Privacy Policy

← Back to Foredeck

The short version

Foredeck is a client for Kubernetes clusters you already have access to. It runs on your device and talks to the API servers of clusters you added yourself — and, for Foredeck Pro, to the App Store and RevenueCat, which keep track of your purchase. If you allow it, it also sends anonymous usage statistics to Amplitude; nothing from your clusters is ever part of them. Everything Foredeck stores about your clusters — the list of clusters, their addresses, their credentials, your preferences — stays on this device.

What Foredeck stores on your device

• The clusters you add: the name you give them, the server address, the certificate authority from the kubeconfig, and your display preferences. These are written to Foredeck's own folder, which is protected by iOS file protection and included in your device backup if you take one. • Cluster credentials: bearer tokens, usernames and passwords, and client certificates with their private keys — and, for a cluster added through a cloud account, that account's API token, access key or sign-in. These are held in the iOS Keychain, marked so they stay on this device and are excluded from iCloud backups. Removing a cluster in Foredeck deletes both, including the keychain entries.

What leaves your device

Foredeck sends requests to the Kubernetes API servers you configure, over TLS, carrying the credentials you provided. Every one of those destinations is one you typed in, or one your cloud provider listed for you after you signed in to it (see Cloud accounts below). To know whether you have Foredeck Pro, the app asks RevenueCat, the service that records App Store purchases for it. RevenueCat receives a random Foredeck ID made on your device (it names no one and is kept in your iCloud Keychain, so it survives a reinstall), the purchases made under it, and basic device information such as the iOS version and country of your App Store account. Nothing about your clusters is ever sent to it. The cluster's replies — the state of your workloads, your logs, your events — are shown on screen and held in memory while you look at them. They are not written to disk and not sent anywhere else.

Cloud accounts

You can add clusters by signing in to a cloud account instead of importing a kubeconfig: a DigitalOcean or Linode API token, an AWS access key, a Microsoft Entra service principal, a Yandex Cloud service account key, or your Google account. Foredeck then talks directly to that provider — DigitalOcean, Akamai Cloud (Linode), Amazon Web Services, Microsoft Azure, Yandex Cloud or Google Cloud — to list your clusters, read each one's address and certificate authority, and obtain the short-lived token the cluster accepts. Nothing passes through any server of the developer, who never sees the account, the key or the clusters. You can also sign in through your organisation's OpenID Connect identity provider, such as OpenUnison, Dex or Keycloak, in the system sign-in sheet, or by pasting the credentials it gives you. For Yandex Cloud the service account key never leaves the device: Foredeck signs a short request with it on the phone and sends only that signature to Yandex Cloud in exchange for a temporary token. For an OpenID Connect sign-in, Foredeck talks only to the identity provider named in your kubeconfig or entered by you, to renew the short-lived token your cluster accepts; the refresh token and ID token are kept in the iOS Keychain on this device and are never sent to the developer. The token, key or sign-in is kept in the iOS Keychain on this device, used only for the requests above, and deleted when you remove the last cluster that uses it. Google user data. When you sign in with Google, Foredeck requests the "See, edit, configure and delete your Google Cloud data" permission (scope cloud-platform) and your email address. It uses them only to list the Google Cloud projects and Google Kubernetes Engine clusters your account can see, and to open the clusters you choose, acting with exactly the permissions your account has in IAM and in the cluster. Your email address is shown in the app so you can tell which account a cluster belongs to. Foredeck does not read, store or send any other Google data; it creates, changes or deletes something in a cluster only when you tell it to. The data received from Google is kept on your device, is not transferred to the developer or anyone else, is not used for advertising, and is not used to train AI or machine-learning models. Foredeck's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. You can revoke Foredeck's access at any time at myaccount.google.com/permissions.

Usage statistics, only if you allow them

On first launch Foredeck asks whether it may send anonymous usage statistics. Nothing is sent, and the analytics component is not even started, until you choose Allow; you can change your answer at any time in Settings → Privacy. If you allow it, Foredeck sends Amplitude, Inc. (USA) events such as: the paywall was shown, a plan was bought, a cluster was added from a kubeconfig, a connection succeeded or failed, logs or a shell were opened, a session lasted between five and twenty minutes. Properties are chosen from fixed lists, and counts and durations are sent only as ranges. With each event go the app version, the iOS version, the device model, the language and the country — derived from your IP address by Amplitude, which does not store the address itself — and a random identifier made on your device. Never sent: anything from your clusters — names, addresses, namespaces, objects, YAML, logs, commands, error messages or credentials — and no account, no advertising identifier (IDFA), no identifier shared with other apps, no precise location. The statistics are not used for advertising, not combined with other data and not sold. Why: to learn which features are worth building and where people get stuck connecting a cluster. The legal basis is your consent (Article 6(1)(a) GDPR), which you can withdraw in Settings; turning it off stops sending and deletes the random identifier on your device. Amplitude keeps the data for up to one year. It is processed in the United States under the EU–US Data Privacy Framework or the European Commission's Standard Contractual Clauses. Amplitude's privacy notice: amplitude.com/privacy.

Diagnostics

Foredeck writes to the system log through Apple's unified logging, which stays on your device unless you deliberately capture and share a sysdiagnose. Values that could identify your infrastructure are marked private and are redacted in those logs. The developer has no way to see any of it.

Others involved

Foredeck contains no advertising. Its third-party code is a YAML parser and a terminal emulator, which run on your device; the RevenueCat SDK, which handles purchases as described above under RevenueCat's own privacy policy (revenuecat.com/privacy); and the Amplitude SDK, which sends usage statistics only if you allow it, as described above. Apple provides the App Store and TestFlight and independently collects the information described in Apple's own privacy policy — for example, whether the app was downloaded or crashed. The developer receives only aggregate figures.

Your rights and how to reach us

Information about your clusters lives only on your own device: remove a cluster, or delete the app, to erase it. To have your purchase record removed from RevenueCat, email us your Foredeck ID (Settings → Foredeck Pro). Usage statistics carry no identifier we could match to you; switching them off in Settings deletes the random one on your device, and anything already sent expires at Amplitude within a year. Questions about this policy: kozlovskyaid@icloud.com. Last updated: 10 November 2026. Material changes will appear here and in a release note.