Ostgate

Privacy Policy

Last updated 22 October 2026

Ostgate is a native macOS application that connects you to your own Google Compute Engine instances through Google's Identity-Aware Proxy. This policy explains what data the application touches, where it is kept, and what we, the developers of Ostgate, can and cannot see.

The short version: Ostgate runs on your Mac and talks directly to Google's APIs using your own Google account. None of your Google data or traffic passes through us, we receive no copy of it, and the app collects no analytics or telemetry. The one server of ours the app contacts is a licence server, which sees only what it needs to run the trial and licence keys (see Data we receive).

Who this policy is from

Ostgate is a trading name of Edhar Sporan, a sole proprietor registered in Poland as Ostgate Edhar Sporan (NIP 8993021594). That business is the controller of the data described in this policy (see About). Questions about this policy can be sent to support@ostgate.app.

Google user data the application accesses

When you sign in, Ostgate asks Google for three OAuth scopes. Google shows you these on its own consent screen before anything is granted. Each is used as follows.

openid

Identifies which Google account completed the sign-in. Ostgate uses this to keep multiple signed-in accounts apart as separate profiles. No profile information beyond the account identifier is requested.

email

Reads the email address of the signed-in account. It is used for two things: to determine your SSH username when opening a session to an instance (the OS Login username, or a username derived from the address when your key is published through instance metadata), and to identify the account: its domain becomes the account's default name, which you can change, and the address itself is shown where the account's identity matters, such as the Accounts sheet.

https://www.googleapis.com/auth/cloud-platform

Authorises the Google Cloud API calls Ostgate makes on your behalf. These are all of them, by Google API, with the action of yours that triggers each:

  • Compute Engine (compute.googleapis.com): instances.aggregatedList to list the instances in a project you browse; instances.start and instances.stop when you start or stop an instance, then zoneOperations.get and instances.get to follow the operation; instances.get and projects.get when you open an SSH session, to read the instance's and the project's metadata and determine whether OS Login applies; instances.setMetadata to publish your SSH public key in the instance's metadata where OS Login does not apply (such keys expire after 24 hours); instances.getGuestAttributes to read the SSH host keys an instance publishes, in order to verify that you are connected to that instance; instances.get when a connection fails, to tell whether the instance is stopped or still starting; instances.getSerialPortOutput when you open an instance in the serial output tab; instances.get and projects.get when you open an instance's SSH Keys tab, to list the SSH keys in the instance's and the project's metadata, and, when you delete one of them there, instances.setMetadata or projects.setCommonInstanceMetadata to write the metadata back without that one key, then zoneOperations.get or globalOperations.get to follow the change; and, for Windows instances, instances.setMetadata to write windows-keys metadata and instances.getSerialPortOutput to read the reply, which is the mechanism Google documents for establishing an RDP session password; forwardingRules.aggregatedList in a project you browse that has a Cloud SQL instance on Private Service Connect, and in the consumer projects that instance allows, to find its endpoint;
  • OS Login (oslogin.googleapis.com): users.getLoginProfile to read your OS Login username and users.importSshPublicKey to publish your SSH public key, when you open an SSH session to an instance where OS Login applies. Keys published this way expire after one hour. On an instance that requires OS Login certificates, projects.locations.signSshPublicKey signs your SSH public key for that instance, with its ID and service account, in place of the import; the certificate is valid for five minutes and Ostgate keeps it in memory only. When your account has no POSIX account in that project yet, users.projects.provisionPosixAccount creates it first. users.getLoginProfile also lists your OS Login keys when you open an instance's SSH Keys tab, and users.sshPublicKeys.delete removes the one key you confirm deleting there;
  • Resource Manager (cloudresourcemanager.googleapis.com): projects.search to list the Google Cloud projects your account already has access to, when you browse or search projects;
  • Cloud SQL Admin (sqladmin.googleapis.com): instances.list to show the Cloud SQL instances in a project you browse, with their engine and version, region, state, IP addresses and tier;
  • Cloud Run Admin (run.googleapis.com): services.list to show the Cloud Run services and 2nd-gen Cloud Functions in a project you browse, with their region, URL, ingress, status and last deployment, and services.getIamPolicy to show whether anyone may invoke each one (public) or only IAM-authorised callers;
  • Cloud Logging (logging.googleapis.com): entries.list when you open a VM's Event log, to read that VM's Cloud Audit Logs entries of the last 7 days (starts, stops, metadata changes and system events, with who made each change). They are shown in the tab and not stored;
  • Secret Manager (secretmanager.googleapis.com): only when you use Connect As with a key kept in Secret Manager, or set a connection's SSH password, SSH key or Windows password to come from Secret Manager. secrets.list and versions.list list the secrets and versions in a project you choose, and versions:access reads the one secret version you select when the connection starts. It is used as that connection's private key or password;
  • IAP TCP forwarding (tunnel.cloudproxy.app): the /v4/connect and /v4/reconnect relay, which opens an Identity-Aware Proxy tunnel to an instance you select, for every SSH, file browser and RDP session and every tunnel you start in the Tunnels manager;
  • OpenID Connect userinfo (openidconnect.googleapis.com): /v1/userinfo at sign-in, and once later if the address was not stored, to read your email address. This call relies on the openid and email scopes above, not on cloud-platform.

