Your terminal stays yours.

Termio's relay holds a small, bounded in-memory cache of recent terminal snapshots for live streaming. It is not written to disk and is dropped when your iOS app disconnects. Other content (Agent Inbox messages, session board summaries) IS persisted on the relay; the table below lists exactly what and where, and how to wipe it. All traffic between your Mac, our relay, and your iOS device is encrypted in transit (TLS). Termio is not end-to-end encrypted — the relay sees plaintext while routing.

Last updated: June 2026

What we store

Server side — account, routing metadata, and platform notifications

users row: id, username, email (optional), display_name (optional), password_hash (scrypt), password_hint (optional), created_at.
daemons row: id, user_id, daemon_token (hashed), machine_name, paired_at, last_seen_at, revoked_at.
pair_tokens row: 5-minute single-use tokens minted at pairing. Deleted on consumption or expiry.
invites row: 6-char codes, single-use, with optional expiry.
Platform notifications: Announcements, product updates, and billing notices we send you. Non-sensitive content authored by us. Never your conversation content.
Auth-event audit log: timestamps, source IPs, action types (login.success, login.fail, register, pair.complete, daemon.connect, daemon.disconnect). No message bodies, no command text, no pane content.

Server side — ephemeral, RAM only

For reconnection robustness the relay holds a short-lived in-memory buffer per pane: about 10 minutes OR 1 MB per pane, whichever comes first. Lives in process memory only — never written to disk, never replicated, never backed up. Dropped the moment your Mac daemon disconnects. Note: this covers the live terminal snapshot stream specifically; other content (Agent Inbox messages, session board summaries) IS persisted on the relay.

Mac side (your daemon)

~/.termio/daemon/.env — RELAY_URL + DAEMON_TOKEN (long-lived pairing credential). File mode 0600.
~/.termio/messages.sqlite — local message history, owner-only (0600). Bounded by 100 MB OR 30 days; oldest rows are dropped, then VACUUM reclaims space.
/tmp/termio-audit.log — metadata-only daemon audit log: per request, the ts, reqId, paneId, textLen, action, and target. Rotates at 10 MB; one previous file kept.

iOS side (your phone)

Warm message cache (SQLite): per-device scrollback under the app sandbox at Library/Application Support/termio/messages.sqlite.
Auth state: JWT in the iOS Keychain. Encrypted at rest, protected by device passcode / Face ID / Touch ID.
Preferences: pane MRU order, dismissed suggestion hashes, live-card display state. No message content.

What we do not store

✗Server: no message content, ever. No tmux output, no pane buffers, no user prompts, no assistant responses. The relay routes; it does not log what was sent.
✗Audit log content body. Both the server-side auth audit log and the daemon-side log record textLen (a number), never text.
✗Backups of your messages.The relay's in-memory replay buffer is the only server-side store of anything resembling pane content, and it evaporates on disconnect. No nightly dump, no S3, no cron-rsync.
✗Third-party tracking & ad SDKs. No advertising or cross-app tracking, no ad SDKs, no data brokers, and no crash reporter feeding a third party. We do keep first-party usage analytics — which features you use (e.g. signing up, pairing a Mac, opening a pane), on our own servers, to understand the product and improve it. It never includes terminal content and is never sold or shared. Debug logs you generate stay on your device unless you choose to share them.

Sign in with Apple

Termio offers Sign in with Apple as an optional authentication method. When you first sign in with Apple, Apple shares the following with us:

Apple user identifier: a stable, team-scoped opaque string that identifies your Apple ID without exposing it. Stored as apple_sub in your account row. We never receive your Apple ID password.
Email address: your real email or Apple's private relay address — your choice at sign-in. Used only for essential account notices; never for marketing.
Display name: your name as provided by Apple at first sign-in, if you chose to share it. Stored in display_name; you can edit or clear it in your account settings.

Account deletion for Apple ID users: delete your Termio account from within the iOS app (Settings → Delete Account) or by emailing ouxiaolong67@gmail.com. Revoking Termio in your Apple ID settings (Settings → Apple ID → Password & Security → Apps Using Apple ID) invalidates your session but does not delete your Termio data — use one of the methods above for full deletion.

Where your data lives

Data	Location	Who can read it
Account row	Relay box, MySQL	Operator (you)
Apple identifier — apple_sub (SIWA only)	Relay box, MySQL	Operator
Platform notifications	Relay box, file-backed per user	Operator + you
Daemon token	Mac ~/.termio/daemon/.env (0600)	Your macOS user
Pair token	Relay memory + DB, 5 min TTL	Operator
Message history	Mac ~/.termio/messages.sqlite	Your macOS user
iOS warm cache	iOS app sandbox (encrypted by iOS)	Your phone, when unlocked
JWT	iOS Keychain	Your phone, when unlocked
Replay buffer	Relay process RAM	Operator (in process)
Audit log	Mac /tmp/termio-audit.log	Your macOS user

How to delete your data

iOS: Settings → Sign Out wipes the local message cache, JWT, pane MRU, and preferences on this device.

Mac daemon: Stop the daemon, then rm -rf ~/.termio/ removes all local state including the message history and daemon token.

Account: Email ouxiaolong67@gmail.com to request account deletion. The server-side account row, daemon rows, and invite records will be purged within 7 days.

Sign in with Apple accounts: use the in-app deletion (Settings → Delete Account) or email us. Revoking Termio in your Apple ID settings invalidates your session but does not remove your stored data — a full deletion request is required for that.

Contact

Privacy questions or data-deletion requests: ouxiaolong67@gmail.com