termal.in

Privacy Policy

Last updated: 24 October 2026
Termalin ("we") is the desktop SSH client and cloud service at termal.in.

The short version

  • Your hosts, keys, passwords and terminal recordings are end-to-end encrypted on your device. We store ciphertext we cannot read. Details: security page.
  • We collect the minimum needed to run accounts and sync.
  • We don't sell data, run ads, or embed third-party trackers.

What we store

  • Account: email address, a password hash (Argon2 — we never store the password itself), optional display name, subscription tier, sign-up and sign-in timestamps.
  • Encrypted content: your sync data and session recordings as encrypted blobs, plus a key-derivation salt (not a secret).
  • Recording metadata: duration, size, and whether an AI agent acted in the session — used for lists and plan quotas. The host label and title are encrypted with your master password, like the recording itself.
  • Devices: a device identifier and name per synced device.
  • Payments: if you buy a plan or add balance, our payment processor (Creem, NOWPayments for crypto, or Apple for purchases in the iOS app) handles the transaction and receives your email and payment details — we never see or store card numbers. We keep your subscription tier and an account-credit ledger.
  • Server logs: standard operational logs (IP address, request path, timestamps) kept briefly for security and debugging — e.g. rate-limiting sign-in attempts.
  • Activity log: sign-ins, host connections and other actions on your account, with time, device, IP address and country — what you see under Activity. Trimmed to 30 days on Free, a year on Pro and two years on Team.
  • Outbound connection log: when our server connects somewhere for you from its own address (the web terminal, file browsers, database client), the host and port, the address dialled, whether it worked, and your IP address and country. For a remote desktop opened through us we also note when it ended, how long it lasted and how many bytes went each way — never what was on the screen or typed. Kept 180 days, to answer abuse reports (see Report abuse).
  • AI tool calls: when a connected AI app or an API key uses a tool, we note the time, the app, the tool, the server, whether it worked (and the error if not), how long it took, and the command or file path it named — never file contents, command output or query results. Kept 30 days, to see where connecting an AI app goes wrong.
  • Crash reports and feedback (opt-in, from the app): the error, stack trace and app/OS version, or the text you send. If you delete your account they are kept, but no longer tied to your email address.

What we never have

  • Your master password, or any key derived from it.
  • The plaintext of your hosts, SSH keys, credentials, or recordings — with one exception you trigger yourself: asking the AI assistant to summarize a recording sends that recording's text through our server (see “AI assistant” below).
  • Your keystrokes — recordings capture terminal output only.

How we use data

To provide the service: authentication, sync, storing recordings, enforcing plan limits, and sending emails, all to confirmed addresses only — account emails (verification, password reset); a few emails during your trial (a welcome note, a reminder before the trial ends, and one just after it ends); a one-time note if you connect a chat app (ChatGPT or Claude) to your account but haven't yet added a Connector on any server, so the chat has nothing to reach — sent once, between an hour and three days after you connect, and only on a plan where that feature works; and, if you buy a plan, payment emails (a receipt, and, if you begin a checkout but don't finish, a one-off reminder); and alerts about your servers when something is wrong with one (see Server metrics and alerts below — switched off in Alert settings). Now and then, a few times a year at most, we also send a note about what is new in the product. The trial emails, the chat-app note and the product updates each carry an opt-out link, and that one link turns all three off; account, payment and alert emails aren't affected. Nothing from third parties, and no other marketing. We do not sell or share personal data with third parties except the infrastructure providers that host the service (server & email delivery), our payment processors (Creem, NOWPayments, Apple) and, for the AI assistant, Anthropic — each bound by their own data-processing terms.

AI assistant

Some features are answered by a language model (Claude, by Anthropic): summarizing a recorded session, explaining a piece of terminal output, turning a request into a command, describing a server, and a review of the commands AI agents run through your account. These only run when you ask, except the review, which runs on our side to catch misuse.

  • What is sent: the text the feature works on — a recording's transcript (decrypted on your device for that purpose), the output you selected, the request you typed, the read-only facts gathered about a server, or the command text an AI agent ran. It goes from our server to Anthropic's API and is handled under Anthropic's commercial terms (no training on it).
  • What we keep: nothing of the text. Only the number of requests and tokens per account and day, for the monthly allowance and our own spending cap; and, for the review of agents' commands, a severity label with a short reason next to the command, which was already in your activity log.
  • Your own key: you can add your own Anthropic API key in Settings. It is kept on your device (or in your browser for the web cabinet), sent with the request and not stored by us; usage then bills to your Anthropic account and no allowance applies.
  • Your own endpoint: you can point the assistant at any OpenAI-compatible API or a local model instead. Requests then go straight from your device (or browser) to that endpoint with Termalin's prompts, under that provider's terms; our server does not see them (a Connector's server probe is the exception: it is gathered through our server, and only its output is sent on by your device).
  • Reporting: every answer has a report button; what you flag reaches us as feedback.

Server metrics and alerts

For servers connected with a Connector on a paid plan (or a trial), we read health figures about once a minute over the Connector's existing connection, read-only (on Linux, /proc, df, ps and similar; on Windows, CIM/WMI queries; on macOS, the system's own tools). Nothing extra is installed on the server.

