Privacy

Updated November 11, 2026. llterm is provided by SiteVue AI Inc.

On your computer

Terminal sessions run on your computer. Workspace layout, directories, preferences, and approved-device credentials are saved locally. System charts keep at most two minutes of readings in memory.

Remote connections

Remote access is optional. Pairing requires approval on the desktop. Terminal content and input are encrypted between the desktop and companion. The relay forwards encrypted messages and does not save terminal content or pairing secrets.

The relay temporarily holds connection and routing identifiers. Our hosting provider Railway retains request metadata, including IP addresses, browser or app user agents, request paths, response status and timing, for service diagnostics, security and reliability. These hosting logs are separate from the anonymous download totals described below; they are not used for cross-company advertising tracking.

On your phone

The native companion stores paired-computer credentials in operating-system secure storage. The browser companion keeps these credentials for the current page session. You can forget a computer in the companion or revoke its access on the desktop.

When enabled, camera access is used to scan pairing QR codes. Biometric checks are handled by your device; llterm does not receive Face ID or fingerprint data. Passkey private keys remain with your passkey provider.

Accounts and billing

When you create a remote-access account, we store the account name and email address you enter, passkey public keys, membership and computer-access records, and subscription status. Stripe handles web payments; Apple handles App Store purchases. llterm stores subscription identifiers and verified purchase status, not card numbers.

If your email’s domain belongs to an organization that uses llterm, we send a short-lived code to confirm it during signup and add you to that organization; members do not choose a plan. Organization owners and members verify their work email with a short-lived code. We store the verified email and membership; our email provider Resend delivers verification codes. Organization owners and administrators can see member names, verified work emails, roles, join dates and activity. We retain each membership’s last-seen time and 30 days of daily active-minute totals from authenticated account visits and remote connections. Connected idle time can count. We do not collect terminal content, commands or keystrokes for activity reporting. Removing a membership or deleting an account deletes its activity records.

Organization usage

While remote access is enabled on an updated desktop linked to a Corporate workspace, llterm sends prompt counts and sampled counts of open, working, needs-input and unknown-state terminals to the account service. Owners and administrators can view hourly graphs and staff comparisons for their organization. These records contain no prompt text, terminal content, commands, keystrokes, file paths or project names. Counts are attributed to the account that linked the computer, including companion input. Missing hooks and disconnected desktops limit coverage; sampled activity is not a measure of productivity or exact LLM wait time.

Samples are retained for 30 days. Turning off Remote stops collection. Removing a computer, removing a membership or deleting the account deletes its usage samples.

Download counts

We count file transfers from this website by day, platform, release version, and file, including bytes served and resumed requests. These aggregate counts contain no IP address, user agent, account identifier, or other visitor identifier. They measure server transfers, not unique people or installations, and are visible only to designated service administrators.

Signup attribution and service administration

When you arrive through a tagged campaign link, a first-party cookie remembers the first campaign source, medium, campaign, and creative tag for up to 30 days. If you create an account in that browser, these tags are saved with your account to help us understand which channels bring new users. This cookie contains campaign labels and a timestamp, not a unique visitor ID. We do not use third-party advertising pixels or collect full referrer URLs for this feature. Clearing this cookie removes attribution for a later signup; it does not change a source already saved with an account. Account deletion removes the saved attribution.

Designated SiteVue service administrators can read accounts, organization memberships, verified work emails, subscription status, aggregate usage, and signup attribution across organizations to operate the service. This access requires a recent passkey sign-in and does not provide terminal content or terminal control.

Local app previews

Opening a development server from your phone requires approval of its port on the desktop. Preview traffic travels through the encrypted device connection. It is not published at a public URL. The app closes its local proxy when the preview ends or the app goes into the background.

Controls and deletion

Turn off Remote on the desktop to disconnect companions. Revoke individual devices to remove their saved permission. Deleting the companion removes its local app data; revoke its access on the desktop as well.

Delete your account from Account settings in the app or on the website. This removes your account credentials, sessions and memberships. Billing providers retain records under their own policies. We retain an Apple purchase's original transaction identifier, account identifier and environment to prevent the purchase being claimed by another account. Deleting an account does not cancel an Apple subscription; cancel it separately in Apple's subscription settings.

For privacy questions or requests about account data, send feedback through the llterm TestFlight beta.