Who we are
Oryxis is an open-source SSH client (AGPL-3.0) published by Wilson Glasser. This policy covers the desktop application for Windows, macOS and Linux, and this website. The full source code is available at github.com/wilsonglasser/oryxis, so every claim below can be verified rather than taken on trust.
What we collect
Nothing. Oryxis does not create an account, does not require registration, and sends no usage data, analytics, crash reports or identifiers to us or to any third party of our choosing. There is no server operated by us that receives your data.
Everything the app stores is written to your device, under
~/.oryxis (%USERPROFILE%\.oryxis on Windows):
- The vault, a single SQLite file holding hosts, groups, identities, snippets, known hosts and settings. Secrets (passwords, private keys, API keys, TOTP secrets) are encrypted field by field with a key derived from your master password using Argon2id, with ChaCha20-Poly1305 as the cipher. Without the master password the file is useless, including to us.
- Optional session logs and command history, if you turn them on, stored encrypted in the same vault.
- Local application logs, kept on your device for troubleshooting. They never leave it unless you attach one to a bug report yourself.
-
Downloaded components: optional plugins and on-demand
fonts, cached under
~/.oryxis.
Where the app connects, and when
An SSH client is a networking tool, so it does open connections. All of them are either initiated by you or listed here. None of them route through infrastructure that inspects your data.
Your servers
SSH, SFTP, Telnet, serial and port-forwarding traffic goes directly from your machine to the hosts you configure, or through the jump hosts and proxies you configure. Credentials are read from the vault at connection time and are never transmitted anywhere else.
Update checks and downloads
When update checking is enabled, the app asks the GitHub Releases API whether a newer version exists, and downloads the installer from GitHub if you accept. Optional plugins (cloud providers, the MCP server, the GIF exporter) and on-demand CJK fonts are fetched the same way, only when you enable the feature that needs them. Every download is verified against a pinned SHA-256 hash, and plugins additionally against an Ed25519 signature.
Users who select the China mirror, or whose GitHub request fails while the
mirror setting is on "auto", fetch those same files from our asset host
dl-cn.oryxis.app / dl.oryxis.app. Those hosts
serve static files only. Like any web server, their CDN records the usual
request metadata (IP address, timestamp, requested file) for delivery and
abuse protection. No vault data, host list or credential is ever sent
there. Update checking and the mirror can both be turned off in Settings.
AI assistant (optional, off by default)
If you configure an AI provider and API key, the assistant sends what you type in the chat, plus the terminal context you choose to include, to that provider under your own account and their privacy policy. This is the one feature that can transmit terminal content off your machine, so it is opt-in, requires your own key, and never runs unless you open the chat. We are not a party to those requests: they go from your machine straight to the provider you selected.
Vault sync (optional, off by default)
Sync is peer-to-peer between your own devices. On a LAN, devices discover
each other over mDNS and connect over QUIC. Across networks, the app asks
a public STUN server for its own public address so the direct path can be
established. The servers tried, in order, are Google's
(stun.l.google.com, stun1.l.google.com) and
Cloudflare's (stun.cloudflare.com); a STUN query contains no
payload beyond the request itself, but that operator does see your IP
address. The signaling or relay endpoint is one you choose (a
self-hosted oryxis-relay, or an SFTP server you control).
Sync data is end-to-end encrypted with keys held only by your paired
devices; a relay sees ciphertext and connection metadata, never plaintext.
Password syncing is a separate opt-in on top of that. None of this happens
until you turn sync on.
Cloud and Kubernetes integrations (optional)
When you enable a cloud provider, the app calls that provider's API (AWS, Azure, GCP, Kubernetes) using credentials already present on your machine, such as your AWS profile or kubeconfig, to list the instances you can connect to. Those calls go to the provider, under your account and their terms.
What we never do
- No telemetry, analytics, usage metrics or feature-flag beacons.
- No advertising, ad identifiers or third-party trackers.
- No selling, sharing or profiling of personal data. We hold none to sell.
- No upload of vault contents, terminal output or session recordings to us, under any setting.
- No remote kill switch, license server or activation check.
This website
oryxis.app is a static site. It sets no cookies, stores nothing in your browser and runs no analytics. Two requests do leave your browser: web fonts are loaded from Google Fonts, and the home page reads the repository's public star count from GitHub's API. In both cases that third party receives your IP address as part of answering the request. Links to GitHub, Ko-fi and Buy Me a Coffee are governed by those services' own policies once you click through.
Distribution channels
When you install Oryxis from a store or package manager (the Microsoft Store, winget, AUR, or a distribution's repository), that channel applies its own privacy practices to the download and to any account you use with it. We receive nothing from them beyond aggregate, anonymous download counts where the channel publishes them.
Children
Oryxis is a developer and system-administration tool. It is not directed at children, and since it collects no personal information at all, it collects none from children.
Your rights over your data
Because we hold no personal data about you, there is nothing for us to
export, correct or delete on request. The data the app creates is on your
device and under your control: delete the ~/.oryxis directory
and every trace of it is gone. Uninstalling through your platform's normal
mechanism removes the application itself.
If you use optional features that send data to third parties, such as an AI provider or a cloud provider, exercise your rights over that data directly with them, since they are the controller for it.
Security
Secrets are encrypted at rest with per-field ChaCha20-Poly1305 under an Argon2id-derived key, and the vault can be locked manually or after an idle timeout. Downloaded components are hash-pinned and signature-verified. Vulnerability reports are handled through the process in SECURITY.md.
Changes to this policy
If a future release changes what the app sends and where, this page is updated with it and the date at the top changes. Material changes are also noted in the release notes.
Contact
Questions about this policy: open an issue at github.com/wilsonglasser/oryxis/issues, or email [email protected]. For security reports, follow SECURITY.md instead of a public issue.