Privacy policy.

Who provides CloudLatch

CloudLatch is an independent macOS utility maintained by Chrominsky. It does not require a CloudLatch account or send credentials to a CloudLatch-operated server. Your AWS account, permissions and MFA device are provided separately by you or your organization.

Credentials and authentication

CloudLatch reads IAM user access keys from the AWS directory and source profile you select. The SDK uses the secret access key locally to sign AWS Security Token Service (STS) requests. Your access-key identifier, and for accounts that use MFA your MFA code and device serial, are used in authentication with AWS over HTTPS.

Temporary source credentials are held in memory and stored in macOS Keychain, separately for each saved account. For accounts that use MFA, the MFA device serial is also stored in Keychain. MFA codes are used for the authentication request and are not saved in the application's configuration or Keychain.

For an account set up for access keys without MFA, CloudLatch requests the temporary source session without an MFA code or device serial and does not read or store a serial. In both modes, your long-lived access keys stay in your AWS files and are not copied into Keychain.

Role ARNs and a role-session name containing the configured alias are sent to AWS when you assume a role. Returned temporary role credentials are written to the selected role profile and default in your chosen credentials file. Credential values in these two profiles are replaced; other profiles are preserved. CloudLatch does not store your AWS console password.

Local configuration and diagnostics

Role aliases, role ARNs, the authentication method and preferences are stored in Application Support inside the app container. A local security bookmark remembers access to your selected AWS directory. Session-state files can include the active profile, account ID, expiration and last error.

With saved accounts, a registry file holds account names, identifiers and the current selection, without access keys or session tokens. Each added account has its own configuration, state and directory bookmark, and its own Keychain service.

Diagnostic files and macOS logs contain generic refresh-started and refresh-failed events. The app omits profile/source names and raw AWS error payloads from those diagnostic events. No app-operated advertising, analytics, crash-reporting service or remote backend is included.

AWS processing

AWS receives authentication requests and network information needed to process them, including the source IP address. SDK request metadata can include SDK, operating-system and language versions, feature flags and the app identifier. The bundled AWS SDK declares Other Diagnostic Data used for app functionality, without tracking or linkage to a person in that declaration.

AWS STS activity can also create account-linked CloudTrail records containing identity, time, request and network metadata. CloudLatch does not control those AWS records or their retention. See AWS STS logging, the AWS Privacy Notice and the terms governing your AWS account.

SDK client logging is disabled. This does not prevent AWS request processing or mean that no data leaves your device. CloudLatch does not use this data flow for cross-app advertising or tracking.

Retention and your choices

Temporary credentials expire at the times returned by AWS. Expiration does not automatically remove every saved copy. Configuration, bookmarks, state, logs and Keychain entries can remain until removed or replaced. Changing authentication settings invalidates the cached source session; credentials already written to the shared AWS file remain separate.

You control whether to launch the app, grant folder access or request a refresh. Only the selected account renews; quit CloudLatch to stop automatic renewal. Removing local credentials does not revoke an already issued AWS session or remove AWS audit records. An AWS administrator controls account permissions and applicable revocation and retention procedures.

Remove CloudLatch data

1. Quit CloudLatch first. This stops the app from renewing sessions or recreating local files during removal.
2. Review your selected AWS credentials file. Remove only CloudLatch-written temporary credential values from the role profiles you used and from default, or restore those profiles from your own backup. Other tools may have changed them since CloudLatch last ran. Do not delete the whole file, your source IAM access keys or unrelated profiles. Repeat for each AWS directory used by a saved account.
3. Remove CloudLatch Keychain entries. In Keychain Access, inspect generic-password items with service aws-login-helper. The source-session account is shared-mfa-session; the default MFA-device account is shared-mfa-device, or the account configured in your app configuration. Additional saved accounts use services named aws-login-helper.account.<account ID> with the same account names. Delete only entries you have identified as belonging to CloudLatch. Older versions may share these service names.
4. Remove local app files. In Finder, use Go to Folder and open ~/Library/Containers/dev.cloudlatch.mac/Data/Library/Application Support/AWSLoginHelper/. The app stores config.toml, state.json, aws-directory.bookmark and Logs/hermes.log there. Versions with saved accounts also use accounts.json and an accounts/ folder with one subfolder per added account. Remove the CloudLatch files after preserving anything you need. Legacy installations may also have files in ~/Library/Application Support/AWSLoginHelper/; inspect before removing them.
5. Remove the application if desired. Uninstalling alone does not guarantee removal of Keychain items, shared AWS credential profiles or backups. macOS unified logs and your backups have their own retention. Contact your AWS administrator for server-side access changes or audit-record questions.

CloudLatch does not create an online CloudLatch account, so there is no separate CloudLatch server account to delete. These steps describe local removal; they do not promise immediate erasure from operating-system logs, backups or AWS.

Website and support

This static website uses no analytics, JavaScript, advertising, site cookies, embedded third-party media or remote fonts; fonts and images are served from this site. GitHub Pages serves the site and may process connection information. See GitHub's privacy statement.

GitHub support issues and their attachments are public. Report text is kept by GitHub and the project until removed under the applicable controls and policies. Use fictional examples and never attach credentials, MFA codes, account identifiers or unredacted logs.

Contact

For product or general privacy questions, use CloudLatch support on GitHub. To request private follow-up, ask for a private contact channel without including personal or confidential information in the public issue. Suspected vulnerabilities belong in private vulnerability reporting; that channel is for security reports.

Material changes to this policy will be posted here with an updated date. The November 5, 2026 update adds saved accounts and access keys without MFA.