Privacy Policy
In short:
Guest mode sends nothing to us unless you turn on update checks. If you sign in with Google, we store your Google account ID, email and name, and for each signed-in device its name and last IP address, so you can spot sign-ins that aren't yours. Synced data is encrypted on your device, so we can't read it. The AI assistant only sends what you ask, with secrets removed on your device first, and we don't store your requests. The website has no cookies and no tracking. You can delete your account at any time.
1. Who is responsible
The controller for your personal data is ezzio.nl, based in the Netherlands. For anything about privacy, email privacy@ezzio.nl.
2. Visiting this website
The website uses no cookies, no analytics, no trackers, and loads nothing from other domains (no external fonts, scripts or embeds). Like any web server, ours writes a technical log entry for each request: IP address, date and time, requested path, response code, referring page and browser user agent.
Why: to run the website and the Mist server securely, detect abuse and fix errors.
Legal basis: our legitimate interest in keeping the service secure and working (Art. 6(1)(f) GDPR).
How long: 14 days, then deleted automatically.
3. Guest mode
In guest mode, Mist sends nothing to our server, except update checks if you turn them on yourself or click “Check for updates” (see section 7). Your hosts, usernames, passwords, keys and settings stay on your device. SSH and SFTP connections go directly from your device to the servers you choose; we are not involved and see nothing of them.
4. Google account
Signing in is optional. When you sign in, Google confirms your identity to Mist. We store:
- your Google account ID, email address and name;
- the date you signed up, your last activity time, your Mist version and operating system (for example “windows”), and a random account identifier;
- for each signed-in device, a session: a one-way SHA-256 hash of the session token (never the token itself), the computer name, operating system, Mist version, sign-in and last activity time, and the last IP address the app connected from.
Devices and sessions. For every sign-in to Mist (session) the server stores the computer name, operating system, Mist version, sign-in and last activity time, and the last IP address the app connected from. Only you can see this data — in Settings → “My devices” — so you can spot a sign-in that wasn't yours and end it. Mist on your other devices notifies you about a new sign-in. Session data is deleted together with the session: when you sign out (on this device, on another one from “My devices”, or “everywhere”), delete your account, or after 180 days without activity. Legal basis: legitimate interest (the security of your account), Art. 6(1)(f).
We do not store your profile photo, and we keep no IP addresses other than the last one per active session (above) and the web server log (section 2). We request only the basic openid, email and profile scopes.
If you are signed in but don't use sync, the only things the app sends are your sign-in, an activity signal about once every 6 hours, which we use to count active users, and update checks (section 7).
Why and legal basis: to create and run your account and keep you signed in — performance of a contract (Art. 6(1)(b)). Last activity, Mist version and operating system are also used to count users and decide which versions and platforms to support — legitimate interest (Art. 6(1)(f)).
5. Sync (end-to-end encrypted)
Sync is optional. When you turn it on, Mist encrypts your data on your device with a key protected by your master password. Your master password and recovery key are never sent to us. We store:
- the vault: Argon2id parameters, a salt and your vault keys in encrypted form;
- the records: a random ID, version, counter, size, last-change time and the encrypted content (XChaCha20-Poly1305).
We cannot see or decrypt the addresses or names of your hosts, usernames, passwords, keys, groups, snippets, tunnels, notes, variables, workspaces or settings. This also means we cannot recover your data if you lose both your master password and your recovery key. When you delete a record, a “tombstone” without content remains so your other devices learn about the deletion; tombstones are removed after 90 days.
Legal basis: performance of a contract (Art. 6(1)(b)).
