cotty holds the keys to your servers. This page says plainly what we store, what we never store, and who else touches your data.
Last updated 29 July 2026
cotty is an SSH terminal for your machines and servers, available on the web, as a desktop app for Windows and macOS, and as an Android app. It is provided by Spectamatrix Solutions (“cotty”, “we”, “us”).
This policy covers the cotty website (cotty.sh), the console (console.cotty.sh), the desktop apps and the Android app. For anything here, write to support@cotty.sh.
When you sign in with Google, we receive your email address, name and profile picture from your Google account. If you sign up with an email address and password instead, we store your name, your email address and a hashed password — never the password itself. We also store your session tokens and which method you last signed in with, so you stay signed in.
If you sign in with Google, we additionally store the OAuth tokens Google issues for your account — access, refresh and ID tokens — and the scopes you granted, so we can keep that sign-in linked and valid. We use them only to authenticate you, never to read anything else from your Google account. If you already have a cotty account on the same email address, signing in with Google links the two.
When you sign in we record the IP address the request came from and your browser or app's user-agent string, and store them with that session so you can see and revoke your sign-ins and so we can investigate suspicious access. The credential audit log described below records the same two fields, on both granted and refused requests.
For each host you add, we store the details needed to reach it: the label you give it, its hostname or IP address, port, SSH username, which authentication method it uses, the operating system you select for it, the connection mode saved on it, and any tags or notes you write.
Sharing with other people. A host can be shared with another cotty account. When it is, we store that account's identifier against the host, and they can see its label, address, port, SSH username, authentication method, operating system, tags and notes. Your stored SSH credential is never released to someone you share with — credential access is restricted to the host's owner.
We record when terminal sessions start and end, the labels you give them, and why a session closed. We also store your workspace layout — which tabs and split panes are open, and which host each one belongs to — so it follows you between devices.
We do not record the contents of your terminal. Commands you type and output your servers return are not written to our database or saved as session recordings.
So a terminal survives a dropped connection, cotty starts your session inside a tmux session on your own server, named using your cotty account and host identifiers, and sets a few tmux options for you (mouse scrolling, clipboard support, hidden status bar). Your scrollback lives in that session on your machine, not on ours. Deleting a terminal in cotty runs a command on your server to end it.
cotty includes a file browser for the hosts you add, and lets you paste an image into a terminal. These always go through our servers, on every platform including desktop. When you browse a directory we see the file and folder names, sizes, permissions and timestamps; when you upload, download or paste, the contents pass through our servers and are held briefly in server memory while the transfer completes. We do not store your files or write them to our database. A pasted image is written to a temporary file on the host you are connected to, which cotty deletes once it is more than 24 hours old.
Our website and web console use Plausible Analytics, which is cookieless and does not track individuals across sites or build user profiles. It records the page address and the referring page — never your name, email or terminal contents. The desktop and Android apps send no analytics, and the Android app contains no analytics, advertising or crash-reporting SDK of any kind.
This is the part that matters most, so we will be direct about it.
When you add a host — or press Test before saving one — the password or private key you enter is sent to our servers, and our servers open an SSH connection to that host straight away to check it works. A secret used only for a test is not written to our database. A secret for a host you save is stored in our database, encrypted at rest with AES-256-GCM. If your key has a passphrase, it is stored the same way. If you use an SSH agent instead, no secret is stored.
This is not end-to-end encryption. The encryption key is held by our servers, which means we are technically able to decrypt your stored SSH credentials — and we do decrypt them, each time we open a connection to a host on your behalf. Please add cotty hosts with credentials scoped to what you are comfortable entrusting to a hosted service, and prefer keys you can rotate.
Credentials are stripped from ordinary API responses and are never sent back to a browser. The one exception is a client that connects directly to your server, such as the cotty desktop app, which authenticates with a bearer token rather than a browser session. That path is restricted to the host's owner, is rate limited, and requests are recorded in an audit log — whether they were granted or refused. Each entry records the time, the host, your account, the outcome, and the IP address and user-agent the request came from.
On the desktop app, a credential released for a direct connection is also cached on your own computer — in memory for a few minutes, and on disk in your application data folder, encrypted with your operating system's secure storage (Windows DPAPI or macOS Keychain). That lets direct connections keep working if our API is unreachable. Signing out erases the cache.
This differs by platform, and the difference is worth understanding.
Web and Android. These connect through the cotty relay: our servers hold the SSH connection to your host and pass data between it and your device. That means our servers process the terminal stream, in both directions, in order to relay it. As above, we do not record or store that stream — it passes through and is gone.
Desktop. By default the Windows and macOS apps connect straight from your own machine to your server over SSH, with no relay in between — in that mode your terminal traffic never reaches our servers at all. The desktop app also offers Auto and Relay connection modes under Settings → Connection: in Auto, a direct connection that fails falls back to our relay, and in Relay every session is routed through our servers. The relay is also used if the app's local connector cannot start, if a host is set to relay-only, or if the host uses SSH-agent authentication. Whenever the relay is used, the handling described for Web and Android applies. The file browser always goes through our servers, on every platform.
Host key verification. The desktop app pins your host's SSH key on first use for direct connections and warns you if it changes. The relay used by the web and Android apps does not currently pin host keys — it accepts the key presented by the server at that address. If you need host-key pinning, use the desktop app.
Traffic between your device and cotty is encrypted with TLS, and the connection from cotty to your host is SSH.
We use what we collect only to run the service:
A small number of services process data on our behalf or are contacted by the app:
We do not share your personal data with anyone for their own marketing purposes.
Where your data lives. Our servers and database are located outside the EEA and the UK. If you are in one of those regions, using cotty involves transferring your personal data to them.
Traffic to cotty is served over TLS. Stored SSH credentials are encrypted at rest with AES-256-GCM and are stripped from normal API responses. Access to a stored credential by the desktop app is owner-only, rate limited and audited. Passwords, where you use them to sign in, are stored hashed.
A small number of our staff can access account data, and can sign in to an account on your behalf in order to investigate a support request or suspected abuse. We do this only where it is necessary and only for as long as it is necessary, and every such access is recorded against the session. We can also suspend an account that breaches our Terms.
No service can promise perfect security. If we ever become aware of a breach affecting your data, we will tell you.
We keep your account data, hosts and stored credentials for as long as your account exists, because the service cannot function without them. Session metadata and credential audit records are also retained for the life of the account, and are destroyed when it is deleted.
Deleting a host. You can delete a host at any time from within the app. Doing so closes any live session to it and erases its stored credential immediately — once deleted, the password or key is gone and cannot be recovered.
Deleting your account. You can delete your whole account from Settings in the app, or from console.cotty.sh/delete-account, which works whether or not you are signed in. We email you a link to confirm it is really you. Deleting removes your account, your hosts and their stored credentials, your terminal history and audit records, and disconnects any session that is still open. It does not touch anything on your own servers — deleting a cotty account is not an instruction to change your machines. You can also write to support@cotty.sh.
Depending on where you live, you may have the right to access the personal data we hold about you, to have it corrected, to have it deleted, to object to or restrict how we use it, and to receive a copy in a portable form. Write to support@cotty.sh and we will respond.
cotty is a tool for developers and system operators. It is not directed at children, and we do not knowingly collect personal data from anyone under 18. If you believe a minor has given us personal data, contact us and we will remove it.
We may update this policy as cotty changes. When we do, we will update the date at the top of this page, and for significant changes we will let you know in the app or by email.
Questions about this policy, or about your data: support@cotty.sh.
See also our Terms & Conditions.