Last updated: 2026-10-04. This policy covers the Omnimux apps for Android (uk.omnimux.app),
iOS, macOS, Windows and Linux, and the two servers we operate for them: the optional hosted ntfy
server and the push relay.
Omnimux is a terminal and file manager for machines you already own. It has no account unless you ask for one, no analytics, no advertising and no crash reporting, and it sends nothing to us. What it knows lives on your device and on the machines you point it at.
Machine addresses, user names, passwords and private keys, ntfy server addresses and tokens, WireGuard configurations, proxy and jump host settings, port forwards, notification encryption keys and your snippets are stored only on your device, in the operating system's secure storage (Keychain, Android Keystore, Windows Credential Manager, Linux Secret Service). They are sent only to the machines and servers you configured, over SSH or HTTPS.
Also kept on the device: the notifications you have received and your answers to them; a list of the files you have downloaded (name, size, which machine, when — the note, not the file); session transcripts and trigger alerts if you turn them on, capped by the size and age you set. None of this is uploaded anywhere. Files you download stay where you saved them; files and photos you attach are uploaded over SSH to the machine you chose and nowhere else.
The app's own encrypted backup (⋮ → Backup & restore) contains all of the above and is written wherever you tell it to go. It is encrypted with a passphrase you choose; we never see it, and nobody can recover it for you.
The apps contain no analytics, advertising or crash-reporting SDKs. We do not receive your machine names, addresses, credentials, commands, terminal output, files or message contents. There is no profile, no identifier assigned to you, and nothing is sold or shared with third parties.
Instead of running a server you can ask the app to create an account on the ntfy server we operate.
It holds a generated user name (of the form omx-xxxxxxxx), a hashed recovery code, your
topic names and one access token per device, so that messages can be routed to you. We do not ask for
an email address or any other identifying detail. Messages pass through the server to reach your
devices and are held only until they are delivered or expire. See
deleting your account.
With encryption turned on for a machine, only the notification title leaves it in clear: the question text, the Yes/No actions and your replies are encrypted on the machine with a key that exists only there and on the devices you set it up from. The ntfy server and the push relay carry that ciphertext without being able to read it. Keys are never uploaded to us; a second device gets them from the machine itself over SSH, or from your own encrypted backup.
If you turn on push delivery, the relay we operate stores your device's push token, the list of ntfy topics you asked it to forward (server address, topic name and the access token you provided for it), and your subscription status. To forward a notification it receives the message title, text and reply buttons from your ntfy server and passes them to Apple Push Notification service; where end-to-end encryption is on, that text is ciphertext the relay cannot read, and your phone decrypts it as the notification is shown. Your replies never pass through the relay: a button tap goes from the phone to your ntfy server. Message content is not stored after delivery; connection logs are kept for 7 days for troubleshooting. Unregistering the device deletes its data within 24 hours.
Everything the app talks to is a machine or server you named: your SSH hosts, your ntfy server, a WireGuard peer you configured, and — if you use the Pico Wake board — an address on your own network. The app does not scan your network and does not report what it finds on it.
| Data | Where | Kept |
|---|---|---|
| Machines, keys, settings, snippets | Your device only | Until you delete them or the app |
| Notifications received, downloads list | Your device only | Last 200 of each; you can clear them |
| Transcripts and alerts | Your device only | The size and age limit you set |
| Hosted ntfy account | Our ntfy server | Until you delete the account |
| Undelivered messages | Our ntfy server | Until delivered, then up to 12 hours |
| Push registration (iOS) | Our relay | Until unregistered; then ≤ 24 hours |
| Server connection logs | Our servers | 7 days |
Everything on the device goes when you uninstall the app, or sooner: machines, notifications and the downloads list can each be removed from within the app. If you created a hosted ntfy account, this page explains how to delete it and what is removed.
| Permission | What it is for |
|---|---|
| Internet, network state | Reaching the machines and servers you configured. |
| Camera | Scanning QR codes only — a machine's pairing code, an account code, a WireGuard config. No photos are taken or stored. |
| Notifications | Showing the questions your machines ask, with Yes/No buttons. |
| Foreground service (data sync, remote messaging) | Keeping one WebSocket open to your ntfy server so questions arrive while the app is in the background. You turn it on, and can turn it off. |
| Run at startup, ignore battery optimisation, wake lock | Letting that listener survive a reboot and the system's sleep, if you choose. |
| Biometrics | The optional app lock. Authentication happens on the device; we never see it. |
| Install packages | Offering to open an APK you downloaded from your own machine. Nothing is installed without the system's own prompt. |
| Storage (Android 9 and older) | Saving downloads into your Downloads folder. Newer versions do not need it. |
| Vibrate | Feedback when you select text in the terminal. |
Omnimux is a developer tool and is not directed at children. We do not knowingly collect anything from anyone, including children.
Connections are SSH or HTTPS. Host keys are pinned on first use and a changed key is refused. Credentials are held in the platform's secure storage and, on iOS, marked so they cannot travel in an iCloud backup. The relay and ntfy server are reached over TLS.
If this policy changes materially we will update the date above and, for anything that affects data we hold, say so in the app's release notes.
Omnimux — [email protected]