1. General information
This Privacy Policy explains what data is processed when you use Gozuh. Gozuh is a completely free mobile app for viewing information from a Wazuh environment that you configure yourself.
Gozuh is not a cloud service. The provider does not operate a backend that receives your Wazuh data, credentials, tokens, alerts, hosts, inventory, vulnerabilities, or configuration.
2. Gozuh app data
The Gozuh mobile app does not send your Wazuh data, credentials, tokens, alerts, hosts, vulnerabilities, inventory, or configuration to the provider. These data are processed locally on your device and are transmitted only to the Wazuh Manager API and Wazuh Indexer API endpoints that you configure.
3. Network access
On Apple mobile devices, Gozuh may ask for Local Network access when you connect to a Wazuh server on your local network. It uses this access to connect to the server addresses you enter.
On Android, Gozuh uses network access to connect directly to the Wazuh endpoints you enter. The current Android version does not request a separate Local Network runtime permission.
The app requires network access so it can connect to the Wazuh endpoints you enter in Settings. Depending on your configuration, this may involve server URLs, hostnames, IP addresses, usernames, passwords, API responses, and JWT tokens used by your Wazuh environment.
This communication takes place between your device and your configured Wazuh services. Gozuh does not route this traffic through a Gozuh-operated server and does not transmit this information to the provider.
Public Wazuh endpoints should use HTTPS. Local HTTP may be available only for eligible local addresses and is not encrypted.
4. Local storage of credentials and tokens
Credentials and tokens stay on your device and are protected using platform-specific security mechanisms.
On Apple mobile devices, Wazuh usernames, passwords, and Manager JWT tokens are stored in Apple Keychain, the platform-provided secure storage mechanism for sensitive app data.
On Android, encryption keys are protected by Android Keystore. Wazuh Server API credentials, Wazuh Indexer API credentials, and Manager JWT tokens are stored separately as AES-GCM encrypted files in the app's private no-backup storage. Passwords and JWT tokens are not stored in Android DataStore.
Non-secret preferences, such as configured server URLs, usernames, connection mode, default time range, and the app lock setting, may be stored locally in private app preferences. On Apple mobile devices this may use UserDefaults. On Android this may use Android DataStore.
Gozuh may also save dashboard and vulnerability history on your device, including daily totals and host names used in summaries.
5. App lock and local authentication
Gozuh includes an optional app lock that can and should be enabled in the app settings. When enabled, Gozuh locks after entering the background and asks you to unlock it with the authentication method available on your device.
On Apple mobile devices, biometric verification is handled locally through Apple's LocalAuthentication framework and may use Face ID, Touch ID, Optic ID, or the available device authentication method.
On Android, optional App Lock uses Android system authentication. Depending on the device and Android version, unlocking may use an enrolled strong biometric or the device PIN, pattern, or password.
Gozuh receives only the authentication result. It does not receive raw biometric data, does not store biometric templates, and does not send biometric information to the provider.
When protected content is displayed, the Android app uses Android's secure-window protection to reduce exposure through screenshots, screen recording, and the recent-apps preview. Protection may vary by Android version and device manufacturer.
6. App analytics, tracking, and crash reporting
Gozuh does not include analytics SDKs, advertising SDKs, crash-reporting SDKs, tracking SDKs, cloud sync services, or third-party telemetry. The app does not create automatic crash reports for the provider and does not perform session recording.
7. Support communications
If you contact support, the provider may process your email address, message content, app version, mobile platform, OS version, and any information you voluntarily include. This data is used only to respond to your request, troubleshoot issues, protect legal claims, and improve documentation.
Please do not send passwords, tokens, private hostnames, customer data, alert payloads, screenshots containing secrets, or other confidential information.
8. Website logs
When you visit gozuh.com, the hosting provider may process technical logs such as IP address, browser user-agent, requested URL, date and time, and error logs. These logs are used for security, abuse prevention, diagnostics, and maintaining the website.
