Privacy Policy
Effective 8 September 2026 · Covers the Termpolis desktop app, the Termpolis Remote phone app, and the pairing relay.
The short version. Termpolis runs on your computer. Your code, your terminal sessions and the memory it builds from them stay there. We do not operate an account system, we have no server that stores your work, and we cannot read what you do with it. The phone app is a remote control for the desktop app, end-to-end encrypted, and it stores nothing but its own key.
1. Who we are, and how to reach us
Termpolis is built by CodeDev LLC. The fastest way to reach us about anything in this policy is GitHub issues. For something you would rather not raise in public, write to [email protected] — the same address listed on the app's App Store and Google Play pages, and the same person either way.
2. The desktop app
What stays on your computer
Everything you work on. Termpolis is a terminal: it runs agents on your machine, against your files, using the model account you are already signed in to. The following live in your user data directory and are never uploaded by us:
- Terminal sessions, scrollback and command history.
- The shared memory ("Mneme") built from your sessions and code — its text, its embeddings and its graph. It is encrypted at rest with AES-256-GCM.
- Your settings, workspaces, shell configuration and keybindings.
- Any credentials the CLI agents you use store for themselves. Termpolis does not read them and does not copy them anywhere.
What leaves your computer, and to whom
| Goes to | What | When |
|---|---|---|
| Your model provider (Anthropic, OpenAI, Google) | The prompts, files and terminal context you send an agent — under your account and their terms, exactly as if you ran their CLI yourself. | Whenever you use an agent. We are not in this path and never see it. |
| GitHub | A version check, and the release you download. | On update checks and downloads. |
| Us (Sentry, anonymous events) | Crash reports, updater health, and anonymous feature counters. | Only if you turn telemetry on. It is off by default. |
Telemetry, if you enable it
Off unless you switch it on, and a single switch controls all three tiers. When it is on, the contract in the code is that no file paths, no terminal contents and no user identifiers are sent. What is sent is the shape of a crash, whether an update succeeded, and counts of feature use. When the switch is off every reporting path is a no-op — not "buffered", not "sampled".
3. Termpolis Remote (the phone app)
Termpolis Remote is a remote control for a Termpolis desktop that is already running. It runs no agent, holds no memory and holds no model credentials. On its own it does nothing at all.
What the phone stores
- Its own private key, in the operating system's keystore (iOS Keychain / Android Keystore), marked as available only while the device is unlocked and not backed up to another device.
- One pairing record per desktop: that desktop's public key, a random session identifier, the relay address, a device id and the name shown for it in the app.
A phone can be paired with several desktops at once — a work machine and a home one, say. Each pairing has its own private key and its own record, written to the keystore separately, so no two desktops see the same phone identity and forgetting one leaves the rest untouched.
That is the whole list. Terminal output reaches the phone encrypted, is held in memory while the app is open, and is never written to disk. Unpairing erases the key and the record for that desktop, and it works whether or not the relay is reachable.
The camera
Used for one thing: scanning the pairing code your desktop displays. Frames are decoded on the device and discarded. Nothing from the camera is stored or transmitted.
What the phone app collects
Nothing. There is no account, no analytics SDK, no crash reporter, no advertising identifier and no server of ours that the app talks to. The dependency list is short on purpose and is checked by a test on every push, so this claim cannot drift quietly.
4. The pairing relay
The phone and the desktop are usually on different networks, so they meet at a relay we run. The relay is deliberately built so that trusting it is not required.
- Every message is encrypted end to end between your phone and your desktop. The keys are derived when you pair, from both devices' identities, and never exist anywhere else. The relay does not hold them and cannot derive them.
- What the relay can see: an opaque room identifier, the size of each message, and its timing. Not the contents, not your terminal, not what you typed.
- The relay keeps no logs of your traffic and stores no messages. It forwards a frame to the other end of the room and forgets it. A room with nobody in it is discarded.
- Transport is TLS, and the payload inside it is sealed separately. Both layers would have to fail to expose anything.
When you pair, both screens show the same eight words. They are derived from the two device keys, so they match only if nothing is sitting in the middle. Comparing them is the whole verification, and it takes a couple of seconds.
5. What we never do
- We do not sell or share personal information, in the sense the CCPA and CPRA use those words. There is nothing to sell: we do not hold it.
- We do not use your code, prompts or sessions to train anything.
- We do not track you across apps or websites, and the app requests no tracking permission because it has no use for one.
- We do not run an advertising network or embed one.
6. Your choices and rights
Because your data stays on your devices, most rights are exercised directly rather than by asking us:
- Erase everything on the phone: forget each desktop in Settings, or delete the app. Both destroy the key material.
- Cut the phone off from one desktop: revoke the device in that desktop's Remote settings. Either end is enough — the channel cannot be re-opened without both. Any other desktops the phone is paired with are unaffected.
- Erase everything on the desktop: clear the memory store from Settings, or delete the app's user data directory.
- Stop telemetry: switch it off in Settings. It is off by default.
If you are in the EEA, the UK, California or another region with statutory data rights and you believe we hold something about you, write to us and we will answer. In almost every case the honest answer will be that we hold nothing, because the architecture does not give us anywhere to put it.
7. Children
Termpolis is a developer tool and is not directed to children under 13. We do not knowingly collect information from them, and there is no mechanism by which we could.
8. Security
Memory is encrypted at rest with AES-256-GCM. The remote channel uses X25519 key agreement, HKDF-SHA256 key derivation and ChaCha20-Poly1305 authenticated encryption, with the safety-word comparison above as the defence against a substituted key. The phone's private key sits in the platform keystore, not in application storage. The wire format is documented in the open, and the two independent implementations of it are tested against each other on every push.
No system is perfect. If you find a weakness, please tell us before you tell anyone else — [email protected], or GitHub issues if it is safe to say in public.
9. Changes to this policy
If this policy changes materially, the date at the top changes with it and the previous versions remain in this site's git history, so you can see exactly what changed and when.