Privacy Policy

1. The short version

• Your terminal session — every keystroke, every byte of output — flows directly between your host machine and the viewer's browser over an encrypted WebRTC channel. We never see or store it.
• We do store the minimum needed to operate the Service: your email and display name (from your identity provider), a log of when and from where you signed in, and metadata about each session you create (start time, end time, visibility — never contents).
• We do not sell your data. We do not run third-party advertising trackers on our app.

2. What we collect

From your identity provider

When you sign in with Google, we receive your stable Google subject id, email address, name, and profile picture URL. We store all of these so you have a profile in the Service.

From your device and network

For each authentication event we record:

• The IP address the request came from.
• The User-Agent header sent by your browser or HTTP client.
• Device context you provide explicitly (for the CLI: hostname, operating system, architecture, Node.js version, CLI version).

About each session you create

• The session id, pairing code, visibility, start/end timestamps.
• Which account joined the session as the viewer.

3. What we do not collect

We never see, log, or store any of the following:

• The contents of your terminal — commands, output, files, history.
• The contents of any file you transfer through the session.
• Keystrokes typed by the viewer or echoes from the host.

These travel directly between host and viewer over WebRTC and are end-to-end encrypted with DTLS-SRTP. Our servers handle signaling (introductions) only.

4. How we use what we collect

• To authenticate you on every request.
• To show you a log of your own activity (where you signed in from, sessions you started, etc.).
• To enforce abuse, rate, and security limits.
• To process payments for the paid plan via our payment processor.
• To send you operational email about your account (no marketing).

5. Where your data lives

User records, identities, session metadata, and authentication activity are stored in a managed Postgres database. Short-lived pairing codes live in Redis with a strict TTL (two minutes by default) and are deleted automatically — even when never claimed.

Data is retained for as long as your account exists. When you delete your account, your user record and linked identities are removed, and related rows are removed by database cascade. Authentication logs are retained for up to 24 months for fraud and abuse prevention, then purged.

6. Third-party services

We rely on a small set of third parties to run the Service:

• Google — for OAuth sign-in. Subject to the Google Privacy Policy.
• Dodo Payments — for payment processing and merchant-of-record billing. We never receive full card numbers; Dodo handles cardholder data under PCI DSS.
• Our hosting provider — server compute, Postgres, and Redis. They process data on our behalf under a data-processing agreement.

7. Cookies and analytics

The Service uses only the minimum cookies and local storage needed to keep you signed in. We do not use third-party analytics or advertising trackers on the application surface.

8. Your rights

Subject to your jurisdiction, you may have the right to access, correct, export, or delete the personal data we hold about you, and to object to or restrict its processing. Email [email protected] from the email address on your account to make a request — we respond within 30 days.

9. Children

The Service is not directed to children under 16. We do not knowingly collect personal information from children under 16. If you believe a child has provided us with personal information, please contact us so we can remove it.

10. International transfers

Our servers and processors are located outside your country of residence. By using the Service you consent to your data being processed in those jurisdictions, subject to appropriate safeguards.

11. Changes to this policy

We will update this page when our practices change. Material changes will be announced by email or via a notice in the Service before they take effect. See the "Last updated" date at the top.

12. Contact

Privacy questions or requests: [email protected]. Also see our terms of service.