Privacy Policy

nodeterm is a terminal and coding-agent workspace. It ships as a desktop app for macOS and Linux, a self-hosted Server Edition, and nodeterm mobile, an iOS companion. This policy covers all of them.

1. Who we are

nodeterm is an independent project. The data controller for the limited processing described below is the project's maintainer, reachable at eneskirca@gmail.com.

2. What we do not collect

None of the apps send us any of the following — not in aggregate, not anonymized, not ever:

• Terminal input or output, keystrokes, scrollback or clipboard contents.
• Your source code, file contents, file names, repository names or git history.
• Prompts, responses or transcripts from coding agents (Claude Code, Codex, Gemini) or from the built-in chat node.
• SSH hosts, usernames, passwords, private keys or host keys.
• Your canvas/workspace layout, project names, notes or tags.
• Your location, contacts, photos, microphone audio or camera images.
• Any advertising identifier. We do not track you and we do not share data with data brokers or ad networks.

These live on your device (and, if you use SSH, on the servers you yourself connect to). We have no copies and no way to obtain them.

3. The network calls the desktop app actually makes

The macOS app is not offline software, so it is worth being exact about the handful of requests it makes to our infrastructure. Every one of them necessarily reveals your IP address to the receiving server, as any HTTP request does.

3.1 Update check always on

Packaged builds check for a new version on launch and every six hours against nodeterm.dev/updates (which serves release files hosted on GitHub Releases). The request reveals your IP address and the app version you are running. No account, no device id, no content. Downloading an update also involves GitHub's CDN, which sees your IP address under GitHub's privacy statement.

3.2 Announcements & minimum-version check always on

Packaged builds call api.nodeterm.dev/v1/check on launch and every six hours to fetch in-app messages (e.g. "a security update is available") and the minimum supported version. The request carries exactly three parameters: app version, operating system (darwin/linux/win32) and the release channel (stable). Nothing is persisted server-side. It is skipped entirely in unpackaged/development builds and when the DO_NOT_TRACK or NODETERM_TELEMETRY_DISABLED environment variable is set.

3.3 Anonymous telemetry opt-in — off by default

If — and only if — you switch on Settings → Privacy → Telemetry, the app sends a ping to api.nodeterm.dev/v1/ping on launch and at most once a day. The entire payload is:

{
  "deviceId":   "random UUID generated on this machine",
  "appVersion": "0.3.1",
  "os":         "darwin",
  "arch":       "arm64",
  "channel":    "stable"
}

The deviceId is a random identifier created locally on first run. It is not derived from any hardware id, is not linked to your name, email or any account, and is used only to avoid counting one installation many times. We use this to know roughly how many installs there are and which OS/architecture/versions to support — nothing else. It is never used for tracking or advertising and is never shared with anyone.

To disable it: leave it off (the default), turn it off again in Settings → Privacy, or set DO_NOT_TRACK=1 or NODETERM_TELEMETRY_DISABLED=1 in the environment, which overrides the setting.

3.4 Pro licensing only if you buy Pro

Optional Pro features are paid. If you start a purchase, the app opens a Stripe checkout page carrying the same random deviceId so your purchase can be bound to your installation; the app then talks to api.nodeterm.dev/v1/license/* with your deviceId and, if you use one, your license key, and receives a signed entitlement token that is verified offline on your machine. We never see your card details. Payment and any billing email you give Stripe are handled by Stripe as an independent controller under its privacy policy. If you do not buy Pro, none of these requests happen.

4. Remote access and the relay

The desktop app can be reached from the iOS companion, either directly over your local network / SSH, or — for Pro users — through our relay at relay.nodeterm.dev when the two devices are on different networks.

• The relay is end-to-end encrypted and cannot read your session. Your desktop and your phone hold their own keypairs (NaCl box: Curve25519 + XSalsa20-Poly1305, with a fresh per-session traffic key). All terminal traffic is encrypted on the sending device and decrypted only on the receiving device. The relay forwards opaque bytes.
• What the relay necessarily sees: the IP addresses of the two connecting devices, the size and timing of the encrypted packets, and the short-lived pairing/join token used to match a phone to its host. It never sees terminal content, commands, files, keys or passwords.
• Pairing is confirmed by a human on both ends. Devices are paired with a QR code and a 6-digit code (a short authentication string derived from the shared key) that you compare on both screens, so a malicious relay cannot insert itself between them.
• What our API stores for relay: to let your phone find your desktop later, we mint a device token bound to your desktop's public key, your random deviceId and your Pro entitlement, plus an optional label you choose. That is connection metadata, not content.
• Private keys never leave the device. The desktop stores its host key in your Application Support directory, encrypted with the OS keychain where available; the phone stores its keys in the iOS Keychain, device-only, never synced to iCloud.

5. Data stored locally on your devices

All of this stays on your machine. We cannot read it and it is never uploaded to us.

