Privacy

Last updated: November 11, 2026

Rexmius is built so that we know as little about you as possible. This page explains what data the Rexmius app and this website handle, and why.

Using the app without an account

• Your saved hosts and settings are stored only on your computer.
• Saved passwords, private keys and key passphrases are encrypted with your operating system's keystore (Windows DPAPI or the macOS Keychain).
• SSH connections go directly from your computer to your servers. We never see them.
• The app contains no analytics, advertising or tracking.

Encrypted sync (optional)

If you turn on sync, you sign in with Google or with an email address and password. Sign-in is handled by Firebase Authentication, a service of Google. We receive your email address, an account ID and, for Google sign-in, your display name.

Before anything is uploaded, your hosts, passwords, keys and trusted host keys are encrypted on your device with a key derived from your vault password (scrypt, AES-256-GCM). Only this encrypted data, the parameters needed to derive the key, and timestamps are stored in Cloud Firestore (Google). Your vault password never leaves your device, so we cannot read your data or reset your vault password.

Account emails, such as address verification and password reset messages, are sent from [email protected] through Firebase.

Updates

The app checks rexmius.com for new versions and downloads updates from it. Like any web request, this reveals your IP address and app version to our server.

This website

• No cookies, no analytics and no third-party scripts or fonts.
• Our hosting and network providers process standard technical data, such as IP addresses and browser information, to deliver the site and protect it from abuse.

Your choices

• You can use Rexmius without ever creating an account.
• To delete your account and the encrypted data stored for it, email us from the address you signed up with.

Contact

Questions about privacy: [email protected]