What leaves your device

This page lists everything the Sternway apps send off your device, feature by feature: what, where to, and when. Settings › About › What leaves this device in both apps shows the same list, with the state of that device’s own settings next to each feature.

There is no telemetry. No analytics, no crash reporting, no usage statistics, no advertising identifiers; neither app contains such a library. The app’s log stays on the device, and Copy diagnostics only puts text on your clipboard.

There is no Sternway server you are sent to by default. Sync, sharing and the account talk to a server whose address you type in. Without an account, the only things that leave the device are the connections you open and the features below that you turn on yourself.

Your connections

SSH, SFTP, SCP, Telnet, Mosh, serial, jump hosts, proxies and port forwards go where you point them, with what you type into them. That is the point of the app. A few things happen on those connections that you may not expect:

OS check. When a session to a saved host is ready, a fixed read-only script on its own channel reads the host’s os-release, uname and login shell name, once per connection, so the host gets its icon and snippets are quoted correctly. The answer stays on the device.
Host status (desktop details pane, phone host menu): a fixed read-only script reads uptime, load, memory, disk and failed services over a connection you already have open.
Reachability dots (off by default): about once a minute, a TCP connection to each visible host’s SSH port, closed at once. No login, nothing sent on it.
Wake-on-LAN and port knocking: the magic packet and the knocks go from this device to the host’s network, as configured on the host.
SSH agent (desktop): the agent is reached only over a socket or pipe on this computer; only its signature of the login challenge goes to the server.
Step CA (desktop): requests to the CA you set on a key, over HTTPS, with its root pinned; with an OIDC provisioner, your browser signs in at the provider the CA names.

Where: the server you entered. Nothing is sent before you sign in.

Signing up or in: your email, name, public keys, the key-derivation settings, and this device’s id, name (the computer’s host name, or the phone’s maker and model) and platform. Not your password: a key derived from it (the auth key), and your encryption keys only wrapped with keys the server does not have.
While signed in: every change to your hosts, groups, keys, snippets and settings, as an encrypted blob, with its id, vault, type, revision, key version and whether it was deleted in plain text. Sync runs at start, after each change and every minute; a WebSocket brings changes at once.
Keys and identities sync (encrypted) unless you turn off Settings › Security › Sync keys and identities.
Session logs are uploaded (encrypted) only with Settings › Logs › Sync session logs on. It is off by default.
Teams: the owner’s app sends the signed member list each time the team changes (team id and name, members’ ids and key fingerprints, vault ids, key versions and access, and a team’s policies in plain text). Members’ apps send signed reports of which policies their device applies, with no item contents or host addresses.
Team presence: the ids of the team-vault hosts you have open, so teammates see who is on them. Personal hosts are never included. Turn it off with Settings › Security › Show my activity to my team.
Verify email: asks the server to mail you a code, then sends the code you type.

The server stores, in plain text, your email, name, handle, public keys, devices, passkeys (public keys), team names and members, the signed member lists, invites, a team’s SAML settings and each item’s metadata. Everything else it holds (item contents, logs, vault names, wrapped keys, the two-factor secret) is encrypted or hashed.

Sync through a folder

The app writes encrypted files to a folder you chose and sends nothing over the network itself; your sync tool carries the files. Readable in the folder: the key file (wrapped under your passphrase), random file names, rounded sizes and the times files were written. See Sync through a folder.

Single sign-on and passkeys

The app asks your server where to sign in and opens that page in your browser; the answer comes back to a port on 127.0.0.1 (desktop) or a sternway:// link (phone). Your server receives a random flow id, a hash of a secret that stays on the device, and the code the sign-in page hands back. With a passkey, the server gets the passkey’s public key and, at each use, a signature over a one-time challenge. Your encryption password is never sent.

A team owner setting up SAML fetches the identity provider’s metadata from this computer; the server never fetches URLs for a team.

AI assistant (off by default)

Nothing is sent unless you turn the assistant on and choose a provider (Settings › AI), and then only when you ask it something.

Where: the provider you chose: Anthropic, any OpenAI-compatible service (a local model too), or your Sternway server, which passes it on to the service its operator set up.
What: your question, a fixed instruction text, and only if you selected text in the terminal, that selection (at most 8 KiB). Never the scrollback or the rest of the screen. The phone also sends the host’s operating system and shell name when known.
Secrets are taken out first, on the device: private key blocks, tokens with a known shape, passwords in addresses and command lines, NAME=value where the name says it is a secret, and the exact values of every password, key and passphrase saved in your vaults are replaced with [REDACTED].
You see it before it goes: with Always preview before sending on (the default), every request shows what will be sent, with each hidden secret marked, and nothing is sent until you press Send.

Not caught: a secret that is in no vault and does not look like one, a saved value shorter than 4 characters, and a saved value written in another form (base64, URL-encoded).

Leaked-password check (off by default)

With Settings › Security › Breach check for new passwords on, setting your account password asks Have I Been Pwned’s Pwned Passwords service for the leaked password hashes that start with the same five hexadecimal characters as your password’s SHA-1 hash. Only those five characters are sent, with padding; the match is worked out on the device. Host passwords are never checked.

Update check (desktop, off by default)

With Settings › Updates › Allow update checks on, the app downloads the update feed (by default https://downloads.sternway.dev/feed/stable.json) a minute after it starts, then once a day, and when you press Check for updates. No version, platform or id is sent. Nothing is downloaded or installed. See Turn on the update check.

Imports from the network (desktop, when you run them)

Tailscale: from this computer, the app runs tailscale status --json. Through the API, one request to api.tailscale.com (or your Headscale server) with the key you paste, which is not stored.
AWS EC2: a group linked to AWS asks EC2 for its running instances at the interval you chose, signed with the access key you stored for it on this device.
Discover devices: multicast DNS questions on your local network for ten seconds. They stay on the local network.

A shared session goes through your Sternway server’s relay, encrypted with a key that is only in the invite link’s # part, which the server never receives. The server learns who joins (their name and email), when the invite ends and whether guests only watch.

Everything else

Notifications are made on the device. No push service is used and no push token is registered.
Links from a terminal or the About page open in your browser after you confirm; the app itself sends nothing.
The desktop window cannot load anything from the network, and spell checking is off, so no dictionaries are downloaded. Fonts, themes and icons are bundled.
Backups and exports are files you save yourself. A CSV export holds saved passwords in plain text; the app says so first.
Session recordings never leave the device.

Not covered here: what your server, its reverse proxy, your AI provider or your network record about requests they receive (such as IP addresses), and requests the operating system, Electron or Chromium make on their own.

Check it yourself

Run the app with no account and every feature above off, and watch its traffic with Wireshark, tcpdump, OpenSnitch or your router: you will see your own connections and nothing else. Turn a feature on and you will see exactly the destination listed for it.