Wendo privacy policy

This is a translation for convenience. In case of discrepancy, the Spanish version prevails.

Last updated: 2 November 2026

Wendo is an SSH client. It connects directly from your phone to your servers: there are no accounts, no Lirafy servers in between, and Lirafy does not see what you do in the terminal. This policy explains the little that does leave the device and where it goes.

1. Controller

Lucía Díaz Cuadrado (“Lirafy”). Contact: [email protected].

2. What stays on your device

• SSH keys and passwords, and any API keys you add, are stored in the system’s secure storage (Keychain on iOS, Keystore on Android). You can also protect them with Face ID, Touch ID or fingerprint.
• Your machines (name, address, port, user, server fingerprint), settings, text snippets and dictation history are stored in the app.
• What happens in the terminal is not stored: it is held in memory while the session is open.
• Images you attach and files you download via SFTP go to the app’s temporary cache.

None of this is sent to Lirafy. Keep in mind that system backups (Android or iCloud) may include app data, depending on how your device is configured.

Sync: if you turn it on, Wendo writes a file to the folder you choose. Credentials are only included if you say so, and they are encrypted (AES-256-GCM) with a password that only you know.

3. What leaves the device

Crash reports and statistics: only if you accept

The first time you open Wendo, the “Your privacy” notice offers you two separate options, both off by default: crash reports and usage statistics. You can decline everything, accept only one or both, and change it whenever you like in Settings › About. As long as you don’t accept, the app sends none of this. Legal basis: your consent (art. 6.1.a GDPR), which you can withdraw at any time.

Crash reports (Firebase Crashlytics, by Google). If you accept them and the app closes because of an error, it sends a technical report to Lirafy’s Firebase project: where it failed, the error, the app and system version, the device model and a Crashlytics installation identifier. It does not include the terminal content. For failures in the app itself, before sending it users and machine names, IP addresses, personal paths and the names of your saved machines are removed. Failures in the system’s native code (Android or iOS) are collected by Crashlytics itself, without that cleanup.

Report the problem. If you tap “Report the problem”, that report is sent even if you have automatic reports turned off, because you ask for it; it includes the comment you write and goes through the same cleanup.

Usage statistics (Firebase Analytics, by Google). If you accept them, they send which screens are used (by type, never with your data), whether a connection worked and by what means (SSH, Mosh or ET) and the result of a Pro purchase. Never machines, users, commands or terminal content. They are not used for advertising: advertising identifiers are disabled.

Wendo Pro purchases

They are made through Google Play or the App Store. The licence is checked on the device itself; Lirafy does not receive your payment data, only the sales information that the stores provide to developers. Google’s and Apple’s privacy policies apply.

Downloads you request

• Whisper dictation models: downloaded from Hugging Face when you ask for them. With the Whisper engine (the default), the audio is transcribed on the phone itself and does not leave it.
• Optional typefaces: downloaded from jsDelivr and GitHub when you choose one.

Those services receive your IP address, like any website, when serving the download.

Services you configure yourself

• Your SSH, Mosh or Eternal Terminal servers: the app connects directly to them.
• Notifications with ntfy: if you configure a topic, the app queries that server. The default server is the public ntfy.sh; on it, the notifications sent by the hook on your computer (which may include the command to approve, paths, the project name or the agent’s last reply) travel to and are stored on that service without end-to-end encryption, and the topic works like a password. If this matters to you, use your own ntfy server. That processing is done by ntfy.sh, not by Lirafy.
• Dictation with your own key (OpenAI or Groq): only if you choose that engine, the audio is sent to that provider with your key, under its terms.

Local network discovery

To find SSH servers on your wifi, Wendo searches the local network (Bonjour/mDNS). That information does not leave your network.

4. Permissions

All are optional: if you do not grant them, only that feature stops working.

5. Recipients and transfers

Lirafy does not sell or transfer your data. The processors it uses are Google (Firebase Crashlytics and Analytics; Google Play) and Apple (App Store). Google may process data outside the European Economic Area with the safeguards of the EU-US Data Privacy Framework and standard contractual clauses.

6. Retention

Crash reports are kept for 90 days, the Crashlytics retention period. Statistics are kept for the retention period set in Google Analytics, at most 14 months.

7. Your rights

You can request access, rectification, erasure, restriction, portability or object by writing to [email protected]. You can also lodge a complaint with the Spanish Data Protection Agency (AEPD, www.aepd.es).

8. Minors

Wendo is a tool for professionals and is not aimed at children under 14.

9. Changes

If what the app does with data changes, we will update this policy and its date, and we will notify you in the app if the change is significant.