Privacy Policy for SiaShell

Last Updated: January 6, 2026

Effective Date: January 6, 2026

---

1. INTRODUCTION

This Privacy Policy describes how Sia Makerlab ("Company," "we," "us," or "our") collects, uses, discloses, and protects information in connection with the SiaShell mobile application ("App," "Service," or "Application"). By downloading, installing, accessing, or using SiaShell, you ("User," "you," or "your") acknowledge that you have read, understood, and agree to be bound by this Privacy Policy.

If you do not agree with any part of this Privacy Policy, you must immediately cease all use of the Application and uninstall it from your device.

Contact Information

• Company: Sia Makerlab
• Email: sia@siamakerlab.com
• Website: https://siamakerlab.com
• App Homepage: https://siashell.com

---

2. SCOPE AND APPLICATION

This Privacy Policy applies to:

• All versions of the SiaShell application
• All platforms on which the Application is available
• All users regardless of geographic location

This Privacy Policy does NOT apply to:

• Third-party websites, services, or applications linked from the App
• Remote servers you connect to using the App
• Any data transmitted to or from remote servers via SSH/SFTP connections
• Services provided by Google, including but not limited to Google AdMob, Google Play Billing, and Google Play Store

---

3. INFORMATION WE COLLECT

3.1 Information Stored Locally on Your Device

SiaShell stores the following information exclusively on your device using industry-standard encryption (AES-256):

Server Connection Profiles

• Server name (user-defined label)
• Host address and port number
• Username
• Authentication type preference
• Connection timestamps
• Visual customization preferences (color tags)

Authentication Credentials

• SSH passwords (AES-256 encrypted)
• SSH private keys (AES-256 encrypted)
• Private key passphrases (AES-256 encrypted)

Host Key Fingerprints

• Public key fingerprints of connected servers
• Host key types (RSA, ED25519, ECDSA)
• Verification timestamps

Application Settings

• Terminal appearance preferences (font size, theme, colors)
• Connection behavior settings (auto-reconnect, keep-alive)
• User interface preferences (language, dark mode)

IMPORTANT: All sensitive credentials are encrypted using AES-256-GCM encryption and stored using Android Keystore system. This data is NEVER transmitted to our servers or any third party. We have NO access to your credentials, connection details, or any data stored locally on your device.

3.2 Information Collected by Third-Party Services

Google AdMob (Advertising)

We use Google AdMob to display advertisements. AdMob may collect:

• Advertising ID (Google Advertising ID)
• Device information (manufacturer, model, operating system version)
• IP address
• Ad interaction data (impressions, clicks)
• General location data (country/region level)

For more information, please review Google's Privacy Policy.

Google Play Billing (In-App Purchases)

For in-app purchases (e.g., "Remove Ads"), Google Play Billing processes:

• Purchase transaction data
• Order identifiers
• Product identifiers
• Purchase tokens

This information is processed by Google according to Google Play's Terms of Service.

Google User Messaging Platform (UMP)

For GDPR/CCPA compliance, we use Google UMP which may collect:

• Consent preferences
• Geographic region (for determining applicable regulations)
• Device identifiers for consent management

3.3 Information We Do NOT Collect

SiaShell explicitly does NOT collect:

• Personal identification information (name, email, phone number)
• Location data (GPS, precise location)
• Contact lists or address books
• Photos, media, or files (except those you explicitly transfer via SFTP)
• Microphone or camera data
• Biometric data
• Browsing history
• SMS or call logs
• Usage analytics or telemetry
• Crash reports (no automatic crash reporting is implemented)
• Terminal session content or command history
• Contents of files transferred via SFTP

---

4. HOW WE USE INFORMATION

4.1 Local Data Usage

All locally stored data is used exclusively to:

• Enable SSH/SFTP connections to your specified servers
• Remember your server configurations for convenience
• Apply your personalized settings and preferences
• Verify host key authenticity to prevent man-in-the-middle attacks

4.2 Third-Party Data Usage

Data collected by third-party services is used to:

• Display relevant advertisements (Google AdMob)
• Process in-app purchase transactions (Google Play Billing)
• Manage privacy consent preferences (Google UMP)

We do not have direct access to, control over, or responsibility for data collected by these third-party services.

