Privacy Policy

Last updated: May 9, 2026

1. Information We Collect

Account Information

• Phone Number: If you choose SMS authentication, we collect your phone number for verification purposes.
• OAuth Identity: If you sign in via Apple, Google, or GitHub, we collect the email address and unique identifier provided by the OAuth provider.
• Guest Access: Guest users are assigned a temporary identifier; no personal information is collected.

Service Data

• Session Metadata: We store session start/end times, session titles, and working directory paths to enable session persistence and reattachment.
• Terminal Sessions: Terminal session output is streamed in real-time and is not persistently logged on the Gateway. We do not record keystrokes or terminal content.
• Device Information: Device model, operating system version, and app version are collected to optimize the mobile experience.

Communication Data

• SignalR Connection: Real-time terminal sessions use SignalR over WebSockets. Connection metadata (IP address, connection duration) is temporarily held in memory.

2. How We Use Your Information

• To authenticate your identity and authorize access to the Service
• To establish and maintain real-time terminal sessions between your browser and remote Workers
• To enable session persistence (detach/re-attach)
• To improve the Service, fix bugs, and enhance security
• To communicate with you about service updates (only if you have opted in)

3. Data Storage and Retention

• Authentication tokens (JWT): Stored in your browser/device local storage. Tokens expire and are refreshed automatically.
• User accounts and sessions: Stored in the Gateway's PostgreSQL database. When self-hosting, you manage this database entirely.
• Retention: Session metadata is retained until you delete the session. Account data is retained until account deletion is requested.
• Data Deletion: You can request deletion of your account and associated data by opening an issue on our GitHub repository or contacting us through the project page.

4. Third-Party Services

• Apple, Google, GitHub: Used for OAuth authentication. We receive only the information you authorize (email, name, identifier).
• SMS Provider: Used for phone number verification (if SMS login is enabled). Phone numbers are shared only for the purpose of sending verification codes.
• Google Play Services: The Android app is distributed through Google Play and uses Google Play Services for core device functionality.
• Apple App Store / TestFlight: The iOS app is distributed through Apple's App Store and TestFlight.

5. Open Source and Self-Hosting

Corterm is open source under the MIT License. You are encouraged to self-host the Gateway and Workers on your own infrastructure. When self-hosting:

• No data is sent to Corterm-operated servers
• All data remains within your own network and database
• You are responsible for the security and privacy of your self-hosted deployment
• The source code is available at github.com/monster-echo/CortexTerminal2

6. Data Security

We implement appropriate technical and organizational measures to protect your information:

• All communications are encrypted via TLS/HTTPS
• JWT tokens are signed and have configurable expiration
• Password-equivalent secrets are never stored in plaintext
• Real-time terminal traffic uses WebSocket with MessagePack binary encoding over TLS

7. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you
• Request correction or deletion of your personal data
• Restrict or object to processing of your personal data
• Data portability
• Withdraw consent at any time (where processing is based on consent)

To exercise these rights, please contact us through the channels listed below.

8. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last updated" date. For significant changes, we may provide additional notice through the app or our GitHub repository.

9. Contact

If you have questions about this Privacy Policy or wish to exercise your data rights, please contact us:

• GitHub: github.com/monster-echo/CortexTerminal2
• Issues: Open a GitHub Issue