wooloo-mobile privacy

Updated October 20, 2026

wooloo-mobile (shown as “wooloo mobile” in the launcher) connects your Android device to servers you choose. The app has no developer-operated account service, advertising or analytics collection. Your servers and the external services below have their own data handling policies.

On your device

Machine profiles contain addresses, usernames, session names, paths, host fingerprints and optional Cloudflare Access client IDs. Preferences and quota consent are local. Private SSH keys, saved passwords and Access secrets are encrypted using Android Keystore. Profile metadata is not encrypted by that secret store. Android backup and device-transfer backup are disabled in the app configuration. An unlocked device can still display terminal content and saved machine details.

SSH and terminal

Commands, keyboard input, prompts and attachments go to the selected server over SSH. Terminal output comes back to your device. The server, terminal programs and agents may retain that content or send it to their own providers. Notifications can show agent information on the lock screen; adjust Android notification settings if needed. Copy/share actions send the selected text or public key to the clipboard or the app you choose. Never share private keys or credentials in a bug report.

Camera, QR and images

Camera access is requested for QR scanning. The bundled decoder reads QR data locally. You can instead select an image or paste a machine link. Review destination and fingerprints through a trusted channel before connecting. Selected attachments are copied to the app cache; images can be resized or re-encoded. Small files can be uploaded unchanged, including embedded metadata such as location: metadata removal is not guaranteed. Unsent files may remain in cache; stale attachment cleanup removes files older than 24 hours when it runs, not on a guaranteed timer. Uploaded files and prompts remain subject to server retention and are not deleted by removing the app.

Google ML Kit processes QR images and results on-device; Google states that these inputs and results are not sent to its servers. The SDK can nevertheless send performance and usage metrics to Google and contact its servers for updates and compatibility information. Bundling the decoder does not disable those SDK communications. This is separate from developer-operated analytics, which this app does not add. Google's ML Kit terms and privacy information apply: https://developers.google.com/ml-kit/terms and https://policies.google.com/privacy.

External services

Direct SSH contacts the configured host. Cloudflare transport connects to the selected Cloudflare hostname and sends configured Access service-token headers to it; SSH runs inside that tunnel. Cloudflare can observe connection metadata. The version distributed outside Google Play can check GitHub for updates automatically; Settings lets you disable automatic checks. Manual checks and downloads contact GitHub and its asset delivery services, which receive network metadata such as your IP address. Each APK installation requires Android confirmation. The Google Play version does not check for or install updates itself; Google Play delivers its updates.

Optional agent quotas (experimental)

Quota access is opt-in for each remote sign-in identity. When enabled, the app reads agent credentials and usage information from that host over SSH, including supported credential files/Keychain entries and recent Codex usage logs. It sends the Claude token from the phone to https://api.anthropic.com/api/oauth/usage and the Codex token/account header to https://chatgpt.com/backend-api/wham/usage. These queries do not follow redirects. Tokens are held in memory for quota requests; they are not added to local profile JSON. Disable quotas on the machine's spaces screen to revoke future reads and queries; already completed requests cannot be recalled. Endpoint availability is not guaranteed. Rejected credentials, rate limits or unavailable quotas do not prevent SSH use; Codex may fall back to usage in the remote session log. This feature does not imply endorsement by the providers.

Deletion and recovery

Delete a machine to remove its profile and saved machine password/Access secret. Trusted host fingerprints are stored separately by host and port and remain when a machine is removed, because other profiles may use them. Clear Android app storage to remove all local trust records. SSH keys are managed separately: deleting a key removes its local private key and saved passphrase, but does not revoke the public key on any server. Remove it from the relevant authorized_keys files yourself. Clearing Android app storage or uninstalling removes local app data; it does not remove server files, remote credentials, provider records or shared copies. If Keystore access is lost, encrypted secrets cannot be recovered by the app: re-import a separately backed-up key or generate and authorize a new one, and re-enter credentials. Do not uninstall your only copy of a needed key without preparing another authorized access method.

Contact

Use https://github.com/rarce/wooloo-android/issues for sanitized questions and reports. Issues are public; do not post terminal dumps, personal hostnames, tokens, passwords, private keys or exploitable security details. Report vulnerabilities privately through GitHub private vulnerability reporting; see SECURITY.md.