▌ Phosphor

Privacy Policy

September 23, 2026

Privacy Policy

Effective date: September 23, 2026

Phosphor is a client for Bulletin Board Systems (BBS). It connects to BBS servers that you choose — typically your own server, or a community board you have an account on. This policy describes the data practices of the Phosphor iOS app. In plain terms: Phosphor sends your data to your servers, and to no one else.

The short version

  • Phosphor has no accounts, no analytics, no tracking, and no advertising of any kind.
  • Phosphor does not send any data to us — not crash reports, not usage statistics, not telemetry. There is no server operated by us that the app reports to.
  • Everything the app stores stays on your device (with the one Keychain exception below).
  • The only network traffic the app generates is between you and the BBS servers you configure, over the connection you choose (telnet or SSH).

What the app stores, and where

Server profiles — When you add a server, Phosphor saves the profile on your device (in your app’s Application Support directory): a name, the host address, and the port. Profiles contain no passwords.

Device pairing tokens — When you pair your phone to a server (by scanning the pairing QR code shown by your server), the server issues your device a token so it can receive push notifications and authenticate. The token itself is stored in the iOS Keychain, the system’s encrypted storage; the profile file only holds an opaque reference to it. Tokens stay on your device and are sent only to the server that issued them.

Settings and preferences — Window layouts, terminal settings, and similar options are saved on your device via the standard user-defaults mechanism.

Pairing codes — An in-progress pairing code is kept temporarily on your device until pairing completes, then cleared.

Network traffic

Phosphor connects directly from your device to the BBS host and port you enter. Depending on your choice:

  • Telnet connections are unencrypted — this is the nature of the telnet protocol, and a fact of BBS history. Anything you type, including logins, travels in cleartext. Use telnet only where you accept that.
  • SSH connections are encrypted end-to-end between your device and the server, using standard SSH (via the Citadel library).

The app does not connect to any server other than the ones you have configured (and, out of the box, pre-fills one example profile pointing at our own BBS — you can delete it or keep it; either way, it only connects when you tell it to).

Push notifications

If you enable push notifications and pair your device with a BBS, that server sends notifications to your device through Apple’s Push Notification service (APNs). Push payloads for Phosphor are deliberately minimal — typically just enough to tell the app which screen to open (for example, “you have mail”), with no message content in the payload itself. Message content stays on the BBS until your app connects and fetches it.

Granting notification permission is optional and off until you enable it.

Camera

Phosphor’s camera is used for one thing: scanning the pairing QR codes shown by your server. Camera frames are processed on-device for QR detection and are never stored, transmitted, or analyzed anywhere else. The camera is used only when you’re on the pairing screen.

What we do not do

  • No analytics or telemetry SDKs — the app’s dependencies are an open-source terminal emulator, an SSH library, and SwiftNIO, none of which collect data.
  • No crash reporting — crash reports go to Apple’s standard mechanism only if you have opted in to sharing them with app developers in your device settings.
  • No third-party advertising or tracking SDKs.
  • No collection of location, contacts, photos, health, or financial data.
  • No reading of anything outside the app’s own storage, except the camera while pairing.

Children

Phosphor is not directed at children under 13 and does not knowingly collect personal information from anyone, of any age — there is nothing to collect.

Your control

You can delete everything at any time: remove a server profile in Settings and its Keychain token is removed with it; uninstall the app and all of its data is erased from your device. Push notification pairing ends when you unpair from your server or uninstall.

Changes to this policy

If the app’s data practices ever change, this page will be updated with a new effective date before the change ships.

Contact

Questions about this policy: [email protected]