PRIVACY

Privacy policy.

CloverTerm is a local-first tool: your working data does not leave the device by default. This page names every single thing the app exchanges with our servers — there are three, all listed below.

Last updated: 2026-09-29

Credentials never leave secure storage

Passwords, private keys and access tokens go only into Keychain, DPAPI or Keystore. They are never uploaded.

Sync is end-to-end encrypted

The key is derived on your device from your Sync Password. Your repository holds ciphertext only.

No ads, no tracking

No behavioural analytics, no advertising identifiers, no data shared with third parties.

01 · WHAT WE COLLECT

Three things. That is all.

None of the three contains host data, and all are anonymous per device — before you sign in, our servers do not know who you are, only that a device exists.

Usage statistics

UsageStatsNo account
Contents
Platform, app version and distribution channel (where the installer came from), plus a local installation ID (generated at random on first launch), sent once per launch. No other field — each one is listed on the security page.
Identity
Anonymous per device: while you are signed out, our servers only see that a device exists — not whose it is — and no sign-in is required. Once you sign in, the heartbeat carries your session and the device joins your account; a device name appears only then, as part of the device list.
Purpose
Counting active devices (a heartbeat in the last thirty days), to decide where to spend effort. Contains no host data.
Turning it off
It shares one switch with error reports in settings. Off means off.

Error reports

ErrorReportNo account
Contents
A record of an unhandled error inside the app (the app keeps running afterwards), containing only this: app version, platform, error type, the redacted first line of the message, and stack frames from our own code, plus when it happened.
Excluded
No logs and no user data — host names, host addresses, usernames and file paths in the message are replaced before sending, and there are no terminal contents.
Purpose
Finding and fixing defects. Covers unhandled errors inside the app only; app crashes and freezes are not reported.
Turning it off
Shares a switch with usage statistics. Everything is redacted before sending.

Device list

DeviceListAfter sign-in
Contents
The devices under your account: one row each, with a device name and platform, visible and removable in account settings.
When it appears
Only after you sign in and confirm this device on the website. The anonymous device from before and this row are the same device at two stages, not two things.
Purpose
So you can recognise every device holding a session, and sign any of them out remotely.
02 · WHAT WE DON'T

And what we never collect.

  • Host addresses, ports, usernames and other connection settings
  • Credentials: passwords, private keys, access tokens (secure storage only)
  • Terminal input, output and command history
  • Files transferred over SFTP and remote directory contents
  • Behavioural analytics and interaction tracking
  • Advertising identifiers and any third-party sharing
03 · SELF-HOSTED SYNC

Where the data goes once sync is on.

The backend is your own private GitHub or Gitee repository; our servers never handle synced data. The flow: local data is packed into a snapshot → encrypted with the sync master key via AES-256 → pushed to your repository. The master key is derived on your device from your Sync Password via Argon2id and cannot be recovered from anywhere — which means nobody outside your devices can read the synced contents, including us.

The access token used to reach the repository lives in system secure storage, treated exactly like a password or a private key.

04 · ACCOUNT

Accounts and the feedback community.

Registration needs an email address, used for signing in and recovery. Signing in happens through browser sign-in: after you confirm the device on the website, a one-time callback code is handed back to the app and expires in five minutes; the app then reconciles periodically to check the session is still valid.

The feedback community is an account feature: posts and comments are visible to other users, so avoid pasting host addresses or keys. Not signing in changes nothing about local features.

Checking for updates reads a static release manifest on the website. It does not go through our API and carries no identity.

05 · YOUR CONTROLS

The switches are yours.

  • Stop the reports: one switch in settings disables usage statistics and error reports together. Local features are unaffected.
  • Manage your devices: review every device in account settings and sign any of them out remotely.
  • Delete your account: start it from account settings; email, device list and feedback content are cleared per the retention policy.
  • Take your data with you: hosts, snippets and the rest have always been on your own devices, and the sync snapshot is in your own repository.
06 · RETENTION & CHANGES

Retention and changes to this policy.

Anonymous usage statistics feed a rolling thirty-day count of active devices; individual heartbeats older than that are not kept. Error reports are cleared periodically once fixed. Deleting your account removes the email address and the device list with it.

If this policy changes materially we will update the date on this page and note it in the changelog. Questions are welcome in the feedback community.

// Related: terms of service · security · third-party licences · FAQ