Privacy Policy

Effective 28 July 2026 · You can save or print this page.

1. Who is responsible for your data

We are established in the United Kingdom and comply with the UK General Data Protection Regulation and the Data Protection Act 2018 for all users, wherever they are.

2. What never reaches us: your documents

rterminal runs on your computer and works on your files in place. The documents, prompts, and working data in your sessions go directly from your machine to the AI backend you connect (Claude Code, Gemini, Codex, or OpenCode), under your own account with that provider, and are governed by that provider's terms and privacy policy. They are never sent to or stored on rterminal's servers.

One optional exception, off by default: app-data sync. If it is enabled for your account, the app's own chat history and display items sync to your account so they follow you between machines. Chats can quote your working material, so treat this setting accordingly; deleting your account erases everything it stored.

3. What we collect, why, and on what legal basis

• Account data: your email address, a hashed password, and hashed access tokens for your signed-in devices. Used to provide and secure your account. Legal basis: performance of our contract with you; legitimate interests (security and abuse prevention) for token hashing and rate limiting.
• Your skills and tools: the workflow files ("skills" and "tools") that sync with your account so your setup follows you between machines, and, if app-data sync is enabled for your account (it is off by default), the app's own chat history and display items. These are stored for you and are not read for any other purpose, unless you opt in to the research programme below. Legal basis: performance of the contract.
• Subscription state: your Stripe customer reference and subscription status (for example "trialing" or "active") and billing dates. We never see your card number; Stripe collects payment details directly. Legal basis: performance of the contract; legal obligation for tax and accounting records.
• Emails you send us (support, complaints): kept so we can help you and track that complaints are handled. Legal basis: legitimate interests.
• Usage statistics from the app: counts of feature use and errors, recorded against your account as bare event names (for example "app_start"): never content, never file names, never your documents. The account link exists so that your opt-out and your deletion rights work. Used only as aggregate statistics to understand how rterminal is used and to improve it; not used to profile you, and never shared with third parties for their own purposes. On by default; turn it off any time in the app's My Account panel or on your account page, and collection stops. Event-level records are deleted after 90 days. Legal basis: legitimate interests, with your opt-out honoured as an objection.
• Research programme (strictly opt-in): if, and only if, you opt in, we may analyse the skills and tools files synced to your account to improve rterminal's built-in skills. This is off unless you turn it on. You can withdraw at any time in the app or on your account page; from that moment your files are no longer used for research. We record your choice and when you made it. Legal basis: consent. Session content is not part of this programme (see section 2).

The website itself sets no analytics or advertising trackers. Beyond the usage statistics described above we collect no analytics, no advertising identifiers, and no special-category data; we do not profile you, and we make no automated decisions about you that have legal or similarly significant effects. We do not sell or share personal data for advertising.

4. Cookies and local storage

The website sets no cookies. It uses a single item of local storage in your browser to keep you signed in; this is strictly necessary to provide the service you request, so it does not require consent. There are no analytics, advertising, or third-party cookies.

5. Email

We send transactional email only: verification codes, password resets, receipts, and service or billing notices. We do not send marketing email. Every message identifies us and gives you a way to contact us.

6. Who processes data for us

• Stripe processes payments (they are a separate controller of your card details).
• Fly.io hosts our account and sync service.
• [Email delivery provider] delivers our transactional email.

Where these providers process data in the United States, transfers are protected by the UK Extension to the EU-US Data Privacy Framework (the UK-US "data bridge"), with standard contractual safeguards as fallback.

7. How long we keep data

• Account data and synced skills: for the life of your account, then deleted within 30 days of account deletion (except where a shorter or longer period is required by law).
• Payment and tax records: 6 years, as required by UK tax law.
• Support and complaint emails: up to 2 years after the matter is closed.
• Usage statistics: event-level records deleted after 90 days.

8. Your rights

You have the right to ask for access to your personal data, to have it corrected or erased, to restrict or object to our processing, and to receive a portable copy. Where we rely on consent you can withdraw it at any time. To exercise any right, email [support email]; we respond within one month.

If you are unhappy with how we handle your data or a privacy complaint, we will acknowledge your complaint within 30 days. You can also complain to the UK Information Commissioner's Office at ico.org.uk/make-a-complaint.

9. If you are in Australia

We honour the rights above for Australian users too: you can access, correct, or delete your data by emailing us. Your documents never reach our servers (section 2). If you have a privacy concern we cannot resolve, you can contact the Office of the Australian Information Commissioner at oaic.gov.au. If a data breach ever creates a likely risk of serious harm to you, we will notify you without undue delay, whatever your country.

10. Security and breaches

Passwords and access tokens are stored hashed, access to production systems is restricted and audited, and account endpoints are rate-limited. If a personal-data breach nonetheless puts your rights at high risk, we will inform you without undue delay and report it to the ICO within 72 hours as required.

11. Children

rterminal is not directed at children and requires you to be at least 18 to subscribe.

12. Changes to this policy

If we make material changes we will email account holders before they take effect and update the date at the top of this page.