Privacy Policy

KoreShell collects only what is necessary to operate the licensing service: • Email address and hashed password (for account login and communication) • License key and SHA-256 device fingerprint (for activation and device management) • Payment records via Razorpay (we never see your full card number or UPI credentials) • Timestamps of license activations, deactivations, and validation checks • App version and operating system (sent with every license validation — used for compatibility support) We do not collect: SSH credentials, server hostnames, commands you run, file contents, terminal output, AI prompts, backup data, scripts, or any data processed by the desktop app.

All SSH credentials, server configurations, private keys, and vault contents are stored locally on your machine inside an AES-256-GCM encrypted vault. The vault master key is protected by macOS Keychain or Windows DPAPI — never by KoreShell servers. SSH connections are made directly from your machine to your servers. There is no relay server, no proxy, and no inspection of connection traffic.

If you use the AI terminal assistant, your prompts are sent directly from your device to the AI provider you configure (Anthropic, OpenAI, Google Gemini, OpenRouter, or a local Ollama instance). KoreShell does not proxy, log, or store these requests on our servers. Review the privacy policy of your chosen AI provider for how they handle your data. If you use Ollama, all processing happens locally on your machine — no data leaves your device. Consent-gated command execution: when the AI suggests a command, KoreShell logs your approval decision locally in SQLite for your audit trail. This log never leaves your machine.

The KoreShell website uses: • Session cookies for dashboard authentication (httpOnly, SameSite=Strict, 7-day expiry) • Google Analytics (GA4, measurement ID G-40QGMWW5B5) to understand page traffic and feature interest. Google Analytics may collect your anonymized IP address, browser type, and pages visited. See Google's privacy policy at policies.google.com/privacy. We do not use advertising cookies, retargeting pixels, or third-party tracking beyond GA4.

Account and license data is retained while your account is active. You may request deletion by emailing hello@koreshell.io — we will process your request within 30 days. Payment and transaction records required for legal compliance are retained for 7 years per standard accounting obligations. After account deletion these records are anonymized where possible.

• Razorpay — payment processing for Indian and international cards, UPI, NetBanking (razorpay.com/privacy) • Neon — PostgreSQL database hosting for the license server, located in AWS US-East-1 • Microsoft 365 — transactional email delivery (privacy.microsoft.com) • Google Analytics — website usage analytics (policies.google.com/privacy) • Vercel — website hosting (vercel.com/legal/privacy-policy) The desktop app communicates only with the KoreShell license server (license.koreshell.io over TLS 1.3) and directly with your own servers over SSH.

You may request: • A copy of the personal data we hold about you • Correction of inaccurate data • Deletion of your account and associated data • Opt-out of Google Analytics by installing the GA opt-out browser extension (tools.google.com/dlpage/gaoptout) Contact us at hello@koreshell.io. We respond within 30 days.

KoreShell is a developer tool intended for users aged 18 and older. We do not knowingly collect data from minors. If you believe a minor has provided us personal data, please contact hello@koreshell.io.

We may update this policy. Material changes will be communicated via the email on your account at least 14 days before they take effect. Continued use of KoreShell after that date constitutes acceptance.

KoreShell is a brand owned and operated by Adyantrix Private Limited. hello@koreshell.io koreshell.io Effective date: May 26, 2026