9. Cookies and analytics
This website uses Google Analytics in Advanced Consent Mode to understand visits and improve the website. The Google tag loads when you open the website, with analytics and advertising consent set to denied by default. Before you consent, and if you reject analytics, Google receives limited measurements without analytics cookies, including consent status and technical information such as the time of the request, browser information, and referring page. Cookie-based analytics is enabled only when you choose Allow analytics.
Analytics may process browser identifiers, page views, referring pages, device and browser information, and approximate location. Google processes technical connection information, including your IP address, when analytics requests are made. Advertising storage and advertising personalization are disabled in this website's tag. This website analytics does not receive data from the Gozuh app or your Wazuh environment.
You can allow or reject analytics using the consent banner and change your choice at any time through Cookie settings in the footer. Your choice is stored locally in your browser for up to six months. Withdrawing consent stops cookie-based website analytics and removes Google Analytics cookies that this website can access. Limited measurements without cookies continue while consent is denied. Withdrawal does not remove information already processed by Google.
Analytics is provided by Google Ireland Limited for users in the European Economic Area. Data may also be processed outside that area under Google's applicable data protection arrangements. See Google's Privacy Policy and how Google uses information from sites that use its services.
10. Legal bases for processing
Cookie-based website analytics is processed on the basis of your consent under Article 6(1)(a) of the GDPR. You may withdraw that consent at any time without affecting the lawfulness of processing before withdrawal.
Limited measurements without analytics cookies are used for website usage statistics on the basis of the provider's legitimate interest in understanding and improving the website under Article 6(1)(f) of the GDPR. You may object to this processing by contacting support@gozuh.com.
Support communications are processed to respond to your request and, where applicable, to take steps before entering into a contract or to perform a support-related request.
Website logs are processed based on the provider's legitimate interest in security, abuse prevention, diagnostics, and maintaining the website.
Legal claim-related retention is processed based on the provider's legitimate interest in establishing, exercising, or defending legal claims.
11. Third-party websites
The app and website may link to external websites such as the Gozuh website, Wazuh, app stores, or support pages. Opening those links is optional. External websites are controlled by their respective owners and may have their own privacy practices.
12. Security
Gozuh is designed as a read-focused client and avoids destructive actions such as deleting, restarting, or upgrading agents. Sensitive credentials and tokens are protected locally using platform security mechanisms, and network requests are made directly to the endpoints you configure.
You remain responsible for securing your own Wazuh infrastructure, API users, certificates, network access, device, and credentials. Use HTTPS for non-local endpoints and grant only the permissions needed to read the data you want to view in the app. You should also enable the app lock in Gozuh Settings when your device supports it.
13. Terms of Use / EULA
Use of Gozuh is also governed by the Terms of Use / EULA.
14. Retention
Support emails are kept for up to 24 months after the last contact, unless longer retention is required to establish, exercise, or defend legal claims. Website server logs are kept for up to 90 days unless longer retention is necessary for security or legal reasons.
Website analytics retention follows the settings of the Google Analytics property and Google's applicable retention practices. Your locally saved analytics choice expires after six months.
On Apple mobile devices, clearing the app configuration or deleting the app removes locally stored app data from that device. On Android, Reset Defaults restores editable form defaults but does not delete saved connections, credentials, tokens, App Lock settings, or history. To remove all locally stored Gozuh data from an Android device, use Android's Clear storage or Clear data action, or uninstall the app. These actions do not delete data from your Wazuh servers.
15. Your rights
Where GDPR applies, you may request access, correction, deletion, restriction, objection, and portability of your personal data. You may also lodge a complaint with your local data protection authority. In Poland, this is the President of the Personal Data Protection Office (UODO).
16. Changes to this policy
This Privacy Policy may be updated when the app changes. The latest version will be published on this page.
17. Contact
For privacy questions, contact support@gozuh.com or use the support page: Gozuh Support.