Privacy and security

Vaicoa reads your infrastructure and never changes it. That one rule shapes how it handles your tokens, your servers and your data, and it is why it is safe to leave on everywhere. The formal policy is the app’s privacy policy.

Read-only by design

Vaicoa only reads from the Hetzner API. It never creates, changes or deletes anything in your projects. When something needs a change, Vaicoa points you to where you make it: Open in Hetzner Console on a resource, or a brief that you or your coding agent act on through your own process.

The portal will not store a token that can make changes. It tests a new token with one request that Hetzner rejects before anything is created, and asks for a read-only token if the test shows write access. The app warns when a token can write (“Token works, but it can WRITE”). It still only reads with it, but use a read-only token anyway: if a token ever leaks, a read-only one cannot be used to change your projects.

Your Hetzner token

• On the device. In free mode, and for every project you keep on the device, the token is stored in the iPhone’s Keychain. The app sends it only to Hetzner’s API, api.hetzner.cloud, or to the API endpoint you chose under Advanced when you added the project. It is never sent to Vaicoa.
• iCloud, if you turn it on. Sync projects via iCloud is off by default. When on, the tokens go to your iCloud Keychain, end-to-end encrypted by Apple, and the project names and API addresses to your iCloud account, so your other devices can use them. They still never reach Vaicoa’s servers.
• Connected projects. When a project is connected to your team, its token is encrypted at rest on Vaicoa’s servers and can never be viewed again after you save it. To change it, you replace it.
• Free account. A free account stores no Hetzner token at all.

Free mode: what leaves your iPhone

Without an account, the app reads your projects from Hetzner’s API and Hetzner’s public status feed (status.hetzner.com, no token). From Vaicoa’s servers (api.vaicoa.com) it fetches a public app configuration, such as announcements, without signing in. It sends Vaicoa no token, no project data and no account.

Crash reports go to Vaicoa’s servers and contain no account or device identity. Turn them off in Settings → Privacy → Share crash reports.

The agent on your servers

The Vaicoa agent runs as unprivileged system users, not as root; you need root only to install it. It opens no inbound ports and only makes outgoing connections; the hosts it talks to are listed in the agent reference.

Settings from the portal reach your servers within a minute, without SSH access. The agent fetches a small set of declared parameters and builds its configuration locally from the template in its package. No executable code is sent this way. Even if Vaicoa’s servers were compromised, an attacker could only change these documented settings, not run code on your servers.

Log lines are masked on your server before they are sent: obvious secrets such as passwords, tokens, keys, authorization headers and private keys are replaced with [REDACTED]. Vaicoa’s servers mask them again when they arrive, in case a server still runs an older configuration.

Each server has its own agent token, which an administrator can rotate or revoke in the portal.

Briefs and checks

Shared briefs never contain credentials. To leave IP addresses out as well, turn off Settings → Privacy → Include IPs in shared briefs.

Uptime checks never send credentials either. The check form refuses an address that contains them.

Where your data is

Vaicoa’s servers are in the EU. A free account stores your account and your uptime checks with their results, but no Hetzner token and no inventory. On Pro and Team, connected projects, metrics, log lines, job reports and alert history are stored there too.

Push alerts go through Apple’s push service, which carries the alert’s title and text. Purchases of Pro and Team go through Apple.

Your account

Your profile in the portal at account.vaicoa.com has Two-Factor Auth. It needs a verified email address first. Once it is on, signing in asks for the 6-digit code from your authenticator app, or one of your 8-digit recovery codes. The same page has API Keys: New API Key creates one, Revoke ends it.

The app can lock itself: Settings → Security → Require Face ID / passcode.

Account deletion removes your data. Delete your account in the app (Settings → Delete Account) or on the web at account.vaicoa.com/users/profile/delete/. A team you were the last member of is deleted with it. A subscription bought in the app is billed by Apple: cancel it in your Apple Account’s subscription settings. A team that still has other members keeps its subscription.

This website

The privacy policy of mitjamartini.com covers this website.