TermTether Privacy Policy

Last updated 2026-10-31

1. Who we are

The TermTether hosted service (termtether.dev and its subdomains) is operated by TROXEL TECH LLC, an Indiana limited liability company ("we", "us"). This policy covers the hosted service. The box agent you install runs on your own machine; in standalone mode, without our hosted service, it sends us nothing. Questions and requests: legal@troxel.tech.

2. What we collect, and why

• Your GitHub account. You sign in with GitHub. We receive and store your GitHub username, your numeric GitHub user ID, the date your GitHub account was created, and your primary verified email address. We use them to identify you, to decide whether a new account is eligible for the free trial, and to match your sign-in on the dashboard and on your boxes. We also store your plan, trial end date, handle limit, and when your account was created here.
• Handles and boxes. The handles you claim; for each box you enroll, a label, the time it was enrolled or revoked, and a one-way hash of its credential (never the credential itself); and a random per-box web origin label. If you use "sign out all devices", we store the time of that cut-off. If you block a person from one of your boxes, we store the sign-in identity you blocked (a GitHub username or an email address) and when.
• Box telemetry. Each enrolled box checks in about once a minute; we record when it was last seen and which signed configuration it has accepted. Unless you turn telemetry off in the app's Settings, the box also reports its agent version and connection statistics: how many connections were direct, relayed through TURN, or relayed over WebSocket, by device type (desktop, mobile, or unknown), why connections were relayed, the names of browser push services it refused, when the box started counting, and the time of its most recent connection. We keep the latest report per box. While telemetry is on, we also keep a connection history for each handle: for each hour, how many connections were direct, relayed through TURN, or relayed over WebSocket; when the reported agent version changed; and when the box went offline and came back online. It feeds the connection chart on your dashboard, which only you can see, and it holds no IP addresses or device names. A box that goes offline within 45 minutes of its last report can still have that offline time and its return recorded after you turn telemetry off. Telemetry never includes terminal content, commands, keystrokes, or files.
• Your terminal sessions. Terminal traffic between your browser and your box is end-to-end encrypted once you have trusted the box on first connect. Our signaling and relay services pass it along without being able to read it, and we do not store it.
• Feedback. When you send feedback, we store your message, the page you sent it from, your browser's user-agent string, and your GitHub username and ID. Each message is also filed as an issue in our private GitHub repository so we can track the fix.
• Terms acceptance. Which version of the Terms of Service you accepted, how (dashboard, box enrollment, or checkout), and when.
• Billing. Payments are handled by Stripe, and purchases are sold through Link, Stripe's merchant-of-record service. Link collects your payment details, billing address, and the information needed for tax, under its own privacy policy. We never receive your full card number. From Stripe we receive and store your Stripe customer and subscription IDs, your subscription status and plan, the renewal date, whether you have cancelled, and whether a payment has failed.
• Development-build testing (optional). If you opt in to help test development builds, your box reports total active terminal time per agent version. Totals only, never content. Opting out deletes what it sent.
• Emails you send us. Mail to legal@troxel.tech or our support address is delivered to our mailboxes, which are hosted by Google.
• Technical data. Like any web service, our providers process your IP address and request details to deliver the service and protect it from abuse. Our signaling service uses your IP address to rate-limit connection attempts. Our servers keep short-lived operational logs, which can include handle names and error messages. Short-lived sign-in records, such as a pending box sign-in code, expire within about 15 minutes.
• Cookies and browser storage. We use cookies only to keep you signed in. The web client stores its sign-in tokens and cached code in your browser's storage. We use no advertising or analytics trackers.

3. How we use it

We use this information to operate, secure, and support the service, to run trials and subscriptions, to fix problems you report, and to meet legal obligations. We do not sell your personal information, share it for advertising, or use it to build advertising profiles.

4. Service providers

We rely on these providers, which process data for us:

• GitHub: sign-in, and the private repository where feedback is tracked.
• Cloudflare: hosting, our database and key-value storage, sign-in for the dashboard and your boxes (Cloudflare Access), the TURN relay, and email routing.
• Stripe, including Link as merchant of record: payments, subscriptions, receipts, and sales tax.
• Google: the mailboxes that receive email sent to us.

Push notifications are sent by your own box directly to your browser's push service; they do not pass through our servers. We may disclose information if the law requires it, or to protect the service and its users.

5. How long we keep it

• Account data, handles, boxes, terms acceptances, and billing status: while your account exists. Releasing a handle deletes its boxes and their telemetry.
• Box telemetry: each new report replaces the last. Connection history is kept for up to 30 days, and at most the newest 3,000 entries per handle. Turning telemetry off stops new history but does not delete what is already kept; it ages out within 30 days. Releasing a handle or deleting your account deletes its history at once.
• Feedback: until it has been dealt with. We are introducing automatic deletion of resolved feedback, and of the issue it created, 180 days after it is resolved; until that is in place, we delete it when you ask.
• Stripe and Link keep payment records for as long as the law requires, under their own policies.
• Operational logs and short-lived sign-in records: days at most.

6. Your choices and rights

• Turn box telemetry off in the app's Settings. Release handles and revoke boxes from your dashboard.
• Delete your account by emailing legal@troxel.tech from the email address on your GitHub account. Deletion removes your account, handles, boxes and their telemetry, terms acceptances, and feedback, and blanks the feedback issues you filed. Cancel any active subscription first; Stripe and Link keep their own payment records.
• You can ask us for a copy of your data, or to correct it, at the same address. Depending on where you live, you may have further rights under local law; we will honor them.
• You can revoke TermTether's access to your GitHub account at any time in your GitHub settings, under Applications.

7. Security

Terminal traffic is end-to-end encrypted once you have trusted the box on first connect. Box credentials are stored only as one-way hashes, and access to our systems is limited. No service is perfectly secure; tell us at legal@troxel.tech if you find a problem.

8. Children

The service is not for anyone under 18. We do not knowingly collect information from children.

9. Where data is processed

We are based in the United States. Our providers may process data in the United States and in other countries where they operate.

10. Changes

We will post any change here with a new date. For a material change we will also tell you on the dashboard or by email.

11. Contact

TROXEL TECH LLC, legal@troxel.tech