The short version
Denshin does not sell personal data, run advertising, or include third-party analytics SDKs in the mobile app. The app connects to machines you explicitly pair. Your terminal and agent content is handled by your phone and your paired Denshin daemon, using the connection method you select.
If you select Denshin Relay, your connection passes through servers we operate. They carry end-to-end encrypted traffic they cannot read, but they do see connection metadata. That path is described in full below.
Data the app keeps
- Paired machine names, endpoints and pinned machine identity.
- Device credentials in the operating system secure store.
- Local interface state, bounded cached projections and pending messages needed for offline recovery.
- Push notification registration when you enable notifications.
Your paired daemon keeps its own sessions, audit records and terminal state on the machine you control. denshin uninstall removes the host runtime while preserving that state for recovery; denshin uninstall --purge --yes explicitly removes both.
Denshin Relay, operated by us
Denshin Relay is first-party infrastructure, not a third-party service. When you select it, your connection is carried by servers we operate at relay.denshin.dev, and an admission service decides which endpoints may use them. This section describes that path specifically, because it is the one where data reaches infrastructure under our control.
Relay is one of four connection methods offered when you run denshin up on an interactive terminal, and it is the first option presented. It is not silently enabled: a non-interactive install falls back to a local-network mode instead. Tailscale, a direct HTTPS origin of your own, and same-network LAN are the alternatives, and none of them route through our servers.
What the relay can see
Your terminal and agent traffic is QUIC/TLS 1.3 ciphertext, encrypted end to end between your phone and your own machine. The relay carries that ciphertext and cannot read it. It does observe the metadata any network intermediary observes: your IP address, the endpoint identifier of each side, connection times and traffic volumes.
What the admission service stores, and for how long
- Your IP address is never stored in the clear. It is used to enforce rate limits as a keyed hash, in a counter that expires within two hours for installation requests and within two minutes for endpoint exchanges.
- Endpoint leases, holding an endpoint identifier and a pseudonymous installation identifier, expire after 24 hours by default and can never be issued for longer than 7 days.
- The admission service cannot see terminal content, prompts, agent responses, or the credential your phone uses with your own machine.
This infrastructure runs on Fly.io, including its managed PostgreSQL, which processes the records above on our behalf.
Other service providers
Apple and Expo may process device and delivery identifiers when TestFlight, crash delivery infrastructure, or push notifications are used. A chosen network provider, such as Tailscale, processes traffic according to that provider's terms. The public website is hosted by Vercel, which may retain ordinary request logs. Denshin does not ask those providers to use terminal content for advertising.
Control and deletion
Revoke a phone from the machine's device controls to end that device's authority. Remove a paired machine in the app to delete its local record. Uninstalling the app removes its local app data subject to the operating system's backup behavior. To stop using our relay entirely, select another connection method; nothing on this page's relay section applies once you do. For support or a request concerning data held by Denshin, email privacy@denshin.dev.
Changes
This notice is effective July 25, 2026, replacing the version of July 16, 2026. That earlier version deferred disclosing our relay to a future revision, when the relay had in fact already shipped and was reachable from this site. This revision corrects that omission. The notice will be updated again before an account system, a payment service, or a materially different data path is offered publicly.