---

5. DATA SHARING AND DISCLOSURE

5.1 We Do Not Sell Your Data

We do not sell, trade, rent, or otherwise transfer your personal information to third parties for monetary or other valuable consideration.

5.2 Third-Party Service Providers

The following third-party services operate within the App:

Service

Provider

Purpose

Data Shared

AdMob

Google LLC

Advertising

Advertising ID, device info

Play Billing

Google LLC

In-app purchases

Transaction data

User Messaging Platform

Google LLC

Consent management

Consent preferences

5.3 Legal Requirements

We may disclose information if required to do so by law or in response to valid requests by public authorities (e.g., a court or government agency). However, since we do not collect or store your personal data on our servers, we have no data to disclose.

5.4 User-Initiated Transfers

When you use SiaShell to connect to remote servers via SSH/SFTP:

• All data transmitted is encrypted using the SSH protocol
• Data is transmitted directly between your device and the remote server
• We have no access to, knowledge of, or control over this data
• You are solely responsible for the security and legality of such connections

---

6. DATA SECURITY

6.1 Encryption Standards

SiaShell implements multiple layers of encryption:

• Credential Storage: AES-256-GCM encryption via Android EncryptedSharedPreferences
• Database: SQLCipher with AES-256 encryption
• Key Management: Android Keystore (hardware-backed when available)
• SSH/SFTP Connections: Industry-standard SSH protocol encryption

6.2 Security Measures

• All sensitive data is encrypted at rest
• No cleartext HTTP traffic is permitted
• Runtime passwords are cleared from memory upon session termination
• Automatic credential clearing after period of inactivity
• Host key verification to prevent MITM attacks
• No logging of sensitive information (hosts, usernames, passwords, keys)

6.3 Limitations and Disclaimers

WHILE WE IMPLEMENT INDUSTRY-STANDARD SECURITY MEASURES, NO METHOD OF ELECTRONIC STORAGE OR TRANSMISSION IS 100% SECURE. WE CANNOT AND DO NOT GUARANTEE ABSOLUTE SECURITY.

You are responsible for:

• Maintaining the security of your device
• Using strong, unique passwords
• Protecting your private keys
• Keeping your device's operating system updated
• Not sharing your device with unauthorized individuals

---

7. DATA RETENTION AND DELETION

7.1 Local Data Retention

All data stored locally remains on your device until:

• You manually delete it within the App
• You uninstall the Application
• You clear the App's data through device settings

7.2 Third-Party Data Retention

Data collected by Google services is retained according to Google's data retention policies. Please refer to:

• Google Privacy Policy
• Google Ads Data Retention

7.3 Data Deletion

To delete your data:

1. Server Profiles: Delete individual profiles within the App settings
2. Private Keys: Remove keys through the App's key management interface
3. All Local Data: Uninstall the Application or clear App data in device settings
4. Advertising Preferences: Reset your Advertising ID in device settings
5. Consent Preferences: Access privacy options through the App settings

---

8. YOUR RIGHTS AND CHOICES

8.1 General Rights

You have the right to:

• Access locally stored data through the App interface
• Delete your data at any time
• Opt out of personalized advertising
• Modify consent preferences
• Uninstall the Application

8.2 Advertising Choices

To opt out of personalized advertising:

1. Modify consent preferences when prompted or through App settings
2. Reset or delete your Advertising ID in device settings
3. Enable "Opt out of Ads Personalization" in device settings

8.3 GDPR Rights (European Economic Area Users)

If you are located in the European Economic Area (EEA), you have the following rights under the General Data Protection Regulation (GDPR):

• Right to Access: Request information about data processing
• Right to Rectification: Request correction of inaccurate data
• Right to Erasure: Request deletion of your data
• Right to Restrict Processing: Request limitation of data processing
• Right to Data Portability: Request transfer of your data
• Right to Object: Object to data processing
• Right to Withdraw Consent: Withdraw consent at any time

Since we do not collect or store personal data on our servers, most of these rights can be exercised directly through the App or your device settings. For data processed by Google, please refer to Google's GDPR compliance information.

