Privacy Policy
Last updated: 18 October 2026
CloudQuay (“the app”) is an SFTP, FTPS and FTP client for iOS and Android, published by TLM Software (“we”, “us”). This policy explains what data the app does and does not handle.
Short version: the details of your servers, your saved passwords and the files you browse never reach us. The app talks only to the servers you add. The only data that leaves your device for us or our providers is pseudonymous crash and usage statistics and, if you buy Pro, a purchase receipt.
Your servers stay yours
CloudQuay connects directly from your phone to the servers you add. There is no CloudQuay server in between and no account.
- Server profiles (host, port, username, start folder, name) are stored only on your device. They are excluded from Android Auto Backup and device transfer.
- Passwords are saved only if you tick Save password. A saved password goes into the iOS Keychain (this-device-only, never in a backup) or the Android Keystore (an AES-256 key that cannot be exported). If you do not save it, the app asks every time you connect.
- SSH host keys the app learns are kept on your device, so it can warn you if a server’s identity changes.
- Files and folder listings go straight between your server and your phone. We never receive them.
- Plain FTP sends your password and files unencrypted over the network. The app labels it with an open-lock badge and says so when you choose it. Prefer SFTP or FTPS.
What we collect
Pseudonymous diagnostics
To keep the app stable and to understand basic use, we use two Google Firebase services:
- Firebase Analytics records a small set of events, such as whether the rate-this-app prompt was shown, tied to a pseudonymous Firebase installation id (a random device identifier, not your name or an account of ours). It carries no free text and no server details, and the app does not read the advertising identifier.
- Firebase Crashlytics sends crash reports with the device model, OS version and the technical state at the time of the crash. Server hosts, usernames, paths and passwords are not included.
Purchases
If you buy CloudQuay Pro (a one-time purchase), the purchase is handled by the App Store or Google Play and recorded by RevenueCat, our purchase-management provider. RevenueCat receives the purchase receipt against an anonymous app user id. We never see your payment details.
Local network access on iOS
The first time the app reaches a server on your home or office network, iOS asks for permission to use the local network. The app uses it only to connect to servers you saved.
What we do not collect
- Server hosts, usernames, paths or passwords
- File names, file contents or folder listings
- Your name, email address or contact information
- Your location
- Your contacts, photos or calendar
- The advertising identifier
There is no user account, and no cloud sync.
Data deletion
There is no account, and we hold no profile about you, so there is nothing to export or delete on our side for the app itself. You control everything the app stores:
- Delete a saved server (and its saved password) from the server list inside the app.
- Uninstall the app to remove all of its data from your device.
Pseudonymous diagnostics are not tied to your name or an account, so we cannot look them up by person. For a purchase record or any other data-rights request, email privacy@swtlm.com.
Children
CloudQuay is a professional utility for people who manage servers and is not directed at children under 13 (US) or under 16 (EU). We do not knowingly collect personal data from children.
This website
Everything above is about the app. This page is part of apps.swtlm.com, and
that website uses Google Analytics to count visits — pages viewed, session
count, referral source. Analytics cookies (_ga, _ga_*) are set only after
you accept the cookie banner, and nothing is loaded before you do.
apps.swtlm.com is one website: this page and every app page on it share a single analytics property and a single consent choice, so accepting or declining once applies everywhere on the domain. That is the analytics only. This privacy policy covers CloudQuay and its pages, and nothing else — every other app on apps.swtlm.com has its own policy, because every app handles different data. You can withdraw consent at any time by clearing this site’s local storage in your browser.
Third-party service providers
| Service | Purpose | Data shared |
|---|---|---|
| Firebase Analytics (Google) | Usage statistics | A few events tied to a pseudonymous installation id; no server details or free text |
| Firebase Crashlytics (Google) | Crash reporting | Device model, OS version, crash state |
| RevenueCat | One-time Pro purchase management | Purchase receipt against an anonymous id |
| Google Analytics 4 (Google) | Counting visits to this website, only after you accept cookies | Pages viewed, session count, referral source |
Open-source components
CloudQuay uses open-source libraries to speak the three protocols: SSHJ, Apache Commons Net and Bouncy Castle on Android, and libcurl, libssh2 and OpenSSL on iOS. They run on your device and send nothing to us.
Changes
If this policy changes, we will update the date above and publish the revised version at this URL.
Contact
For privacy questions or data-rights requests, email privacy@swtlm.com.