Privacy Policy

Last updated 22 September 2026

Ostgate is a native macOS application that connects you to your own Google Compute Engine instances through Google's Identity-Aware Proxy. This policy explains what data the application touches, where it is kept, and what we, the developers of Ostgate, can and cannot see.

The short version: Ostgate has no server. It runs on your Mac and talks directly to Google's APIs using your own Google account. We operate no backend that your data passes through, we receive no copy of it, and we collect no analytics or telemetry.

Who this policy is from

Ostgate is published by the Ostgate team. Questions about this policy can be sent to privacy@ostgate.app.

Google user data the application accesses

When you sign in, Ostgate asks Google for three OAuth scopes. Google shows you these on its own consent screen before anything is granted. Each is used as follows.

openid

Identifies which Google account completed the sign-in. Ostgate uses this to keep multiple signed-in accounts apart as separate profiles. No profile information beyond the account identifier is requested.

email

Reads the email address of the signed-in account. It is used for two things: as the OS Login username when opening an SSH session to an instance, and as the label shown in the application's account list so you can tell profiles apart.

https://www.googleapis.com/auth/cloud-platform

Authorises the Google Cloud API calls Ostgate makes on your behalf. Specifically it is used to:

• list the Google Cloud projects, zones and Compute Engine instances your account already has access to, and read their configuration in order to display them;
• open Identity-Aware Proxy TCP forwarding tunnels to an instance you select;
• publish your SSH public key, through OS Login where the project uses it, or through instance metadata where it does not;
• for Windows instances, write windows-keys instance metadata and read serial-port output, which is the mechanism Google documents for establishing an RDP session password.

Every one of these calls is made directly from your Mac to Google, authorised by your own credentials, and is subject to your existing IAM permissions. Ostgate cannot reach anything your Google account could not already reach.

Where your credentials are stored

The OAuth refresh token issued to your account is stored in the macOS Keychain on your own computer, in an entry namespaced to that profile. It is not written to preference files, ordinary files on disk, or logs, and it is not transmitted anywhere other than to Google's token endpoint when a new access token is needed.

SSH private key material generated by Ostgate is created in the Secure Enclave where the hardware supports it, which means the private key cannot be exported by any process, including Ostgate itself. Where the Secure Enclave is not used, key material is held in the Keychain under the same per-profile namespace.

Data we receive

None. There is no Ostgate server, no account to register with us, no analytics SDK, no crash reporting service and no usage tracking. We do not receive your email address, your project names, your instance names, your session contents, your IP address or any identifier for your machine.

This website is a set of static pages. It sets no cookies, embeds no third-party scripts, loads no external fonts and runs no analytics.

Retention and deletion

Credentials persist on your Mac until you remove them. You can do so in any of these ways, and each is sufficient on its own:

• sign the profile out inside Ostgate, which deletes that profile's Keychain entries;
• delete the entries directly using the macOS Keychain Access application;
• revoke Ostgate's access from your Google Account's third-party access page, which invalidates the refresh token at Google regardless of what remains on disk.

Because we hold no copy of anything, there is nothing for us to delete on our side and no deletion request you need to send us.

Limited Use

Ostgate's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

In practice this is straightforward for an application with no backend: data obtained from Google APIs is used solely to provide the features described on this site, is not transferred to any third party, is not used for advertising, and is not read by humans.

Children

Ostgate is a professional infrastructure tool and is not directed at children. We do not knowingly collect information from anyone, of any age.

Changes to this policy

If this policy changes, the revised version will be published at this address with a new date at the top. Material changes, in particular any change to the scopes requested or to the claim that no data reaches us, will be reflected here before the corresponding release ships.

Contact

Write to privacy@ostgate.app.