8.4 CCPA Rights (California Users)

If you are a California resident, under the California Consumer Privacy Act (CCPA), you have the right to:

• Know what personal information is collected
• Know whether personal information is sold or disclosed
• Opt out of the sale of personal information
• Request deletion of personal information
• Not be discriminated against for exercising these rights

We do not sell personal information. For data processed by Google, please refer to Google's CCPA compliance information.

8.5 Do Not Track

SiaShell does not track users across third-party websites. There is no personal tracking to disable.

---

9. CHILDREN'S PRIVACY

9.1 Age Restriction

SiaShell is not intended for use by children under the age of 13 (or the applicable age of digital consent in your jurisdiction). We do not knowingly collect personal information from children.

9.2 Parental Notice

If you are a parent or guardian and believe your child has provided personal information through the App, please contact us. Since we do not collect personal data on our servers, any such data would be stored locally on the child's device and can be removed by uninstalling the App.

9.3 COPPA Compliance

In compliance with the Children's Online Privacy Protection Act (COPPA), we do not knowingly collect, use, or disclose personal information from children under 13.

---

10. INTERNATIONAL DATA TRANSFERS

10.1 Google Services

Data processed by Google services (AdMob, Play Billing, UMP) may be transferred to and processed in the United States or other countries where Google operates. Google provides appropriate safeguards for international data transfers, including:

• Standard Contractual Clauses
• EU-US Data Privacy Framework (where applicable)

10.2 User-Initiated Connections

When you connect to remote servers via SSH/SFTP, data may be transferred internationally based on the server location you specify. You are solely responsible for ensuring such transfers comply with applicable laws.

---

11. CHANGES TO THIS PRIVACY POLICY

11.1 Notification of Changes

We may update this Privacy Policy from time to time. We will notify you of any material changes by:

• Posting the updated Privacy Policy on our website
• Updating the "Last Updated" date at the top of this document
• Displaying a notice within the Application (at our discretion)

11.2 Your Continued Use

Your continued use of SiaShell after any changes to this Privacy Policy constitutes your acceptance of the revised policy. If you do not agree with the updated policy, you must discontinue use and uninstall the Application.

---

12. THIRD-PARTY LINKS AND SERVICES

12.1 External Links

The App may contain links to third-party websites or services. We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies before providing any personal information.

12.2 Remote Server Connections

SiaShell enables you to connect to remote servers of your choosing. We have no control over, responsibility for, or liability regarding:

• The security of remote servers
• Data stored on or transmitted to/from remote servers
• Privacy practices of remote server operators
• Any actions taken through SSH/SFTP sessions

---

13. DISCLAIMERS AND LIMITATIONS OF LIABILITY

13.1 No Warranty

THE APPLICATION IS PROVIDED "AS IS" AND "AS AVAILABLE" WITHOUT WARRANTIES OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, AND NON-INFRINGEMENT.

13.2 Limitation of Liability

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, IN NO EVENT SHALL SIA MAKERLAB, ITS AFFILIATES, OFFICERS, DIRECTORS, EMPLOYEES, AGENTS, OR LICENSORS BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, PUNITIVE, OR EXEMPLARY DAMAGES, INCLUDING BUT NOT LIMITED TO:

• Loss of data, revenue, profits, or business
• Unauthorized access to or alteration of your transmissions or data
• Statements or conduct of any third party
• Any other matter relating to the Application

