Security

Security: what stays where

NomaDev is built so that your work never has to pass through us. This page explains, point by point, where your code, passwords and keys live, and the little our own service keeps.

Your projects never leave your computer

The NomaDev server runs on the computer or VPS where your projects already are. Claude Code, git, the preview and the uploads all run there.

Your phone connects to that machine directly. At home this usually happens over Tailscale, an encrypted point-to-point network based on WireGuard; on a VPS, over HTTPS with your own certificate. There is no server of ours in between, so we can't see your code even if we wanted to.

Passwords and passphrases are stored only on your phone

When an upload needs an FTP or SFTP password, or the passphrase of an SSH key, you type it on your phone. If you choose to remember it, it's saved in the Android Keystore, the encrypted storage protected by your phone's hardware; if you don't, it's used for that attempt only.

The password travels to your computer for that single upload, stays in memory while the upload runs and is never written to disk — not on your computer and not by us. Our servers never see it.

Disconnecting the phone in the app also deletes the passwords saved on it.

SSH keys only move if you ask

To publish over SFTP the server uses the SSH keys already on your computer, in your user's folder. They are not copied or uploaded anywhere: the phone only learns whether the key needs a passphrase.

The one exception is yours to make: to use a destination's key in the terminal, you can copy it to the phone. How that works is below.

The SSH terminal

The terminal connects from the phone straight to the server over SSH: the connection is encrypted end to end and doesn't pass through your computer or any server of ours. That's why it works even with your computer switched off.

The terminal's keys and passwords live only on the phone, encrypted with an Android Keystore key protected by the hardware. Using them takes your fingerprint or PIN, and an unlock lasts five minutes. They never end up in Android backups or on Google Drive, and only the native part of the app uses them, at the moment it connects.

You can generate a key right on the phone: the private part never leaves it, and you copy only the public one to the server. If you'd rather use the key a destination already uses on your computer, the app copies it once, after your fingerprint or PIN, and only if the request arrives encrypted, over HTTPS or through an HTTPS proxy on the same machine: over a plain connection your computer refuses.

The first time you connect to a server the app shows you its fingerprint and remembers it; for destinations your computer has already confirmed, its fingerprint counts. If the fingerprint changes, the app stops and warns you, and accepting it takes a long press. Keys and passwords are unlocked only after that check.

What goes through the terminal stays in the phone's memory, never on disk, and is gone when you close the session. The terminal doesn't show up in recent apps or screenshots unless you allow it. In the background sessions stay open at most for the time you choose, and you can close them all from the notification with one tap.

Only the phones you allow

To connect a phone you need a code shown on your computer: 8 characters, single-use, valid for 10 minutes and cancelled after 5 wrong attempts. The QR code carries the same code.

Each phone then receives its own access token. The server keeps only its SHA-256 fingerprint, never the token itself, so even someone who reads the server's files can't pretend to be your phone.

In Settings you see every connected phone and can disconnect any of them. A disconnected phone can no longer connect; restarting the server also closes a connection it still had open.

Nothing is open without authentication

Every request to the server must carry the phone's token. The live connection starts with a single-use ticket valid for 30 seconds, so the token never ends up in an address or a log.

The preview of the site you're developing is never public: it opens only from the app, with a single-use ticket exchanged for a private cookie.

The first time you upload to an FTPS or SFTP server, the app shows you the server's fingerprint and NomaDev remembers it; if it changes later, the app warns you before going on.

What our servers keep, and nothing else

We run one service: the relay that forwards notifications to your phone, because the Firebase key needed to send them can't be shipped inside the app.

It stores your phone's notification token, paired with a random identifier your computer uses to ask for a notification. For each notification it receives the kind (done, question, permission, error, preview), the project name and the session id; it writes the text itself from fixed sentences and keeps none of it.

It never receives code, error messages, passwords or keys. Usage statistics, in the app and on the site, start only if you accept them: they go to Google Analytics and never contain code, files or project names.

And Claude?

Claude Code runs on your computer with your own account, and sends Anthropic what it needs to work on your code — exactly as when you use it in a terminal. NomaDev doesn't add or change anything in that exchange. See Anthropic's privacy policy.

Security questions