Privacy and security

Cloud Viewer reads your infrastructure and never changes it. That one rule shapes how it handles your tokens, your servers and your data, and it is why it is safe to leave on everywhere. The formal policy is the privacy policy.

Read-only by design

Cloud Viewer only reads from the Hetzner API. It never creates, changes or deletes anything in your projects. When something needs a change, Cloud Viewer points you to where you make it: Open in Hetzner Console on a resource, or a brief that you or your coding agent act on through your own process.

The portal will not store a token that can make changes. It tests a new token with one request that Hetzner rejects before anything is created, and asks for a read-only token if the test shows write access. The apps warn when a token can write (“Token works, but it can WRITE”). They still only read with it, but use a read-only token anyway: if a token ever leaks, a read-only one cannot be used to change your projects.

Your Hetzner token

• On the device. In free mode, and for every project you keep on the device, the token is stored in the iPhone keychain or encrypted with a key in the Android Keystore. It is never sent to Cloud Viewer.
• iCloud, if you turn it on. On iPhone, Sync projects via iCloud is off by default. When on, the tokens go to your iCloud Keychain, end-to-end encrypted by Apple, so your other devices can use them. They still never reach Cloud Viewer’s servers.
• Connected projects. When a project is connected to your team, its token is encrypted at rest on our servers and can never be viewed again after you save it. To change it, you replace it.
• Free account. A free account stores no Hetzner token at all.

The agent on your servers

The agent runs as unprivileged system users, not as root; you need root only to install it. It opens no inbound ports and only makes outgoing connections; the hosts it talks to are listed in the agent reference.

Settings from the portal reach your servers within a minute, without SSH access. The agent fetches a small set of declared parameters and builds its configuration locally from the template in its package. No executable code is sent this way. Even if Cloud Viewer’s servers were compromised, an attacker could only change these documented settings, not run code on your servers.

Log lines are masked on your server before they are sent: obvious secrets such as passwords, tokens, keys, authorization headers and private keys are replaced with [REDACTED]. Our servers mask them again when they arrive, in case a server still runs an older configuration.

Each server has its own agent token, which an administrator can rotate or revoke in the portal.

Briefs and checks

Shared briefs never contain credentials. To leave IP addresses out as well, turn off Settings → Privacy → Include IPs in shared briefs (on Android: Include IP addresses in shared briefs).

Uptime checks never send credentials either. The check form refuses an address that contains them.

Where your data is

Cloud Viewer’s servers are in the EU. Free mode does not reach them: the app talks only to the Hetzner API. A free account stores your account and your uptime checks with their results, but no Hetzner token and no inventory.

Push alerts on iPhone go through Apple’s push service, which carries the alert’s title and text. On Android, Google’s Firebase carries only identifiers, no alert text.

Your account

Your profile in the portal has Two-Factor Auth. It needs a verified email address first. Once it is on, signing in asks for the 6-digit code from your authenticator app, or one of your 8-digit recovery codes. The same page has API Keys: New API Key creates one, Revoke ends it.

The apps can lock themselves: Settings → Security → Require Face ID / passcode on iPhone, Require unlock to open on Android.

Crash reports come only from the iPhone app and contain no account or device identity. You can turn them off in Settings → Privacy → Share crash reports. The Android app and the web app send none.

Account deletion removes your data. Delete your account in the iPhone app (Settings → Delete Account), in the Android app (Settings → Delete account) or on the web at account.cloudviewer.app/users/profile/delete/. A team you were the last member of is deleted with it, and that team’s subscription is cancelled at once. A team that still has other members keeps its subscription.

This website

This website counts visits with cookieless, self-hosted analytics (Umami): no cookies, no IP addresses stored, no personal data, and nothing at all if your browser sends Do Not Track. The apps and the portal have no analytics.