THIS LIMITATION APPLIES WHETHER THE ALLEGED LIABILITY IS BASED ON CONTRACT, TORT, NEGLIGENCE, STRICT LIABILITY, OR ANY OTHER BASIS, EVEN IF WE HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

13.3 User Responsibility

You acknowledge and agree that:

• You are solely responsible for maintaining the confidentiality of your credentials
• You are solely responsible for the security of your device
• You are solely responsible for all activities conducted through your SSH/SFTP connections
• You will comply with all applicable laws when using the Application
• Any connection to remote servers is at your own risk

13.4 Indemnification

You agree to defend, indemnify, and hold harmless Sia Makerlab and its affiliates, officers, directors, employees, and agents from and against any and all claims, damages, obligations, losses, liabilities, costs, and expenses arising from:

• Your use of the Application
• Your violation of this Privacy Policy or any applicable law
• Your violation of any third-party rights
• Any unauthorized access to servers using the Application

---

14. PERMISSIONS

14.1 Required Permissions

SiaShell requests the following permissions:

Permission

Purpose

INTERNET

Establish SSH/SFTP connections

ACCESS_NETWORK_STATE

Check network availability

ACCESS_WIFI_STATE

Detect WiFi connection status

FOREGROUND_SERVICE

Maintain background SSH sessions

WAKE_LOCK

Prevent CPU sleep during active sessions

POST_NOTIFICATIONS

Display session and transfer notifications

VIBRATE

Haptic feedback for terminal bell

AD_ID

Enable personalized advertising (optional)

BILLING

Process in-app purchases

14.2 Optional Permissions

You may deny certain permissions, though this may limit functionality:

• Notifications: App functions without notifications
• AD_ID: Ads will be non-personalized if denied

---

15. GOVERNING LAW AND DISPUTE RESOLUTION

15.1 Governing Law

This Privacy Policy shall be governed by and construed in accordance with the laws of the Republic of Korea, without regard to its conflict of law provisions.

15.2 Dispute Resolution

Any dispute arising out of or relating to this Privacy Policy shall be resolved through good-faith negotiation. If negotiation fails, disputes shall be submitted to the exclusive jurisdiction of the courts located in the Republic of Korea.

15.3 Severability

If any provision of this Privacy Policy is found to be unenforceable or invalid, that provision shall be limited or eliminated to the minimum extent necessary so that this Privacy Policy shall otherwise remain in full force and effect.

---

16. CONTACT US

If you have any questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact us:

Sia Makerlab

• Email: sia@siamakerlab.com
• Website: https://siamakerlab.com
• App Homepage: https://siashell.com

We will respond to your inquiry within a reasonable timeframe.

---

17. ADDITIONAL DISCLOSURES

17.1 California "Shine the Light" Law

California Civil Code Section 1798.83 permits California residents to request information regarding the disclosure of personal information to third parties for direct marketing purposes. We do not disclose personal information to third parties for direct marketing purposes.

17.2 Nevada Privacy Rights

Nevada residents may opt out of the sale of their personal information. We do not sell personal information as defined under Nevada law.

17.3 Virginia Consumer Data Protection Act (VCDPA)

Virginia residents have rights similar to those under GDPR and CCPA. Since we do not collect personal data on our servers, you can exercise your rights through the App and device settings.

17.4 Brazil General Data Protection Law (LGPD)

Brazilian users have rights under the LGPD similar to GDPR rights. These can be exercised as described in Section 8 of this Privacy Policy.

---

18. ACKNOWLEDGMENT

BY USING SIASHELL, YOU ACKNOWLEDGE THAT YOU HAVE READ THIS PRIVACY POLICY, UNDERSTOOD IT, AND AGREE TO BE BOUND BY ITS TERMS AND CONDITIONS. IF YOU DO NOT AGREE TO THIS PRIVACY POLICY, PLEASE DO NOT USE THE APPLICATION.

---

SiaShell Privacy Policy - Version 1.0

Copyright (C) 2026 Sia Makerlab. All rights reserved.