  • What is read: CPU, memory, swap, load, disk space and inodes per mount point, disk and network throughput, and counts of processes, open files and TCP sockets. Plus a few names needed to make the numbers useful: mount points, the command lines of the handful of processes using the most CPU, names of failed system services, names and states of containers, listening ports, names and expiry dates of TLS certificates found on the server, the number of pending updates, including security updates, and the number of failed SSH sign-ins. No file contents, no environment variables, no logs.
  • Not end-to-end encrypted: unlike your vault, recordings and command history, these figures are stored on our servers in a form we can read — our service has to read them to draw charts and to raise alerts.
  • On by default, off per server: collection is on for each Connector. You can switch it off for any server on that server's page in Server metrics; switching it off erases what was collected for that server.
  • History: recent days are kept as taken; older history is kept as averages with their peaks. It is kept for 90 days on Pro and two years on Team. Collection stops when a paid plan ends.
  • Alerts: when a figure crosses a threshold — disk nearly full, memory or load pinned, a failed service, a certificate about to expire, the server offline — we send a message by email and, if you set them up, a push to the phone app, Telegram, or a webhook. A Telegram message goes through Telegram; a webhook goes to the address you gave. We keep the list of alerts and a record of each message sent — the channel, the text as delivered, and why a channel failed if it did. Each channel, and alerts as a whole, can be switched off in Alert settings.
  • AI apps you connect: if you connect an AI app (Claude, ChatGPT) to Termalin, that app can read these figures and alerts through the same permission that lets it reach your servers.

Browser extension (Termalin for Chrome)

  • The extension signs in to your Termalin account with OAuth. It keeps the sign-in token, your settings, the server you last picked and a short list of the commands you ran in the browser's own extension storage, on your device. It holds no SSH key or password.
  • When you click Run, the command you confirmed and the chosen server are sent to your Termalin account, which runs it through your Connector, exactly like a connected AI app. The command and its result go into your activity log like any other. Nothing runs without your confirmation.
  • On the chat and Q&A sites it adds a button to code blocks, and puts a result into the chat's message box only when you click "Insert result into chat" (it never sends the message). In the Hetzner, DigitalOcean and AWS consoles it compares IP addresses already shown on the page with your own server list, inside the browser; nothing from those pages is sent anywhere.
  • No analytics, no tracking, no ads, and no other browsing data is collected. We don't sell or share this data, and use it only to run what you asked for. Disconnect the extension at any time in your account (AI apps), or remove it from Chrome, which deletes its storage.

Retention & deletion

  • Cloud recordings are kept per your plan's retention window, then deleted.
  • Server metrics are kept for 90 days on Pro and two years on Team, and are erased for a server as soon as you switch metrics off for it.
  • Deleting your account (in the app or the web cabinet) permanently removes the account and everything stored server-side: sync data, recordings, devices, tokens. There is no soft-delete. The same applies when we delete an account. The exceptions are the records described in the next points.
  • What we keep after deletion, and why. One short record of the deleted account, so that we can stop misuse (a second free trial, or an account deleted to get away from a review of how it was used), answer a question about the account later, and meet our legal and accounting duties. It holds:
    • the account's internal ID, when it was created and deleted, its plan, its country and the reason you gave for leaving, if you gave one;
    • one-way keyed hashes of your email address, the IP addresses you signed in from, your device identifiers and your Connector servers' addresses. A hash can't be turned back into the address; we can only check whether an address someone gives us matches one. This record never keeps them in readable form (the separate encrypted record below does);
    • a summary without personal details: the names you gave your Connectors, the countries you signed in from, how many hosts, Connectors, backups and recordings the account had, and the dates and outcome of any review of the account for misuse (with the short labels from that review, never the commands);
    • your payment records: dates, amounts, plan and the payment provider's reference numbers.
    The hashes and the summary are erased 12 months after deletion. Payment records are kept as long as tax and accounting law requires (up to 10 years), then erased too. After that only an anonymous line remains — when the account was deleted, how long it existed, its plan, its country and the reason given — which we use to see why people leave.
  • The encrypted record we keep for 12 months. When an account is deleted, we also keep one encrypted copy of who it was and what it did, taken just before the account's data is removed. It holds:
    • your email address, your name if you gave one, how you signed in (password, Google, GitHub, Apple, passkeys, two-factor) and whether your email was confirmed;
    • when the account was created and the IP address and country it was created from, and every sign-in: the time, IP address, country and device;
    • your devices (type, name, when first and last seen, last IP address) and your Connectors (name, system, IP addresses, when first and last seen, the access rules you set);
    • a log of the connections made through Termalin: when, to which server and port, through which Connector, how long and how much data. Never what was typed or shown in a session, and never the commands you ran;
    • your account's activity log (what happened, when, from which IP address), without command text;
    • the names and dates of your API keys and connected AI apps (never the keys themselves);
    • any review of the account for misuse, in full, including the evidence it holds — which can include the commands that started the review — and what we did about it;
    • your payments: dates, amounts and the payment provider's reference numbers.
    Why: to prevent abuse of Termalin, to protect other people from harm done through it, to answer lawful requests from the authorities, and to establish or defend legal claims. The record is encrypted, and only Termalin staff can open it; each time it is opened or downloaded we record who did it, when and why. It is erased 12 months after the account was deleted. Payment records are kept separately as long as tax law requires, as described above.
  • Also kept after deletion: the log of outbound connections made through our address, which is erased 180 days after each entry and exists only to answer abuse reports (see Report abuse); a copy of the account's part of it is in the encrypted record above. If an account was paused or suspended for abuse, the IP addresses and device identifiers seen on it are also kept, to spot a new account from the same place.

Cookies & local storage

The landing site sets no cookies and runs no analytics. The web cabinet keeps your session token in your browser's local storage; your master password is used only in the page's memory and never transmitted.

Your rights

You can access what we hold about you (it is what you see in the app and cabinet), correct it, export your recordings, or erase everything via account deletion. Questions or requests: privacy@termal.in.

Changes

We'll update this page as the service evolves and note material changes on the site.