Team vaults
If you create a team or accept an invitation, the server stores: the email addresses of members and invitees, who invited whom, the role (owner, admin, member or connect-only), dates, and your member key pair — the public key, and the private key only in encrypted form. All team content — hosts, passwords, keys, snippets, tunnels and even the team name — is encrypted on members' devices; the server cannot read it. An invitee's email is kept until they accept or decline or the invitation is cancelled. If team access is temporary, the server also stores the date and time it ends; once it has passed, the member's record is deleted the same way as after removal. A team can have several owners; any of them can delete the team, which removes all its data. For 90 days the server shows former members who had accepted the invitation when the team was deleted and the email of the owner who deleted it (the owner who deletes it is told so) — so they know what happened to the team; after that this record is deleted. If you delete your account: teams that have other owners stay with them; teams where you are the only owner and no one else is left are deleted; where you are the only owner and there are members, you choose for each team — hand ownership over to one of the members or delete the team; you are removed from all other teams.
Legal basis: performance of a contract (providing a feature you enabled).
Subscriptions (Mist Team and Enterprise)
If you pay for teams (Mist Team) or manage an organization's subscription, the server stores: the plan, the number of seats, the validity period, who manages the subscription (your account) and a log of subscription changes (what was changed and when: seats, period, managers) — for one year. Members of this subscription's teams see the manager's email — the person who can renew the subscription or add seats. A seat is taken by every person in the subscription's teams, including invited ones (by their email). When plans were launched, every account that existed at that time received Mist Team until 2030-01-01. If you delete your account, your personal subscription without teams is deleted; a subscription that still pays for teams handed over to other people stays without a manager for as long as it has teams. Legal basis: performance of contract.
License managers of an organization (Enterprise)
A license manager sees who takes seats of the organization's subscription: the email and the name from the Google account, since when, which of the organization's teams the person is in (including invited) and with which role, and whether the seat was granted manually. The manager does not see the teams' content (hosts, passwords, keys, logs) unless they were invited to the team themselves — it is encrypted on the members' devices. The manager can grant a seat to an email (Mist Pro without a team), take it back and “free a seat” — the person is then removed from all of the organization's teams; where they were the only owner, another member with permanent access becomes the owner, and if there is none, the team is deleted. The organization's activity log (who granted or freed a seat and when, added or removed a manager, created or deleted a team, changed the seats or the period) is visible to managers and kept for one year. Legal basis: performance of the contract with the organization and the organization's legitimate interest in managing its employees' access.
Team activity log
For each team the server keeps an activity log: who (email), when and from which IP address invited or removed a member, changed a role or access period, renamed the team or changed its key; who added, changed or deleted a team item; who connected to a team server and who revealed or pasted a team host's saved password (connections and passwords are reported by the member's Mist app). The item name, the list of changed fields, the host name and the connection method are encrypted with the team key by the app — the server cannot see them; passwords and values are never in the log; what was done in the terminal and which files were transferred is not recorded. Only the team owner and admins can see the log; nobody can edit or delete individual entries. Events are kept for 12 months and deleted together with the team. If you delete your account, your email and IP addresses stay in the logs of teams you were a member of until that period ends, so the team knows who made changes and connected to its servers (the team's legitimate interest in security).
Cloud session logs (Mist Pro, off by default)
If you turn on “Save logs in the cloud”, Mist uploads a session's log — the text output of the terminal — to the Mist server after the session ends. Before writing to disk Mist replaces saved passwords, tokens and keys in the log with “‹secret›”; keystrokes are not recorded. The log and its details (host, time, who connected and from where: account, computer name, IP addresses) are encrypted on your device — personal logs with your vault key, team logs with the team key; the server cannot read them. The server sees only the size, upload date, author (Mist account) and team. Only you see your personal logs; logs of team hosts are visible to the author, the team owner and admins (the owner can open them to all members). Logs are kept for 90 days (up to 2 GB per account) and then deleted automatically. A log can be deleted by its author (personal) or by a team owner or admin (team); deleting your vault deletes your personal logs, deleting a team deletes its logs. If you delete your account, your personal logs and the logs of your teams are deleted immediately, while logs you recorded on other teams' servers stay with those teams (with your email as the author) until the end of the 90 days or until the team owner or an admin deletes them — so the team knows what was done on its servers (the team's legitimate interest in security). Legal basis: performance of contract (a subscription feature you enabled).
