Privacy Policy

Termi is an open-source, self-hosted server management platform. There is no central Termi service that collects your data. When you deploy Termi, it runs on infrastructure that you own and operate, and all data it processes is stored in your database.

This policy describes what data a Termi instance handles so that you — as the operator and as a user — understand exactly where your information goes. If you are using someone else's Termi deployment, the operator of that instance is the data controller, not the Termi project.

A Termi instance stores the following in the database you configure via DATABASE_URL:

• Account data — your email address and an Argon2id hash of your password (never the plaintext password).
• Two-factor secrets — your TOTP secret and recovery codes, used to verify 2FA.
• Server connection details — hostnames, usernames, passwords, private keys, passphrases, and notes for the servers you add. These credential fields are AES-256-GCM encrypted before they ever touch the database.
• Organizational data — server groups, sharing invitations, and share records you create.
• Session records — encrypted session cookies (iron-session) with a 7-day lifetime.
• Push subscriptions — if you opt in to monitoring notifications, the browser push endpoint required to deliver them.

• All sensitive credential fields are encrypted at rest with AES-256-GCM. An optional user master key adds a second encryption layer derived with PBKDF2.
• Passwords are hashed with Argon2id, never stored or logged in plaintext.
• Connections to your servers are brokered through short-lived 5-minute JWE tokens — credentials are decrypted only at connection time and are never sent to the browser.
• Server-Side Request Forgery (SSRF) protection validates every user-supplied host before a connection is attempted.

For the full technical breakdown, see the Security page.

The Termi project does not operate any analytics, tracking, or telemetry. There is:

• No analytics or behavioral tracking.
• No advertising or third-party ad networks.
• No selling or sharing of personal data — there is no central party to do so.
• No phoning home — your instance does not transmit usage data to us.

A default Termi deployment talks only to the servers you choose to connect to and the database you provide. Depending on the optional features you enable, your instance may additionally communicate with:

• guacd (Apache Guacamole daemon) — required for RDP/VNC, typically run alongside your instance on port 4822.
• A web push service— your users' browser vendor push endpoints, used only if monitoring notifications are enabled.
• An SMTP/email provider — if configured, used to send server sharing invitations and password-reset emails.

These integrations are configured by the instance operator. The Termi project does not receive any data from them.

Termi uses a single encrypted, HTTP-only session cookie (iron-session) to keep you signed in. It is strictly necessary for authentication and is not used for tracking or advertising. The session expires after 7 days, and signing out invalidates it.

Because Termi is self-hosted, you and the instance operator have direct control over all stored data:

• Access & export — all data lives in your own database and can be queried or exported directly.
• Rectification — account details and server entries can be edited at any time from the app.
• Erasure — deleting your account or a server entry removes the associated records from the database.

We may update this policy as Termi evolves. Material changes are reflected in the “Last updated” date above and tracked in the project's public Git history.

Questions about this policy or about Termi's data handling? Open an issue on GitHub or email shuvo.punam@gmail.com.