Why cloud-platform. Secret Manager accepts only this scope: Google offers no narrower one for reading a secret. The IAP TCP forwarding relay publishes no narrower scope either, and Google's own command-line tool uses cloud-platform for its tunnels. Every other API above also accepts cloud-platform, so this one scope covers them all. Ostgate never requests a scope it does not use.

Every one of these calls is made directly from your Mac to Google, authorised by your own credentials, and is subject to your existing IAM permissions. Ostgate cannot reach anything your Google account could not already reach.

Where your credentials are stored

The OAuth refresh token issued to your account is stored in the macOS Keychain on your own computer, in an entry namespaced to that profile. It is not written to preference files, ordinary files on disk, or logs, and it is not transmitted anywhere other than to Google's token endpoint when a new access token is needed.

SSH private key material generated by Ostgate is created in the Secure Enclave where the hardware supports it, which means the private key cannot be exported by any process, including Ostgate itself. Where the Secure Enclave is not used, key material is held in the Keychain under the same per-profile namespace.

A Windows password you choose to save for RDP, and an SSH password you choose to save for a VM that logs in with one, are stored in the Keychain under the same per-profile namespace, never in preferences or files. An SSH password you type without saving it is held in memory for that session only. A password or key you set to come from Secret Manager is never stored by Ostgate: only the secret's name is kept in the connection settings, and the value is read from Google when a connection starts and held in memory for that connection only.

A private key you supply yourself for Connect As, whether from a file or from Secret Manager, is read when the connection starts and held in memory only. Ostgate does not store it, its passphrase, or the file's location.

Ostgate does not ask for, read or store database credentials. A Cloud SQL tunnel only carries the connection your own database client makes, and you sign in to the database in that client.

A Cloud Run proxy only forwards the requests your own browser or client sends to your service, and the service's answers back. It rewrites the request headers it needs to reach that one service, passes everything else through unchanged, and does not read or store response bodies. Ostgate adds no token or other credential of its own to those requests.

Other data kept on your Mac

To remember how you work, Ostgate keeps a small amount of non-secret data in its preferences on your Mac: the accounts you have added, their email addresses and the names you give them, the projects you have added, favourite and recently opened instances, saved tunnels and port forwards with their access level and, for a Cloud SQL tunnel, its engine preset, saved Cloud Run proxies with the service host they reach, the local port each tunnel, Cloud SQL tunnel and Cloud Run proxy last used, the VM each account last used as the bastion for a Cloud SQL tunnel or a Cloud Run proxy, your connection settings (SSH and Windows usernames, Windows domain, ports, SSH authentication method and private key file path, RDP colour depth, Network Level Authentication and connect timeout, automatic logon), the username and port you last used with Connect As, and the SSH host keys you accepted on first connection. None of it leaves your Mac.

The last reading of whether each Cloud Run service is public is kept in memory only, so a refresh need not read an unchanged service's IAM policy again, and is gone when Ostgate quits.

Some features change files outside the app, and only when you ask them to: the SSH integration adds one block to your ~/.ssh/config, and the Hosts tool and host-name aliases for forwards edit /etc/hosts. Edits in the Hosts tool always need an administrator's approval in a macOS prompt. A forward on a port below 1024 uses the Ostgate port helper, which runs as root once you allow it in System Settings › General › Login Items & Extensions. It adds loopback addresses from 127.0.0.2 to 127.0.0.254 to your Mac. While it is installed and your macOS user is an administrator, it also writes Ostgate's own /etc/hosts blocks for forward aliases without that prompt; it never changes other lines. Without the helper, and for names such as googleapis.com or apple.com, forward aliases go through the same prompt. Ostgate removes the addresses and blocks when the forward stops, when you quit, or at the next launch after a crash.

Data we receive

Only what the licence check needs. To run the 7-day trial and licence keys, the application contacts our licence server when it starts and every few hours, and sends:

  • a hardware hash: a SHA-256 hash of your Mac's hardware identifier, so a trial or a key is counted once per Mac. The identifier itself is not sent and cannot be recovered from the hash;
  • the public half of a device key created in your Mac's Secure Enclave, which signs each request. The private half never leaves the Secure Enclave;
  • the licence key you entered, if any.

The server stores the hardware hash, the device public key, when the trial started, which Mac a key is activated on, the name the key was issued to, the key's end date if it has one, and when each was last seen. There is no account to register with us, no analytics SDK, no crash reporting service and no usage tracking. We do not receive your Google account, your project names, your instance names or your session contents, and we receive your email address only if you buy a licence (see Purchases).

