Termoire is private by default. The terminal has no backend — no analytics, no tracking, no advertising, no third-party SDKs. The features that touch a server — agent notifications and Live Activities, iCloud sync, and Apple Speech dictation — are opt-in, and this page says exactly what they send and what the relay retains.
What Termoire stores, and where
Everything Termoire saves stays on your device:
The terminal has no backend
Termoire makes the server connections you initiate — to the SSH, Mosh, and Eternal Terminal servers you add. Those connections, including anything you type or receive, go directly between your device and your servers. Because you may connect to servers on your local network, iOS may ask for Local Network permission; this is used solely to reach the servers you specify.
iCloud sync (off by default)
If you enable sync, Termoire stores your host entries, snippets, and app preferences — plus the public key and metadata of your SSH identities — in your own private iCloud (Apple's CloudKit / iCloud Key-Value store). This data goes to Apple under your iCloud account and Apple's privacy terms, not to us. Private key material is never synced through this feature. Turn it off to stop syncing.
Background agent notifications (off by default, Pro)
If you enable background push, the host integration sends an end-to-end encrypted event envelope through Termoire's relay (api.termoire.com) and Apple Push Notification service. The relay cannot decrypt the message, prompt, tool detail, or decision inside that encrypted envelope. Optional detailed Live Activities use a separate plaintext progress summary so the relay and Apple can update the Lock Screen: this may include the task, command/tool preview, model, and usage metrics. Status Only omits those private details from managed-host activity emission once the host integration has applied the setting; disconnected hosts apply pending changes when their integration updates. Turning off Live Activity display alone does not rewrite an installed host's emission setting. The relay also retains the routing records needed to operate the feature: a pseudonymous device id, APNs and Live Activity tokens, device and host display names/ids, host-to-device bindings, and scoped bearer/push keys. Inactive device registrations and their host bindings are deleted after at most 90 days without a refresh; stale Live Activity tokens are deleted after 24 hours; pending approvals expire within ten minutes. Encrypted event bodies are delivered rather than kept as message history. The service uses these records only to deliver app functionality and never for tracking or advertising.
Apple Speech dictation (only when you invoke it, Pro)
Termoire uses Apple's Speech framework to turn microphone audio into terminal or Chat text. For a language whose recognizer reports on-device support, Termoire requires on-device recognition. For an unsupported language, “Never send speech to Apple” is on by default and makes that language/device combination fail before recording. To use Apple-service recognition, you must turn that setting off and confirm the persistent opt-in on that device; you can revoke it at any time. The dictation overlay discloses the effective mode. Retained recordings are replayed, retranscribed, and compared only with on-device profiles; the Speech Workspace never sends a saved recording to Apple or another service. Termoire's relay and company servers never receive speech audio or transcripts through dictation. Apple's processing is governed by Apple's terms and privacy policy.
App Store privacy terms
In App Store privacy terminology, the optional relay collects Device ID and Other User Content, linked to the device/user for App Functionality, with no tracking. This disclosure includes encrypted event envelopes and any optional plaintext Live Activity summaries described above.
Data sharing
We do not sell relay data or disclose it for advertising or cross-company tracking. The services involved are the servers you choose, Apple services used by the platform (including iCloud, APNs, and Apple Speech when applicable), and the optional Termoire relay described above. The relay forwards only the encrypted payload and routing metadata required for the feature.
Subscriptions & payments
Termoire Pro is sold through the Apple App Store. Apple handles the entire purchase and any billing; we never see or store your payment details. Termoire receives only Apple's entitlement status through StoreKit — whether an active subscription or lifetime purchase exists — which is used solely to unlock Pro features.
No analytics or tracking
There are no analytics, no tracking, no advertising, and no third-party data SDKs in the app. We do not build profiles of you and we do not sell or use your data for advertising.
Children's privacy
Termoire is not directed to children. The optional relay handles the same limited encrypted routing data regardless of the user's age and does not use it for profiling or advertising.
Your control
You can delete any saved host, key, password, known-host entry, dictation recording, or dictation-history record inside the app at any time. Turning off background delivery unregisters the device and deletes its relay bindings; a failed network revocation is shown as pending and retried rather than reported as complete. Deleting the app removes its local container; Keychain data can also be removed from Termoire's credential settings before deletion. You may contact [email protected] for help deleting relay records when the app is unavailable.
Changes
If this policy changes, we will update this page and its effective date.
Questions about privacy? Email [email protected]. For anything else, see Support.