# Privacy. Last updated 31 July 2026 Effective 31 July 2026 ## What this policy is Termy is a native SSH and infrastructure client for macOS and iOS. The Termy app has no advertising, tracking pixels, or third-party analytics SDKs. Anonymous first-party product measurement in the app is off by default. The public Termy website uses cookie-free Umami Cloud analytics as described below. This policy distinguishes data kept on your device, data you explicitly sync, website audience measurement, and the limited requests needed for paid features and updates. Terminal output, commands, credentials, host addresses, and connection history are not sent to Termy for analytics or advertising. ## 01. Data stored on your device Termy stores the information needed to provide the features you use: - **Host and connection profiles:** names, addresses, ports, usernames, notes, folders, proxy jumps, forwards, and preferences. - **Credentials:** SSH keys, passwords, database and object-storage credentials, and direct-license tokens. Secrets use the system Keychain where a Keychain-backed store is available. - **Trust records:** known-host fingerprints and your decisions when a server key changes. - **Workspace data:** snippets, playbooks, inventories, session metadata and history, alerts, health results, saved connections, and preferences. - **Diagnostics:** local application and connection logs. Termy does not upload them automatically; you choose whether to export or share a support bundle. - **Product measurement:** a bounded local list of fixed event names and timestamps shown in Settings. It expires after 90 days and is capped at 512 records. ## 02. Optional iCloud sync Termy Pro can sync hosts, snippets, known fingerprints, history, and alerts through Apple CloudKit when you enable iCloud sync in Settings and restart the app. Private keys and passwords are not synced by Termy and remain in each device's Keychain. Apple processes CloudKit data under its own privacy policy. ## 03. Product and website measurement ### Optional app measurement Anonymous event sharing is off by default. If you explicitly enable it in **Settings → Privacy & measurement**, each request body contains only a random installation UUID, a fixed event name, a random event UUID for retry deduplication, and the event time. The installation UUID is not an account, license, email, device serial number, or advertising identifier. Allowed events cover onboarding, config detection, host import, connection test, first shell, Host X-ray, safe-action preview and verification, capsule save, Pro gate, checkout, payment, license activation, and weekly activity. The API rejects unknown fields and event names. No hostname, username, command, terminal output, path, credential, key material, fingerprint, database content, or incident evidence is included. The source address is used transiently for in-memory abuse prevention, but is not stored in application logs or linked to the event. Server events expire after 180 days, and the dashboard exposes aggregate counts rather than raw installation IDs. ### Cookie-free website analytics The public website uses Umami Cloud to understand aggregate audience and conversion activity. Umami records page paths, page titles, referrers, timestamps, browser, operating system, device type, language, approximate location derived from the network request, and explicit events such as download clicks and checkout starts. URL query parameters are excluded. The tracker does not set cookies. Termy does not send Umami your email address, account ID, license key, payment details, commands, terminal output, host addresses, or infrastructure credentials. Website analytics is separate from the optional measurement inside the Termy app and is used only to understand and improve the website. ## 04. Licensing, purchases, and accounts ### App Store purchases Apple StoreKit processes the transaction and returns entitlement status to Termy. Termy does not receive your payment-card details. ### Direct licenses Activation and periodic entitlement refresh contact `api.termyapp.com`. Requests can include the license key or device token, a stable installation identifier, device name, operating-system version, app version, license status, and active device-slot information. They do not include SSH credentials, server addresses, terminal contents, or commands. The website account area processes account identifiers, purchase records, and billing-provider references for authentication, fraud prevention, fulfillment, refunds, and support. The payment provider, not Termy, processes payment-card details. ## 05. Network activity Depending on the features you choose, Termy can connect to: - **Your endpoints:** SSH, SFTP, databases, Kubernetes, Nomad, Docker-compatible services, object storage, Vault, Git repositories, and other destinations you configure. - **Port forwards:** local listeners and the remote SSH connection needed by a tunnel you start. - **License service:** direct-license activation and refresh described above. - **Software updates:** macOS builds check the signed Sparkle appcast at `dl.termyapp.com` and verify an update's signature before installation. - **iCloud:** only when iCloud sync is enabled and the current entitlement allows it. - **Discord Rich Presence:** only when enabled. Selected activity fields go to the locally running Discord client. - **Host availability checks:** disabled by default. If enabled, Termy attempts a TCP connection to the SSH port of up to 16 recently used hosts every five minutes. It does not authenticate, run commands, or upload results to Termy. - **Anonymous product measurement:** only after the explicit opt-in described above. Turning it off stops future uploads; local measurement remains visible and deletable. - **Website analytics:** public website pages load the cookie-free Umami Cloud tracker described above. The Termy app performs no advertising, automatic behavioral analytics, or third-party tracking. ## 06. Data disclosure Termy does not sell personal data. Data is disclosed only to service providers needed for a feature you chose, when you explicitly share it, or when required by law. Providers receive only the data needed for their role. Umami Cloud processes the limited website analytics data described above on Termy's behalf. ## 07. Retention and deletion - Delete hosts, credentials, history, snippets, and other records from the relevant Termy screens where those controls are available. - Disable iCloud sync to stop future synchronization. Remove existing CloudKit data through Apple's iCloud data controls. - Removing the app deletes its sandboxed database, subject to operating-system backup and retention behavior. - Keychain entries can survive app deletion by design. On macOS, use Keychain Access and search for “Termy” to remove them. - Use **Settings → Privacy & measurement → Delete local measurements** to erase the local event list and rotate its random identifier. Shared events expire after 180 days; contact us with the previous identifier before rotating it for earlier deletion. - Request website-account or direct-purchase deletion by email. Billing records may be retained where tax, fraud-prevention, refund, or legal obligations require it. ## 08. Security and changes Termy uses the platform Keychain for secrets, validates known-host fingerprints, and uses encrypted HTTPS for Termy-operated services. No product can guarantee absolute security; please report suspected issues privately. Material policy changes will update the date above and be summarized in release notes or on this website. ## 09. Contact Questions, access or deletion requests, and security reports: [privacy@noisefloor.dev](mailto:privacy@noisefloor.dev). --- Official source: [Privacy Policy — Termy](https://termyapp.com/privacy)