Privacy policy

This policy explains what Gatesys.ai (“we”) collects when you use the Gatesys SSH app and your account at gatesys.ai, why, and what we never see. The short version: your servers, keys and terminal stay on your computer, and the account knows only what it needs to run your licence.

The app

• No telemetry, no analytics. The app does not report usage, crashes or anything else to us.
• Your hosts, keys, passwords, snippets and audit log stay on your computer. Secrets are sealed in a local vault. None of it is sent to gatesys.ai.
• AI requests go straight from your computer to the runtime you chose — a local model, a cloud provider with your own key, or an agent CLI you are signed in to. They never pass through our servers. When a request leaves your computer, the app masks identifying values first as described in What runs on the server. The provider’s own privacy terms apply to what it receives.
• Update checks ask the release feed whether a newer version exists. That request carries your IP address and app version, like any download.
• Signing in sends a device name (from your computer’s name), the operating system, CPU architecture and app version, so you can recognise the device in your account. While signed in, the app checks in about twice a day to renew its licence.

Your account

When you create an account we store:

• your email address and name;
• a salted hash of your password (never the password itself), or the identifier your sign-in provider (GitHub or Google) gives us;
• your licence: plan, trial dates and subscription status;
• your devices: name, platform, architecture, app version, when each was added and last seen;
• billing identifiers from our payment provider (a customer and subscription id). We never see or store card numbers.

We use this only to run your account and licence, to secure it (for example rate-limiting sign-in attempts, which briefly uses your IP address in memory), and to send the emails the service needs.

Email

We send transactional email only: confirming your address, resetting your password, and telling you before your trial ends. No newsletters unless you ask for them.

When you write to us

The contact form sends us your name, your email address and your message as an email; the website keeps no copy. We use them to answer you, and keep the correspondence for as long as it takes to deal with what you wrote about. The same goes for email you send us directly.

Cookies and analytics

The website sets one cookie of its own, gs_refresh, which keeps you signed in. It is HttpOnly and used for nothing else. The site also remembers in your browser whether you are signed in.

Google Analytics, only if you allow it. The first time you visit, the site asks whether it may count visits. Until you choose Allow, nothing from Google loads and no analytics cookie is set; if your browser sends Global Privacy Control, we take that as a no and do not ask.

• With your permission, Google Analytics 4 sets the _ga cookies (up to two years) to tell visits apart, and records the pages you open, where you came from, your approximate region, device and browser, and which installer you download.
• It never receives the query part of an address (sign-in, reset and verification links carry codes there), your email, or anything from your account. Google signals and ad personalisation are off, and Google Analytics does not store IP addresses.
• We keep this data for 14 months and use it only to see which pages help people and where the site falls short.
• Change your mind any time: cookie settings (also in the footer). Declining removes the _ga cookies.

Who processes data for us

• Polar — our merchant of record. Polar processes payments and taxes under its own privacy policy.
• Our hosting and email providers — to run gatesys.ai and deliver email.
• GitHub or Google — only if you choose to sign in with them.
• Google Analytics (Google Ireland Ltd.) — visit statistics on gatesys.ai, only with your permission.

We do not sell or share personal data for advertising.

How long we keep it

Account data is kept while your account exists. Deleting your account (Account › Settings) erases it and signs every device out. Payment records are kept by Polar as tax law requires.

Your rights

You can see, correct, export or delete your data at any time — most of it from your account page, the rest by writing to [email protected]. Depending on where you live, laws such as the GDPR and Türkiye’s KVKK give you these rights and the right to complain to a supervisory authority.

Changes

If this policy changes in a way that matters, we will email account holders before it takes effect.