termal.in

Privacy Policy

Last updated: 22 October 2026
Termalin ("we") is the desktop SSH client and cloud service at termal.in.

The short version

  • Your hosts, keys, passwords and terminal recordings are end-to-end encrypted on your device. We store ciphertext we cannot read. Details: security page.
  • We collect the minimum needed to run accounts and sync.
  • We don't sell data, run ads, or embed third-party trackers.

What we store

  • Account: email address, a password hash (Argon2 — we never store the password itself), optional display name, subscription tier, sign-up and sign-in timestamps.
  • Encrypted content: your sync data and session recordings as encrypted blobs, plus a key-derivation salt (not a secret).
  • Recording metadata: duration, size, and whether an AI agent acted in the session — used for lists and plan quotas. The host label and title are encrypted with your master password, like the recording itself.
  • Devices: a device identifier and name per synced device.
  • Payments: if you buy a plan or add balance, our payment processor (Creem, NOWPayments for crypto, or Apple for purchases in the iOS app) handles the transaction and receives your email and payment details — we never see or store card numbers. We keep your subscription tier and an account-credit ledger.
  • Server logs: standard operational logs (IP address, request path, timestamps) kept briefly for security and debugging — e.g. rate-limiting sign-in attempts.
  • Activity log: sign-ins, host connections and other actions on your account, with time, device, IP address and country — what you see under Activity. Trimmed to 30 days on Free, a year on Pro and two years on Team.
  • Outbound connection log: when our server connects somewhere for you from its own address (the web terminal, file browsers, database client), the host and port, the address dialled, whether it worked, and your IP address and country. Kept 180 days, to answer abuse reports (see Report abuse).
  • Crash reports and feedback (opt-in, from the app): the error, stack trace and app/OS version, or the text you send. If you delete your account they are kept, but no longer tied to your email address.

What we never have

  • Your master password, or any key derived from it.
  • The plaintext of your hosts, SSH keys, credentials, or recordings — with one exception you trigger yourself: asking the AI assistant to summarize a recording sends that recording's text through our server (see “AI assistant” below).
  • Your keystrokes — recordings capture terminal output only.

How we use data

To provide the service: authentication, sync, storing recordings, enforcing plan limits, and sending emails, all to confirmed addresses only — account emails (verification, password reset); a few emails during your trial (a welcome note, a reminder before the trial ends, and one just after it ends); a one-time note if you connect a chat app (ChatGPT or Claude) to your account but haven't yet added a Connector on any server, so the chat has nothing to reach — sent once, between an hour and three days after you connect, and only on a plan where that feature works; and, if you buy a plan, payment emails (a receipt, and, if you begin a checkout but don't finish, a one-off reminder); and alerts about your servers when something is wrong with one (see Server metrics and alerts below — switched off in Alert settings). Now and then, a few times a year at most, we also send a note about what is new in the product. The trial emails, the chat-app note and the product updates each carry an opt-out link, and that one link turns all three off; account, payment and alert emails aren't affected. Nothing from third parties, and no other marketing. We do not sell or share personal data with third parties except the infrastructure providers that host the service (server & email delivery), our payment processors (Creem, NOWPayments, Apple) and, for the AI assistant, Anthropic — each bound by their own data-processing terms.

AI assistant

Some features are answered by a language model (Claude, by Anthropic): summarizing a recorded session, explaining a piece of terminal output, turning a request into a command, describing a server, and a review of the commands AI agents run through your account. These only run when you ask, except the review, which runs on our side to catch misuse.

  • What is sent: the text the feature works on — a recording's transcript (decrypted on your device for that purpose), the output you selected, the request you typed, the read-only facts gathered about a server, or the command text an AI agent ran. It goes from our server to Anthropic's API and is handled under Anthropic's commercial terms (no training on it).
  • What we keep: nothing of the text. Only the number of requests and tokens per account and day, for the monthly allowance and our own spending cap; and, for the review of agents' commands, a severity label with a short reason next to the command, which was already in your activity log.
  • Your own key: you can add your own Anthropic API key in Settings. It is kept on your device (or in your browser for the web cabinet), sent with the request and not stored by us; usage then bills to your Anthropic account and no allowance applies.
  • Your own endpoint: you can point the assistant at any OpenAI-compatible API or a local model instead. Requests then go straight from your device (or browser) to that endpoint with Termalin's prompts, under that provider's terms; our server does not see them (a Connector's server probe is the exception: it is gathered through our server, and only its output is sent on by your device).
  • Reporting: every answer has a report button; what you flag reaches us as feedback.

