Privacy Policy

Last updated: October 9, 2026

This policy explains what data the StackPilot mobile application (the “App”) uses, where it is kept and which third parties may access it. In short: the publisher collects no data through the App, which communicates directly with your Portainer instance.

1. Data controller

The data controller is Moutawakil Samir (Individual), , reachable at samir@altyxlab.fr.

The publisher operates no server for the App: it has access neither to your credentials nor to the data of your Portainer instances.

2. Data kept on your device

To sign you in, the App stores in the device’s secure keychain (Keychain on iOS, Keystore on Android):

• the address of your Portainer instance and the sign-in method chosen;
• your Portainer username, if you sign in with your credentials;
• your access token, or the session token obtained with your password. The password itself is never stored.

It also stores there the identifier of the last environment viewed on that instance, to reopen the App on its containers, as well as your settings, such as the chosen refresh interval.

The information read from your instance (environments, containers, stacks and their Compose files, images, volumes, logs) is displayed without being stored: it stays in memory while you use the App, and is cleared when you sign out or close the App.

This data only leaves the device to be sent directly to your Portainer instance.

3. Retention period

The token is deleted when you sign out, or automatically as soon as your instance rejects it. The instance address, sign-in method and username are kept after you sign out, to pre-fill the next sign-in; so is the identifier of the last environment viewed, to reopen the same environment.

On Android, uninstalling the App erases this information. On iOS, the system may keep it in the keychain after the App is uninstalled: it is then found again if you reinstall the App.

4. Notifications

Notifications are optional and only work with the monitoring service you deploy yourself on your infrastructure.

When you turn them on, the App requests a notification token from Expo’s service. Expo then receives the notification identifier Apple or Google assigned to the device, an installation identifier generated by the App and the App’s identifier. You then copy this token into your monitoring service’s configuration: the publisher does not receive it.

For each alert, your monitoring service sends Expo the token, the container name, the reason for the alert and the environment and container identifiers. Expo relays the alert to Apple Push Notification service (iOS) or Firebase Cloud Messaging (Android), which deliver it to the device.

To stop receiving alerts, remove the notification permission in the device settings, or remove the token from the monitoring service’s configuration.

5. Reporting a problem

The “Settings” screen lets you report a problem. The link opens GitHub’s issue form in your browser, with a pre-filled message containing the App’s version, its build number, the commit identifier, your device model and its system version.

No information about your Portainer instance is included: neither its address, nor your credentials, nor the names of your containers. Nothing is sent automatically: you review the message, complete it and decide whether to publish it. A GitHub issue is public, and its handling falls under GitHub’s privacy policy: https://docs.github.com/privacy.

6. Data shared by the stores

The App is distributed through the App Store and Google Play, whose use is governed by Apple’s and Google’s privacy policies.

Depending on your sharing settings, Apple and Google may provide the publisher with aggregated usage statistics and crash reports, which do not identify you.

If you take part in testing the App (TestFlight or a Google Play testing track), the publisher knows the email address used to invite you, and receives the feedback you choose to send: comments, screenshots, crash reports.

7. Contacting the publisher

If you write to samir@altyxlab.fr, the publisher uses your email address and the content of your message only to reply to you, on the basis of its legitimate interest in handling your requests. These exchanges are kept for at most three years after the last message.

8. Sharing and transfers

The publisher neither sells nor shares any data. The App contains neither analytics tools nor advertising.

A container’s logs only leave the App if you copy or share them yourself: sharing goes through the system share sheet, to the app you choose. These logs may contain sensitive information about your services; review them before passing them on.

The providers mentioned are established in particular in the United States: data passing through them may be processed outside the European Union, under the conditions set out in their policies:

• Expo: https://expo.dev/privacy
• Apple: https://www.apple.com/legal/privacy/
• Google: https://policies.google.com/privacy

9. Security

Credentials are encrypted by the system’s secure keychain and can only be read by the App.

The confidentiality of exchanges with your instance depends on its configuration: prefer an encrypted connection (HTTPS), and access tokens limited to the permissions needed.

10. Your rights

Under the General Data Protection Regulation (GDPR) and the French Data Protection Act (loi Informatique et Libertés), you have the rights of access, rectification, erasure, restriction, objection and portability over data concerning you.

Since sign-in data is only kept on your device, you control it directly, under the conditions described in the “Retention period” section.

For any other request, write to samir@altyxlab.fr. You may also lodge a complaint with the CNIL, the French data protection authority: https://www.cnil.fr.

11. Changes to this policy

The publisher may change this policy, in particular when the way the App works changes. The date of the last update appears at the top of the document. The current version is available in the App and at https://github.com/altyx/stackpilot/blob/main/docs/legal/privacy.md.