• Workspace and projects — your canvas layout lives in a per-project .nodeterm/project.json inside your own folders, plus an index in the app's data directory.
• Terminal sessions and scrollback — live in tmux on your machine; a capped snapshot of recent output is kept locally so sessions can be restored after a reboot.
• Agent transcripts — written by the agent CLIs themselves into their own directories (e.g. ~/.claude) on your machine.
• SSH — the desktop app stores only the connection details you type (host, user, port, path to an identity file). It does not store SSH passwords; it uses your system's ssh and your own keys. The iOS app stores the SSH password or private key you enter in the iOS Keychain (device-only, not synced), and pins each server's host-key fingerprint there so a changed key is refused.
• Settings, including whether telemetry is on, and a random device-id file used only for telemetry/licensing as described above.

6. Coding agents and other third-party tools you run

nodeterm is a workspace for tools you already have. When you run Claude Code, Codex, Gemini or any other command inside a nodeterm terminal — or use the built-in chat node, which drives Anthropic's Claude Agent SDK with your own Claude credentials — that tool talks to its own provider directly, under your own account and that provider's privacy policy. Your prompts and code go to them, not to us; nodeterm neither proxies nor copies that traffic. The same is true of any server you connect to over SSH: that is your infrastructure.

7. Server Edition

The Server Edition is software you host yourself, on your own machine, reached from a browser. It authenticates with a password you choose (stored only as a scrypt hash) and a session cookie. It sends nothing to us: no telemetry, no update check, no license call. Whatever it processes is on your server, under your control — you are the controller of that data, and we have no access to it.

8. The iOS app (nodeterm mobile)

The iOS companion has no accounts and no analytics. It talks only to (a) computers you point it at, over SSH or the E2EE relay, and (b) api.nodeterm.dev to resolve a relay join token for a desktop you have already paired with. Its permissions are used strictly for the stated purpose:

• Camera — only to scan the pairing QR code your computer displays. No images are stored, saved to your library, or transmitted.
• Microphone + Speech Recognition — only for the optional dictation composer, so you can speak a prompt instead of typing it. Recording starts when you start dictation and stops when you stop; the resulting text is placed in the composer for you to review, and is sent to your terminal only when you press send. Audio is never sent to us and never stored by us.
  Important: dictation uses Apple's on-device/Apple-hosted Speech framework. Depending on your device, language and settings, Apple may process the audio on its servers to perform the recognition. That processing is governed by Apple's privacy policy, not ours. If you would rather not have that happen, simply do not use dictation — the feature is entirely optional and typing works everywhere.
• Local Network — only to reach computers on your own network (SSH / direct connection). Nothing is broadcast to us.

The app's Apple privacy manifest declares no tracking, no tracking domains and no collected data types, which matches the behavior described here.

9. Third parties

• Apple — distributes the iOS app and provides the speech-recognition framework used by dictation. Apple gives us only aggregate, anonymous App Store statistics; we cannot identify you from them.
• GitHub — hosts the desktop app's release files. Downloading a build or an update reveals your IP address to GitHub.
• Stripe — processes payment if you buy Pro. We never receive your card data.
• Our own infrastructure — nodeterm.dev, api.nodeterm.dev and relay.nodeterm.dev, which see the requests described above (and, like any web server, may keep short-lived operational logs containing IP addresses for security and abuse prevention).

There are no analytics providers, no advertising networks, and no third-party SDKs collecting data in any of the apps.

10. Legal basis and retention (GDPR)

• Update and announcement checks — necessary to provide and secure the software (legitimate interest, Art. 6(1)(f)). The check endpoint persists nothing; ordinary server logs are short-lived.
• Telemetry — your consent (Art. 6(1)(a)), given by switching it on and withdrawable at any time by switching it off. Records are anonymous aggregate counters keyed by a random installation id, kept no longer than needed to understand version/platform adoption.
• Licensing and relay device tokens — necessary to perform the contract you entered when buying Pro (Art. 6(1)(b)). Kept for the life of the license, deleted on request.

Because there is no account and no content collection, we typically hold no personal data about you at all. If you have a Pro license, you may ask us to access, correct, export or delete the record associated with it, or to object to processing, by emailing eneskirca@gmail.com. You also have the right to complain to your local data-protection authority.

11. Children

nodeterm is a developer tool and is not directed at children under 13 (or under 16 where that is the applicable age). We do not knowingly collect personal data from children. If you believe a child has provided us personal data, contact us and we will delete it.

12. Security

Remote sessions are end-to-end encrypted; SSH host keys are pinned on first use; secrets are held in the OS keychain where the platform provides one. No system is perfect — if you find a security issue, please report it to eneskirca@gmail.com rather than filing it publicly.

13. Changes

If this policy changes materially, the new version will be published here with a new "last updated" date, and significant changes will be announced in the app.

14. Contact

Questions, requests or complaints: eneskirca@gmail.com.