6. AI assistant (Mist Pro)
The AI assistant is available only when you are signed in with Google and have an active Mist Pro subscription. Mist Pro is currently invite-only (early access); there is no payment on the website yet. Before your first use, the app explains what is sent and asks for your consent.
What is sent — only when you send a request
- the text of your request;
- context about the current session: the remote server's OS and version, the shell, the current directory, and which common programs are available (for example docker, systemctl, apt);
- terminal output only if you choose to include it: the lines you select yourself, or — when you click Fix — the last command you ran and its output.
What is removed on your device before sending
All passwords and passphrases saved in Mist (exact matches), and anything that looks like a secret: private keys, AWS/GitHub/Slack/GitLab/Anthropic/OpenAI tokens, JWTs, values after password=, --password and similar. Removed secrets are put back only on your device.
What is never sent
Your host list, server addresses and names from your Mist settings, the contents of key files, and your vault data. Your Google account data is never sent to the AI provider.
Where it goes
Your device → the Mist server (Hetzner, EU) → our AI provider, Anthropic PBC (United States). The Mist server does not store the text of requests or answers. It keeps only daily counters per account (number of requests and number of tokens), needed for usage limits and accounting.
Anthropic processes requests as our processor under its Commercial Terms and Data Processing Addendum. Under those terms Anthropic does not use this data to train its models, and deletes API inputs and outputs within 30 days, except where it must keep them longer to enforce its Usage Policy (up to 2 years for content flagged as violating it) or to comply with the law. See Anthropic's Commercial Terms and its retention information. The transfer to the United States is covered by the European Commission's Standard Contractual Clauses (2021) included in Anthropic's Data Processing Addendum.
Commands suggested by the AI are never run automatically: you review them and press Enter yourself. The AI can be wrong. Mist marks dangerous-looking commands, but you are responsible for what you run.
Legal basis: performance of a contract (Art. 6(1)(b)) — the AI assistant is part of Mist Pro and runs only when you use it. You can stop at any time by simply not using it.
7. Update checks
The Mist app for Windows checks for new versions by requesting https://mist.ezzio.nl/updates/latest.json: about 15 seconds after start, then every 6 hours, and whenever you click “Check for updates”.
- If you are signed in with Google, automatic update checks are on by default.
- In guest mode, automatic update checks are off by default. You can turn them on in Settings → About; otherwise Mist checks only when you click “Check for updates”.
The request contains no account data. Our server sees the same as for any website visitor: your IP address, the user agent (which includes the Mist version) and the time. This is the ordinary web server log described in section 2, kept for 14 days.
An update is installed only after you click “Update”. The app verifies the update's signature before installing it.
Legal basis: our legitimate interest in delivering security fixes and other updates (Art. 6(1)(f)).
8. Data that stays on your device
- Passwords and passphrases are stored in Windows Credential Manager; private keys are files on your disk.
- The PIN lock settings and the PIN hash (Argon2id) stay on that computer and are never synced.
- If you turn on session logs, terminal output is recorded on that computer, together with who connected: your Mist account, the computer and user name, IP addresses (yours and the one the server sees) and the login on the server. Saved passwords, tokens and private keys are replaced with “‹secret›” before anything is written. Logs stay only on that computer unless you turn on cloud session logs (section 5). They can contain anything shown in the terminal, so treat them like the servers they come from.
- Mist itself connects only to
mist.ezzio.nl(sign-in, sync, teams, AI, update checks) and to Google (sign-in). There is no telemetry and no analytics. Links in the terminal open in your browser only on Ctrl+click, and only for http/https. - Other connections are made directly from your PC and only as part of what you use: to your own servers (SSH, SFTP, Telnet, tunnels — and, for hosts in your list, a short check of the SSH or Telnet port every 5 minutes to show whether they are reachable); and, only when you import servers from a cloud, to that provider's API (Hetzner Cloud, DigitalOcean, AWS, Google Cloud or Azure) with the token or access key you enter. Mist uses that token only for the request and doesn't store it; nothing from it passes through our server. Proxy commands for a host's route (for example Cloudflare Tunnel, AWS SSM or Google IAP) run on your PC.
