Privacy and security
Your code, terminals and conversations with your agents stay on your Mac. Here's what Termlux connects to, what it stores where, and how your secrets are kept.
What stays on your Mac
- Your code and files, and everything shown or typed in a terminal.
- Your conversations with Claude Code and other agents. They talk to their own providers directly, not through Termlux.
- Secrets: workspace environment variables, SSH keys, host passwords and your agent logins.
Termlux's own files, its settings and recent terminal output, can be read only by your user account, and the terminal output is left out of Time Machine backups.
The app has no analytics and no tracking. It sends crash reports only if you turn them on.
Where secrets are kept
| What | Where |
|---|---|
| Your Termlux session | The macOS Keychain |
| Host passwords | The macOS Keychain, filled in when you connect: only for the ssh Termlux starts for that host. Never on disk or a command line |
| Claude logins | Claude Code's own Keychain items, one per workspace |
| SSH keys | Your ~/.ssh folder, or Termlux's keys folder. They never leave your Mac |
| Environment variables | Termlux's workspace list on your Mac. Never synced |
Termlux's Keychain items are its own: another program that asks for them, even one running in a Termlux terminal, gets the Keychain's prompt instead of the secret.
Programs in a terminal can write to your clipboard, but never read it.
What Termlux connects to
| Where | Why | What it sends |
|---|---|---|
api.termlux.com | Your account, activation and sync | Your email; a random ID for this Mac with its platform and app version; and what you sync |
dl.termlux.com | Updates | Nothing about you |
| Your ntfy server | Phone notifications, only if you set a topic | The notifications' text, with keys and passwords masked |
| Sentry, in the EU | Crash reports, only if you turn them on | The error, where in Termlux it happened, and the app and macOS versions |
Termlux doesn't connect to Anthropic itself, and never reads your Claude sign-in: you sign in through Claude Code, and your usage comes from Claude Code too. Claude Code, ssh to your servers and git clone connect where you tell them to.
Crash reports
Off unless you turn them on: tick Send crash reports in the tour's last step, or switch it on in Settings › Workspaces & privacy. The change applies the next time Termlux starts.
When something in Termlux breaks, a report says what went wrong and where in Termlux's code, with the app and macOS versions and a random ID for that launch. It never includes your terminals, chats, files, servers or anything you typed. Before a report leaves your Mac, Termlux also takes out your user name from folder paths, email addresses and your Mac's name.
Reports go to Sentry, an error-monitoring service, and are stored in the EU. At most 20 are sent per launch.
What sync stores
Only your own Macs receive what you sync, but it's kept on our servers to get there:
- Shared workspaces: their names, settings and folder paths. Paths can include your Mac's user name.
- Their task boards: everything in each task. Keep secrets out of task text.
- SSH hosts: addresses, user names, settings and port-forward rules. Never passwords or keys.
Environment variables are removed before anything is sent, and the server also removes fields that look like passwords, keys or tokens.
Projects you open
A project's own Claude settings can run commands on your Mac. Termlux asks before Claude starts in a folder whose settings do, and again whenever they change. See Folders that run commands.
Claude's permission mode decides what it does without asking. Changes to your servers always ask, whatever the mode.
Updates you can trust
Termlux is signed with our Apple Developer ID and notarized by Apple. Updates are signed with our own key too, and Termlux refuses one that isn't.
The details
The Privacy Policy lists everything we collect, why, who processes it, how long it's kept and your rights.