Server metrics and alerts

For servers connected with a Connector on a paid plan (or a trial), we read health figures about once a minute over the Connector's existing connection, read-only (on Linux, /proc, df, ps and similar; on Windows, CIM/WMI queries; on macOS, the system's own tools). Nothing extra is installed on the server.

  • What is read: CPU, memory, swap, load, disk space and inodes per mount point, disk and network throughput, and counts of processes, open files and TCP sockets. Plus a few names needed to make the numbers useful: mount points, the command lines of the handful of processes using the most CPU, names of failed system services, names and states of containers, listening ports, names and expiry dates of TLS certificates found on the server, the number of pending updates, including security updates, and the number of failed SSH sign-ins. No file contents, no environment variables, no logs.
  • Not end-to-end encrypted: unlike your vault, recordings and command history, these figures are stored on our servers in a form we can read — our service has to read them to draw charts and to raise alerts.
  • On by default, off per server: collection is on for each Connector. You can switch it off for any server on that server's page in Server metrics; switching it off erases what was collected for that server.
  • History: recent days are kept as taken; older history is kept as averages with their peaks. It is kept for 90 days on Pro and two years on Team. Collection stops when a paid plan ends.
  • Alerts: when a figure crosses a threshold — disk nearly full, memory or load pinned, a failed service, a certificate about to expire, the server offline — we send a message by email and, if you set them up, a push to the phone app, Telegram, or a webhook. A Telegram message goes through Telegram; a webhook goes to the address you gave. We keep the list of alerts and a record of each message sent — the channel, the text as delivered, and why a channel failed if it did. Each channel, and alerts as a whole, can be switched off in Alert settings.
  • AI apps you connect: if you connect an AI app (Claude, ChatGPT) to Termalin, that app can read these figures and alerts through the same permission that lets it reach your servers.

Browser extension (Termalin for Chrome)

  • The extension signs in to your Termalin account with OAuth. It keeps the sign-in token, your settings, the server you last picked and a short list of the commands you ran in the browser's own extension storage, on your device. It holds no SSH key or password.
  • When you click Run, the command you confirmed and the chosen server are sent to your Termalin account, which runs it through your Connector, exactly like a connected AI app. The command and its result go into your activity log like any other. Nothing runs without your confirmation.
  • On the chat and Q&A sites it adds a button to code blocks, and puts a result into the chat's message box only when you click "Insert result into chat" (it never sends the message). In the Hetzner, DigitalOcean and AWS consoles it compares IP addresses already shown on the page with your own server list, inside the browser; nothing from those pages is sent anywhere.
  • No analytics, no tracking, no ads, and no other browsing data is collected. We don't sell or share this data, and use it only to run what you asked for. Disconnect the extension at any time in your account (AI apps), or remove it from Chrome, which deletes its storage.

Retention & deletion

  • Cloud recordings are kept per your plan's retention window, then deleted.
  • Server metrics are kept for 90 days on Pro and two years on Team, and are erased for a server as soon as you switch metrics off for it.
  • Deleting your account (in the app or the web cabinet) permanently removes the account and everything stored server-side: sync data, recordings, devices, tokens. There is no soft-delete. Two things are kept after deletion: payment records, as accounting requires, and the log of outbound connections made through our address, which is erased 180 days after each entry and exists only to answer abuse reports (see Report abuse). If an account was paused or suspended for abuse, the IP addresses and device identifiers seen on it are also kept, to spot a new account from the same place.
  • When you delete your account we also keep a short anonymous record — the date, how long the account existed, its plan, its country and the reason you chose, if you gave one — so we can see why people leave. It holds no email, name or IP address. For 12 months we also keep one-way keyed hashes of the account's email, device identifiers and Connector server addresses. They can't be turned back into the originals and are used for one thing only: a new account on the same email, device or server doesn't get a second free trial. After 12 months the hashes are erased.

Cookies & local storage

The landing site sets no cookies and runs no analytics. The web cabinet keeps your session token in your browser's local storage; your master password is used only in the page's memory and never transmitted.

Your rights

You can access what we hold about you (it is what you see in the app and cabinet), correct it, export your recordings, or erase everything via account deletion. Questions or requests: privacy@termal.in.

Changes

We'll update this page as the service evolves and note material changes on the site.