- Backup to a file creates a file on your PC encrypted with your passphrase (standard age format). It doesn't go through our server, and team data isn't included.
9. Who else is involved
- Hetzner Online GmbH (Germany) — hosting. Our server is in Hetzner's data centre in Helsinki, Finland (EU). Processor.
- Google — sign-in. You interact with Google directly, under Google's privacy policy. Our server verifies the sign-in with Google's public keys and sends no data back to Google.
- Anthropic PBC (United States) — AI assistant, only for Mist Pro users who use it. Processor; see section 6.
We do not sell or rent your personal data, do not use it for advertising, and do not make automated decisions about you with legal or similarly significant effects.
10. How long we keep data
| Data | Kept |
|---|---|
| Account (Google ID, email, name, dates, Mist version, OS, account ID) | As long as the account exists |
| Sessions (token hash, computer name, OS, Mist version, times, last IP address) | Until you sign out (here, from “My devices” or everywhere) or delete your account; sessions inactive for 180 days are deleted |
| Sync vault (encrypted keys, Argon2id parameters, salt) | As long as the vault or account exists |
| Sync records (encrypted) | As long as they exist; tombstones of deleted records 90 days |
| Team vaults: members' emails, roles, who invited whom, dates, member keys, encrypted team content | As long as the team exists; your membership until it ends or you delete your account |
| Cloud session logs (encrypted; server sees size, date, author, team) | 90 days, then deleted automatically; earlier if deleted by you or the team. Deleting your account deletes your personal logs and your teams' logs at once; logs you recorded on other teams' servers stay with those teams for the rest of the 90 days |
| Team activity log (who did what, when and from which IP address; item and host names encrypted) | 12 months, or until the team is deleted. Your email and IP addresses stay in it for that period even after you delete your account |
| Temporary team access (end date and time) | Until the access ends; then the member's record is deleted |
| Deleted-team notice for former members (team ID, email of the owner who deleted it, reason, time) | 90 days, then deleted automatically |
| Team invitations (invitee's email) | Until the invitation is accepted, declined or cancelled |
| Mist Pro subscription (plan, end date) | As long as the account exists |
| Mist Team / Enterprise subscription (plan, seats, period, manager) | As long as the subscription exists; deleted with your account if it has no teams |
| Subscription change log; organization activity log (Enterprise) | One year |
| AI usage counters (requests and tokens per day) | As long as the account exists |
| AI request and answer text | Not stored by Mist; at Anthropic see section 6 |
| Database backups (copy of all of the above) | 30 days |
| Server service log (internal numeric user ID on sign-in and account deletion; errors without request content) | Rolling, size-limited; currently about 10 weeks |
| Web server log (IP, time, path, user agent), including website visits and update checks | 14 days |
11. Google user data
Mist's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Data we receive from Google (your account ID, email address and name) is used only to sign you in and run your Mist account. It is not sold, not used for advertising, not transferred to third parties, and not sent to the AI provider.
12. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you;
- rectification of incorrect data;
- erasure — see Delete account;
- restriction of processing;
- data portability — receive your data in a machine-readable format (JSON);
- object to processing based on legitimate interest;
- withdraw consent for the AI assistant — simply stop using it.
To use these rights, email privacy@ezzio.nl from the email address of your Mist account. We reply within one month. If we need to confirm that the request comes from you, we will ask.
You can also lodge a complaint with the Dutch data protection authority, the Autoriteit Persoonsgegevens, or with the authority in your own EU country.
13. Children
Mist accounts are not intended for anyone under 16. We do not knowingly collect data from children under 16; if you believe a child has created an account, contact us and we will delete it.
14. Changes
If we change how we process personal data, we update this page before the change takes effect and change the date below.
Last updated: October 22, 2026