Understand what stays where—and what no app can guarantee.

HerdRanger connects directly over verified SSH. Local encryption and careful boundaries reduce exposure but do not replace host, network, device, or recovery security.

Open the user guide

Direct connection and local records

Android device Your host Herdr

You retain control of your data. HerdRanger is not a cloud relay: provider tokens, project files, the Herdr process, prompts, agent output, and remote terminal output remain on systems you control, subject to your host and provider policies. Server access occurs directly between your Android device and the server you configure.

The app keeps encrypted profile/credential records and bounded local history needed for its features. It contains no analytics, application logging, crash collection, cloud transcript service, or durable prompt outbox.

Credential and host-identity protection

Encrypted app storage uses Android-backed key material and is excluded from automatic backup.
Unknown host keys require explicit review; changed keys block authentication with no override.
Generated private keys are not displayed or exported. Only public keys can be copied.
Biometric protection can gate new SSH authentication but cannot revoke an already-open connection.
Explicit encrypted backups are portable secrets and use a separate user-chosen password.

Security boundaries and limitations

Terminal output is untrusted input. Writable terminals are opt-in, clipboard paste requires review, remote clipboard writes are disabled, and network loss does not replay input. No JVM/native application can promise immediate erasure of every in-memory copy.

SSH host verification does not secure a compromised host, weak account permissions, an unlocked phone, a malicious provider, or an unsafe command. Maintain OS updates, backups, least privilege, private-network policy, and an independent recovery path.

Never send operational secrets to support. Exclude passwords, keys, host addresses, backup files/passwords, agent output, transcripts, and unredacted screenshots.

Third-party services

HerdRanger depends on Android (opens in a new tab), OpenSSH-compatible hosts, Herdr (opens in a new tab), your selected agent providers, and any speech-recognition, notification, VPN, or credential provider you enable. Those services have their own terms, privacy behavior, availability, and security controls.

Read the site’s Privacy Policy and Terms of Use. The website’s early-access and support forms use Formspree only for the fields users choose to submit. Neither form requests SSH credentials, private keys, pairing codes, server addresses, transcripts, or agent output.

Software and asset notices

Runtime components include Kotlin/AndroidX/Compose, SSHJ, Bouncy Castle, and ConnectBot termlib/libvterm under their respective licenses. The app package carries required dependency notices.

The app and website use JetBrains Mono Nerd Font 3.5.1 under the SIL Open Font License 1.1.

The bundled dark and light wallpaper collections were generated specifically for HerdRanger with OpenAI image generation. They are proprietary HerdRanger application assets, not human-created photography or an open stock-wallpaper collection.

HerdRanger is independent and is not affiliated with, endorsed by, sponsored by, or released by Herdr.