The licence server runs on Cloudflare Workers. Like any hosting provider, Cloudflare processes your IP address and request details to deliver the requests and may keep short-lived request logs; the licence server itself does not store your IP address.

This website is a set of static pages. It sets no cookies, runs no analytics script and loads no external fonts.

The site counts page views on its own server. Each page it serves adds one record with the date, the page's address without its query string, the kind of device, the domain of the site whose link brought you here (such as www.google.com), and the country Cloudflare places the request in. The kind of device is one of Mac, Windows, Linux, iPhone or iPad, Android, crawler or other, worked out from your browser's User-Agent header, which is not kept. If the link carried a utm_source tag, the record keeps that tag too. It stores no IP address, no full referring address and no cookie, so a page view cannot be traced to a person.

The site counts downloads. A Download link goes to ostgate.app/download, which adds one to a count and sends you on to the disk image on GitHub. The count stores the date, the Ostgate version, the kind of device, and the page of this site the link was on, or only that the link was followed from elsewhere. It stores no IP address, User-Agent or cookie, so a count cannot be traced to a person. GitHub then serves the file under its own privacy statement.

The site is delivered through Cloudflare, which, like any hosting provider, processes your IP address and request details to serve the pages and protect them from abuse. That processing is Cloudflare's, under its own privacy policy; none of it reaches us as analytics.

Purchases

Licences are sold by Paddle.com, our reseller and Merchant of Record. Paddle collects your payment details, billing address and tax details under its own privacy notice. Card and bank details never reach us.

When you buy, Paddle notifies our licence server of the subscription: its ID, plan, number of users, billing period and status. To issue your key, the licence server reads your email address, your name and, for a business purchase, the company name from Paddle, and emails the key to you through Cloudflare's email service. It stores the subscription ID, a hash of the key and the name the key is issued to: the company name, else your name, else your email address. Your email address is used to send the key and is not stored otherwise. This processing is needed to perform the purchase (Article 6(1)(b) GDPR). The key record is kept while the licence exists; write to us to have it deleted after it ends.

Retention and deletion

Credentials persist on your Mac until you remove them. You can do so in any of these ways, and each is sufficient on its own:

  • remove the profile inside Ostgate (Remove from This App), which deletes that profile's refresh token, SSH key, saved Windows passwords and saved SSH passwords from the Keychain, together with the host keys it trusted and its settings (favorites, tunnels, pinned projects and connection settings);
  • delete the entries directly using the macOS Keychain Access application;
  • revoke Ostgate's access from your Google Account's third-party access page, which invalidates the refresh token at Google regardless of what remains on disk.

We hold no copy of your credentials or Google data, so there is nothing of that kind to delete on our side. The licence records described above are kept while the licence service runs; to have them deleted, write to us (see Contact) with your licence key, or, for a trial without a key, the date it started.

How your data is protected

  • Every connection the application makes, to Google's APIs, to the Identity-Aware Proxy relay and to our licence server, is encrypted with TLS.
  • OAuth refresh tokens, saved passwords and SSH key material are kept in the macOS Keychain, and SSH private keys in the Secure Enclave where the Mac supports it; none of them is written to files or logs.
  • Tunnels listen on your Mac's loopback addresses only, and every connection to them is checked against the tunnel's access setting: Ostgate itself by default, or apps running as your macOS user for database and web tunnels, unless you choose otherwise.
  • No Google user data is sent to or stored on any server of ours, so there is no copy of it that could be exposed on our side.

The security overview describes the same protections for a security review: data flow, keys, local listeners, hosts to allow and signing.

Limited Use

Ostgate's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

No data obtained from Google APIs ever reaches a server of ours (the licence server receives none of it). Data obtained from Google APIs:

  • is used only to provide the user-facing features described in this policy, in the application on your Mac;
  • is not transferred to any third party, except to Google itself when the application calls Google's APIs on your behalf;
  • is not used for, or transferred for, serving advertisements, including personalised, retargeted or interest-based advertising;
  • is not sold, and is not transferred to data brokers or information resellers;
  • is not used to determine credit-worthiness or for lending purposes;
  • is not used to develop, improve or train artificial intelligence or machine learning models, generalised or otherwise;
  • is not read by humans. It stays on your Mac, where only you see it.

Children

Ostgate is a professional infrastructure tool and is not directed at children. We do not knowingly collect information from anyone, of any age.

Your rights

Under the GDPR you can ask for access to the data we hold about you, its correction or deletion, restriction of its processing, a copy in a portable format, and you can object to its processing. Write to support@ostgate.app. You can also lodge a complaint with a data protection authority; in Poland, that is the President of the Personal Data Protection Office (UODO).

Changes to this policy

If this policy changes, the revised version will be published at this address with a new date at the top. Material changes, in particular any change to the scopes requested or to the claim that no data reaches us, will be reflected here before the corresponding release ships, and noted in the release notes of that release.

Contact

Write to support@ostgate.app.