Privacy Policy

Last updated: 23 October 2026

The short version. TermRover has no accounts and no backend of ours. Your SSH keys, credentials, host profiles, and settings stay on your device, secured with each platform's recommended storage (Android Keystore, iOS Keychain) — we never receive or sell them. The only data sent on our behalf is diagnostics (crash reports and aggregate usage analytics), used to fix bugs and improve the app. It never includes your hosts, credentials, or terminal contents, carries no advertising ID, and you can turn it off in Settings. If you use Agent Calling, your call audio and your coding agent's recent conversation go to OpenAI, which provides the call's voice, and never to us.

TermRover is an SSH and tmux terminal client for iOS and Android. This policy explains what it stores on your device and the only times data leaves it: your own SSH connections, optional voice dictation, optional Agent Calling, and opt-out diagnostics.

What TermRover stores on your device

Host profiles — the hostnames, ports, usernames, and tmux preferences you enter for the servers you connect to.
Credentials — the SSH passwords and private keys you add, held in each platform's recommended secure storage (an AES-256-GCM blob keyed by Android Keystore on Android; iOS Keychain on iOS). Your private key never leaves the device — it's used locally to sign SSH authentication challenges.
Known server keys — the fingerprint of each server's host key, so the app can warn you if it ever changes (a sign of a possible interception).
Local preferences — theme, font size, and your open tabs, so sessions restore between launches.
Agent Calling settings: the voice service and voices you choose, a record of the hosts where you installed TermRover's calling helper, and, if you add one, your OpenAI API key, held in the same secure storage as your credentials.

All of the above is stored locally. TermRover has no backend; none of it is uploaded to us, and it is not included in diagnostics. The only exceptions are an OpenAI API key you add for Agent Calling and your choice of voice, which go to your own host for a call, as described below.

SSH connections

When you open a session, TermRover connects directly from your device to the server you specified, over the SSH protocol. The contents of that session — what you type and what the server returns — flow only between your device and that server. We are not a relay or proxy and have no visibility into this traffic.

Voice dictation (optional)

If you use the microphone button, the app records audio only while you're actively dictating and converts it to text using your platform's built-in speech recognition (Apple's Speech framework on iOS, Android's SpeechRecognizer). Depending on your device, that may run on-device or be sent by the OS to the platform provider (Apple or Google) under their privacy policy, not ours. TermRover never stores the audio or sends it to us — only the resulting text lands in the command composer for you to review.

Agent Calling (optional)

Agent Calling lets you talk by phone with a coding agent (Codex, Claude Code, pi or OpenCode) running on one of your hosts. OpenAI provides the call's voice, whichever agent you call. Nothing goes to OpenAI until you start a call.

Your voice goes directly to OpenAI. During a call, the app streams your microphone audio over an encrypted WebRTC connection from your phone directly to OpenAI, and the voice's replies come back the same way. The audio does not pass through your host or through any TermRover server, and TermRover does not record or keep it.
TermRover's helper on your host. To set up a host, TermRover asks your permission, then installs a small Node.js helper in ~/.termrover on that host and keeps it up to date with the app (for pi or OpenCode, also a small extension or plugin, when you install it). When a call starts, the helper sends OpenAI your agent's recent conversation (its latest turns, up to a size limit), with the conversation's name and working folder, so the voice knows the context. During the call it also sends the agent's new messages, replies and progress, including anything typed in the agent's terminal. This happens whichever agent you call, including Claude Code, pi and OpenCode. For a Codex call on a Codex subscription, Codex itself on your host runs the voice session and supplies that context.
What reaches your agent. OpenAI transcribes what you say, and your requests reach the agent as ordinary messages in its conversation, handled by that agent and its own AI provider like anything you type there. Photos or files you attach during a call are uploaded over your SSH connection to ~/.termrover/uploads on your host and handed to the agent; TermRover does not send them to OpenAI. They stay on your host until you delete them.
With a Codex subscription, the voice runs on the Codex sign-in (your ChatGPT account) on that host. Your Codex credentials stay on the host: the app only learns whether Codex is signed in there.
With your own OpenAI API key, the key is stored on your phone in secure storage. For each call, the app sends it over your SSH connection to the helper on your host, which uses it to start the voice session with OpenAI. The helper holds the key in memory for that call only and never writes it to disk. OpenAI bills the key's account.

TermRover's own infrastructure never receives your call audio, your agent's conversation, your Codex credentials or your API key. What OpenAI does with the audio and context it receives, including whether and how long it keeps them, is governed by OpenAI's terms and policies (for an API key, the terms of your OpenAI API account) and its privacy policy, not by ours.

Permissions we request

Internet — to open SSH connections to your servers.
Microphone: for the optional voice dictation feature, and during an Agent Calling call, to stream your voice to OpenAI as described above. TermRover uses the microphone only while you are dictating or on a call.
Notifications & foreground service (Android): to keep an active session connected briefly while the app is backgrounded, and to keep an agent call running while the app is in the background or the phone is locked, each with a visible notification.
Phone calls: agent calls are placed through your phone's own calling system (Android's self-managed calls, iOS's LiveCommunicationKit), so the lock screen and Bluetooth devices can show and control them. TermRover does not read your phone calls or call history, and agent calls are not added to your recent calls.

Diagnostics (Firebase)

To fix bugs and understand how the app is used, TermRover sends two kinds of diagnostic data to Google's Firebase on both iOS and Android, enabled by default:

Crash reports (Crashlytics) — the stack trace, device model, OS and app version, and coarse state like available memory when the app crashes.
Usage analytics — aggregate app-usage events, such as which screens are opened and how often sessions start, plus device model and OS version.

Both are tied only to a random, app-generated install identifier — never your name or email — and carry no advertising ID (no Apple IDFA; Android Advertising ID collection is turned off). They never include your hosts, usernames, credentials, known-host data, command history, or terminal input/output. We don't sell or share your data, build ad profiles, or track you across apps or sites. Google processes this data on our behalf under its Firebase terms and retains it on a limited rolling basis (crash data ~90 days).

Your choice. Turn diagnostics off any time in Settings → Diagnostics ("Share crash & usage data").

Data retention and deletion

Because everything is stored locally, you're in control: delete individual host profiles in the app, or uninstall TermRover to remove all of its stored data from your device. The only data held on our behalf is the diagnostics above; to request its deletion, contact us below.

If you set up Agent Calling, TermRover's files on your own hosts live under ~/.termrover (the helper, call attachments, and a log of any messages that never reached your agent), plus the pi extension or OpenCode plugin if you installed them. Delete them to remove Agent Calling from a host. Data sent to OpenAI during a call is handled under OpenAI's policies linked above.

Changes to this policy

If this policy changes, we'll update the date above and post the revised version here. If we ever add a feature that collects or transmits data not described above, we'll disclose it before it ships.

Contact

Questions about privacy? Email [email protected].