Thank you for using SelfCmd (“we”, “us”, or “the software”). We respect your privacy and are committed to protecting your personal data. This Privacy Policy explains what we collect, how we use it, how long we keep it, and what rights you have. Please read it carefully before using our products. If you do not agree, please discontinue use.
1. Scope
This policy applies to:
- The SelfCmd desktop client (Windows, macOS, Linux)
- The SelfCmd website and related pages
- The SelfCmd back-office (administrator access only)
2. Information We Collect
2.1 Desktop client
The SelfCmd desktop client is an offline tool. By default it sends nothing to any server. Everything you configure lives only on your machine under data-store/, including:
- SSH connection details (host, username, password or key path; passwords and key passphrases are stored encrypted)
- Scheduled tasks, command library, workflows
- Local operation logs
- The License file and machine ID
The client communicates with our network in only two cases:
- License activation and validation: the client sends an HMAC-SHA256 signed payload containing the License Key, your machine ID, and a timestamp. The server returns a signature verification result. It does not read your connection, task, or command data.
- Update check (optional): the client may request the latest version number from our website. The request includes only a generic User-Agent and no personal or host data.
2.2 Website and purchases
When you purchase a License or send feedback we collect:
- Email address — to deliver the License Key, receipts and essential product notices
- Purchase information (order number, plan, amount) — handled by our third-party payment processor
- Machine ID — generated by the client on activation. It is a 32-character hex hash derived from your hostname and hardware fingerprint and is not reversible back to your hardware.
- Feedback content (if you submit any) — the text you enter and an optional email
- Standard access logs — IP address, User-Agent, and request path recorded by the hosting layer for security auditing. Retained for no more than 90 days.
3. What We Never Collect
Neither the client nor the website ever collects:
- Your SSH usernames, passwords, private keys, or any auth credentials
- The commands you run, their output, or any file contents
- Any information about the remote hosts you manage (IPs, configs, status, logs, etc.)
- Sensitive personal identifiers (ID number, passport, phone, address)
- Your browsing habits or click trails (no third-party trackers beyond §2.2 access logs)
4. How We Use Your Information
- Validate License authenticity, bind it to a machine, and prevent abuse
- Send you License Keys, receipts, and important security notices
- Respond to your feedback and support requests
- Detect and defend against attacks on the website and License service
- Generate aggregate, non-identifying statistics to improve the product
5. Third-Party Services
We use carefully vetted third-party services, sharing only the minimum data required:
- Payment processing: via Stripe / Afdian / WeChat Pay depending on your region. These providers have their own privacy policies. We do not receive your full card number or payment password.
- Email delivery: via SMTP services (Aliyun DirectMail, SendGrid) for License Keys and notifications.
- Cloud hosting: the website and License API are deployed on public clouds (Vercel, Aliyun) with their own physical and network security standards.
6. Retention
- Licenses & purchase records: retained for 5 years after License expiry, for invoicing and after-sales support
- Feedback: retained until we believe the issue has been resolved, for a maximum of 2 years
- Access logs: 90 days
- Local client data: fully under your control. You may delete the
data-store/directory at any time.
7. Your Rights
Under applicable data protection laws (China PIPL, EU GDPR, etc.) you have the following rights:
- Access: request a copy of the information we hold about you
- Rectification: ask us to correct inaccurate or incomplete data
- Deletion: ask us to delete your data (where the License has lapsed or been refunded)
- Object: object to our use of your data for direct marketing
- Portability: request a copy of your data in a structured, common format
To exercise any of these rights please email [email protected]. We will respond within 30 days.
8. Information Security
- Passwords and SSH key passphrases stored in the client are encrypted with a local keystore; the key never leaves your machine
- License Keys are signed with HMAC-SHA256, making them tamper-evident
- The website is HTTPS-only (TLS 1.2+); all API requests use enforced encrypted channels
- The back-office uses captcha + strong password validation; login attempts are rate-limited
- We apply least-privilege access internally; database operations are logged for audit
9. Children
SelfCmd is a professional tool for developers and operators. It is not intended for users under 14. We do not knowingly collect data from minors. If you believe we have done so accidentally, please contact us to have it removed.
10. Updates to This Policy
This policy may be updated. We will give you reasonable notice of material changes via the website or email. Continued use of the software or website after the update means you accept the new policy.
11. Contact Us
If you have any questions about this policy, your data, or our privacy practices, please contact:
- Email: [email protected]
- Feedback: via the “Feedback” widget at the bottom of the website