Legal

Privacy Policy

abalso AI ssh · Last updated: October 2026 · only the German version is authoritative

Controller (GDPR)

Eduard Mehrtens e.K. · Am Hagen 15 · 28790 Schwanewede · Germany · Email: info@abalso.de

The essentials first. Your passwords, SSH keys and server data do not reach us: credentials live in your operating system's keychain, synchronization is end-to-end encrypted and only ever targets destinations you choose yourself. The app sends no telemetry and the free tier requires no sign-in. Every connection to our servers is listed below.

1. Using this website

1.1 Hosting and server logs

This website, the download/update server (download.ssh.abalso.de), the license system (lizenz.ssh.abalso.de) and the AI relay (ai.ssh.abalso.de) run on servers in Germany. Technically necessary data (IP address, time, requested resource, browser type) is processed to serve the pages and fend off attacks (Art. 6(1)(f) GDPR). Logs are deleted after 30 days at the latest, are not merged with other sources and not used for behavioral analysis. We embed no analytics or tracking; fonts and graphics are served from our own server.

1.2 Purchases via Paddle

Purchases are processed by Paddle.com Market Ltd., Judd House, 18–29 Mora Street, London EC1V 8BT, United Kingdom, as Merchant of Record; the purchase contract is between you and Paddle. On the landing pages of this site the Paddle checkout script (cdn.paddle.com) is loaded so the buy buttons work — on the German and English landing pages only once you click a buy button, on the other language pages when the page is opened; your IP address is technically transmitted to Paddle (Art. 6(1)(f) GDPR). The Paddle script in turn loads an analytics service of the Paddle group (public.profitwell.com, "ProfitWell"); your IP address and the visited page are transmitted there as well. Processing by Paddle companies outside the EU cannot be excluded; details and safeguards are set out in Paddle's privacy policy (an adequacy decision exists for the UK). No Paddle script is loaded on the legal pages. During checkout Paddle processes the data you enter there (name, email, billing and payment data, country); we do not receive full payment data — only what is needed for unlocking (in particular email address, product, order and subscription id, period end).

2. Data processing in the app

2.1 Principle

The app sends no telemetry. The free tier requires no sign-in. The contents of your terminal sessions, your server profiles, keys and recordings are not transmitted to us (for the single exception — AI requests you trigger — see 2.5).

2.2 Device ID

On first use the app generates a random device ID (UUID) without any hardware reference. It solely serves to assign licenses and the one-time 7-day trial to devices.

2.3 Update check

The app asks the update server (download.ssh.abalso.de) for new versions; only IP address, requested file and installed version are transmitted (Art. 6(1)(f) GDPR).

2.4 License account, sign-in and 7-day trial

For Pro/Plus and the trial our license system keeps an account under your email address. We process email address, device IDs, tier and term, and for the trial the fact that it has already been used for this email address and this device (stored permanently to prevent repeated free trials, Art. 6(1)(f) GDPR). Sign-in codes and purchase confirmations are sent by email. Otherwise the legal basis is Art. 6(1)(b) GDPR (performance of contract).

2.5 abalso AI (Plus tier)

When you use the abalso AI, the app sends your request together with the necessary terminal context to our relay (ai.ssh.abalso.de, servers in Germany). The app redacts recognizable secrets (passwords, keys, tokens) before sending. To generate the answer our relay forwards the request to our processor IONOS Cloud GmbH (Germany), which runs the language model in the IONOS AI Model Hub in data centres in Germany (data processing agreement under Art. 28 GDPR). According to IONOS, requests and answers are processed there in memory only, neither logged nor stored permanently, and not used to train models. No transfer to third countries takes place. Our relay does not permanently store the contents of your requests; token consumption per account is recorded for quota accounting. Alternative without our relay: your own API keys (BYOK — direct connection from your device to the provider you choose, Pro tier).

2.6 AI with your own keys (BYOK)

With your own keys the app connects directly from your device to the provider you choose (OpenAI or Anthropic); that provider's privacy policy applies and our servers are not involved.

2.7 Synchronization

Synchronization encrypts your data on your device (AES-256-GCM) and transfers it exclusively to the targets you choose (your own SFTP/WebDAV server or a local folder). We operate no sync service and receive neither keys nor contents.

2.8 Public IP display

For the optional display of your public IP the app queries an echo service (api.ipify.org, fallback checkip.amazonaws.com); your IP address is transmitted to that service by design — that is the purpose of the request (Art. 6(1)(f) GDPR).

2.9 Local data

Credentials live in your operating system's keychain; session recordings and the audit trail are stored locally and sealed, and are only exported by you.

2.10 Mobile apps (iPhone, iPad, Android)

The mobile apps are free companions to the desktop app and require no account. They send no telemetry and contain no analytics or advertising SDKs. Server profiles, passwords, SSH keys and 2FA secrets are stored exclusively in the protected storage of your device (iOS Keychain or Android Keystore) and are not transmitted to us. SSH connections run directly between your device and your servers. The camera is used only at your request to scan QR codes (setup, direct transfer); no images are stored. Local network access serves solely the direct transfer over Wi‑Fi between your own devices (encrypted with a one-time code). Synchronization works as described in 2.7 (your own server, end-to-end encrypted). AI features are available in the mobile apps only with your own keys (BYOK, see 2.6), which you store in the desktop app; when you use them, the app sends your request together with the necessary terminal context directly to the provider you chose (OpenAI or Anthropic). Purchase and updates are subject to the terms of the respective store (Apple App Store, Google Play); the stores receive no personal data from us.

3. Recipients

Hosting in Germany for website, update, license and AI relay services.
Paddle.com Market Ltd. (UK) and affiliated companies (including ProfitWell) for purchase processing — as independent controllers (section 1.2).
IONOS Cloud GmbH (Germany) as processor operating the language model of the abalso AI — only when using the abalso AI (section 2.5).
With BYOK: the AI provider you choose — directly from your device (section 2.6).

4. Retention

Server logs: deleted after 30 days at the latest.
License account: for the duration of the contract and statutory retention periods.
Trial marker (email/device ID): permanent, to prevent repeated free trials.

5. Your rights

You have the rights of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection to processing based on Art. 6(1)(f) GDPR (Art. 21). Contact info@abalso.de. You may also lodge a complaint with a data protection authority; the authority responsible for us is the State Commissioner for Data Protection of Lower Saxony.