Privacy Policy

Filip Mercioniu is the data controller for the limited personal data described here. Contact: support@openterm.app.

The site sets no cookies, stores nothing in your browser, and carries no advertising, no third-party trackers and no social or CDN scripts. Fonts are served from our own domain, not from Google. There is nothing here to consent to, which is why you are not shown a cookie banner.

The site is hosted by Vercel Inc. (US), which acts as our processor. Two things are recorded:

• Server logs. Vercel automatically records standard request logs (IP address, browser user agent, requested URL, time). They are used only to deliver the site and protect it from abuse, and are deleted on Vercel’s normal rotation schedule.
• Audience measurement. We use Vercel Web Analytics to count visits, so we know which pages are read and which are not. It is cookieless: it writes nothing to your device and reads nothing from it, and it cannot follow you to any other website. For each page view it records the time, the page path and its route pattern, the referring page, filtered query parameters, an approximate location derived from your IP address (country, region, city), your device type, operating system and browser version, and the version of the measurement script. Your IP address itself is not stored: a repeat view is recognised through a hash derived from the request, which is discarded after 24 hours. We see only aggregate counts, never individual people or sessions, and we do not attempt to re-identify anyone.

Legal basis: our legitimate interest in running a secure website and understanding, in aggregate, how it is used (GDPR Art. 6(1)(f)). We do not rely on consent, because none of this involves storing or reading information on your device. You may object to the audience measurement at any time by writing to support@openterm.app, or simply by using a content blocker — common blocklists stop the measurement script from loading. No part of the site is withheld from you if you do.

We do not collect, receive or store your terminal output, commands, files, prompts, agent sessions, API keys or settings. API keys you enter in the app are stored encrypted in Windows Credential Manager on your device. The app itself has no user accounts, crash reporting, analytics or telemetry — the measurement described in section 2 applies to the website only. Everything the app stores — settings, layouts, workspaces, session state — stays in files on your device, and you can delete it at any time by removing the app and its data folder.

A few features contact third parties directly from your device. We are not in the middle of these requests and do not see their contents. Each provider handles your data under its own privacy policy.

• Updates: the app checks GitHub for new signed releases and downloads them from GitHub. GitHub sees your IP address.
• Agent version checks: to tell you when an installed AI CLI is outdated, the app asks the public npm and PyPI registries for the latest version of that package.
• Usage meters: to show your Claude Code or Codex plan usage, the app reuses the sign-in credentials those tools already saved on your computer and sends them only to their own provider (Anthropic or OpenAI).
• AI features (optional): if you add an OpenRouter API key, the text you ask the app to clarify or name is sent to OpenRouter and the model it routes to. The Agents panel assistant also sends the questions you ask it and the terminal text it reads to answer them, and its agent summaries send a short excerpt of each agent’s prompt and screen while the panel is open. Dictation, if you turn it on, sends each recording to OpenRouter to be transcribed. Without a key, nothing is sent.
• Voice assistant (optional): if you add a Gemini API key and start a voice conversation, your microphone audio, the assistant’s instructions and the terminal text it reads are sent to Google (Gemini Live) while the conversation runs. On Google’s free tier, Google may use this data to improve its products. Without a Gemini key, nothing is sent to Google.
• GitHub issues: the Issues tab uses the GitHub CLI (gh) already signed in on your computer, so requests go from your device to GitHub under your own account. The app never sees or stores your GitHub token.
• Agent installers: when you choose to install an agent, its official install script is downloaded from that vendor.
• Browser panes and AI agents: websites you open and agents you run (Claude Code, Codex, Gemini and others) connect to their own services under their own terms. What you send them is between you and them.

Issues, discussions and pull requests on our GitHub repository are public and hosted by GitHub under GitHub’s privacy statement. Do not post secrets, API keys or personal data there. If you email us, we use your address and message only to reply, and delete them when no longer needed.

We do not sell, rent or share personal data, and we do not use it for advertising or profiling. We disclose data only if required by law.

• Website audience measurement: aggregate counts are kept for as long as the site runs; the 24-hour visit hash is discarded automatically.
• Server logs: kept by Vercel on its normal rotation schedule (a matter of days), then deleted.
• Emails you send us: kept only as long as needed to deal with your message, then deleted.
• The app stores nothing with us at all, so there is nothing for us to keep or delete.

Some providers mentioned above (such as Vercel and GitHub) are established in the United States and process data outside the EU/EEA. Where they do, the transfer relies on safeguards such as the EU Standard Contractual Clauses (and, where the provider is certified, the EU–US Data Privacy Framework). We have a data processing agreement in place with Vercel under GDPR Art. 28.

Depending on where you live (including under the GDPR, UK GDPR and California’s CCPA/CPRA), you may have the right to access, correct, delete, restrict or export your personal data, to object to its processing, and to not be discriminated against for exercising these rights. Contact us at support@openterm.app and we will respond within 30 days. You can also complain to your local data-protection authority. Because we hold almost no data about you, most requests will be answered by confirming that.

Releases are cryptographically signed and the app only installs updates signed with our key. The site is served over HTTPS. No system is perfectly secure; report vulnerabilities to support@openterm.app.

The app and site are not directed at children under 16, and we do not knowingly collect their data.

We may update this policy. The date at the top shows the latest version, and we keep the previous versions in the public history of this site’s repository. Material changes — a new purpose, a new recipient, or anything that would require your consent — will be announced on this page before they take effect. The change made on 18 September 2026 added cookieless audience measurement to the website, described in section 2. The change made on 29 September 2026 described the Agents panel assistant and the GitHub issues feature in section 4. The change made on 14 October 2026 described dictation audio and the voice assistant in section 4, and how API keys are stored in section 3.