string, and the referring page if your browser sent one.
• Why — To return the page you asked for, to keep the site available, and to block attacks. There is no other purpose and no profile is built.
• No cookies — The site sets none. Not for analytics, not for preferences, not for anything — which is why the notice at the foot of the page is an explanation with an OK button rather than a consent gate. The Cookie Policy says more.
• One thing is stored locally — Pressing OK on that notice writes a single localStorage key so it stays dismissed. It holds the value 1, it is never sent anywhere, and clearing your site data removes it. That is the only thing this site writes to your browser.
• No third parties in the page — Every script and style is served from this domain. The typeface is self-hosted, so loading a page makes no request to Google Fonts or to any other provider.

Downloads

Installers and bundles are served from downloads.mangossh.com, which is Cloudflare R2 storage on the same account. Fetching one is an ordinary web request and is treated exactly as a page request above: connection data, no cookie, no account, no record tied to a person.

We can see how many times a file was downloaded in aggregate. We cannot see who you are, and we do not try to find out.

If you email us

Mail sent to contact@mangossh.com reaches an ordinary mailbox. We keep what you send for as long as it is useful to answer you and to keep a record of the conversation, and we use it for nothing else — no mailing list, no marketing, no passing it to anyone.

If you send a log, a configuration file or a screenshot, please read it first. Hostnames, usernames, addresses and occasionally keys turn up in terminal output far more often than people expect.

The public feedback board

Bug reports and feature requests go to a public repository on GitHub. That is GitHub's service, under GitHub's privacy policy, and it needs a GitHub account. Anything you post there is public the moment you post it.

Use email instead if you would rather not make an account, and always use email for a security report.

The applications

This is the part most privacy policies are vague about, so to be precise: there is exactly one request an application ever makes to us, it happens only when you click for it, and it carries nothing about you.

• No telemetry — No usage analytics, no feature counters, no crash reporter. There is no code in them that reports to us, which is checkable with a packet capture on your own network.
• No account — Nothing asks you to sign up, sign in or register a device. The hosted account and the hosted Cloud Vault described in some documentation are not running, and the applications have them switched off.
• Update and news check — There is one request that comes to us, and only when you ask for it. Opening Check for Updates fetches a single JSON file from mangossh.com — the latest version number and any news items. It is an ordinary web request carrying no identifier, no version of yours and no account; the comparison with what you are running happens on your machine. Nothing fetches it in the background, and the air-gapped edition has the whole feature compiled out.
• No licence check in practice — Nothing in any application is gated behind a paid licence today. If a licence key is ever issued and you enter one, the application validates it with our licensing provider, keygen.sh, sending the key and a locally generated device identifier — and nothing else. Until you do that, it makes no such request.
• Your data stays yours — Hosts, credentials, keys, session logs and recordings live on your own machine, in your operating system's credential store and in the application's own encrypted files. None of it is uploaded anywhere by us.

What the applications contact, when you ask them to

Some features reach the internet because that is what the feature is. Each one runs only when you use it, and none of these requests comes to us:

• The servers you connect to — The whole point of the software. Your SSH, RDP, VNC, SFTP and serial sessions go to the machines you name, and nowhere else.
• Password breach check — Uses Have I Been Pwned's Pwned Passwords range API, which is k-anonymous: the first five characters of a hash of the password are sent, never the password and never the full hash.
• Speed test — Measures a connection against speed.cloudflare.com.
• Audit log geolocation — Where you enable the sshd follower, public IP addresses seen in a server's own auth log are sent to ipapi.co to attach a country to each event. Private and loopback addresses are never sent.
• AI assistant and MCP — Only if you configure it, and only to the provider whose key you supplied — Anthropic, Google, OpenRouter or a local model. Your prompts and whatever context you allow go to that provider under their terms, not ours.
• Cloud and identity integrations — Azure, Microsoft Entra, Google and similar are contacted only when you configure them, with the credentials you supply.
• Webhooks you set up — Alerts go wherever you point them, such as a Slack webhook URL you provide.

The air-gapped edition

MangoSSH Secure is built without the code for every feature listed above that reaches the internet. The functions are absent from the binary rather than switched off in a setting, which is the distinction that matters on a network where nothing may leave.

Servers you run yourself

The vault server, the relay and MangoFly's coordination server are software we publish and you operate. They run on your hardware under your control. We have no access to them, receive nothing from them, and are not the controller or processor of anything they hold.

If you run one, the people using it are your responsibility — including whatever notice and lawful basis they need.

Keeping and deleting information

Server logs for the website and for downloads are kept only for the short period Cloudflare retains them for operations and abuse prevention, and are not exported, combined or analysed by us.

Email is kept while it is useful and deleted on request.

Your rights

Wherever you live, you may ask what we hold about you, ask for a copy, ask for it to be corrected, or ask for it to be deleted. In practice the honest answer is usually that we hold nothing except any email you have sent.

If you are in the European Economic Area or the United Kingdom: our lawful basis for the limited processing described above is legitimate interests — delivering a website that was asked for, keeping it available, and answering mail that was sent to us. You may object to that processing, and you may complain to your supervisory authority.

If you are a California resident: we do not sell or share personal information, and we have no advertising, profiling or cross-context behavioural tracking of any kind. Exercising a right under the CCPA will never cause you to be treated differently, because there is no service to withhold.

Children

These are tools for managing servers and they are not directed at children. We do not knowingly collect anything from anyone under 13.

Changes

If this policy changes, the date at the top changes with it. Where a change is material — if a hosted service ever starts, for instance — it will be said plainly rather than slipped into a paragraph.