Your terminal stays yours.

Inbox pruning runs before each append. Non-pinned existing messages older than seven days are removed, and at most the newest 500 non-pinned existing messages are kept. A new non-pinned append can bring that count to 501, plus up to 20 pinned decisions (521 total). Reading a quiet thread does not trigger this age pruning.

The newest 20 open decision cards per thread are exempt from that message age/count pruning. Decided or withdrawn cards, and any open cards outside the newest 20, use the non-pinned limits. This is not permanent retention: a separate daily worker archives threads idle for 14 days and purges threads archived for more than 30 days, including open decisions. Manual archive hides a thread until purge.

Tasks normally archive after 24 hours of completed inactivity or seven days when orphaned, subject to eligibility and live-child checks. The daily task purge uses 30 days for archived owner-verified tasks and 90 days for other archived tasks. Removing database references is not a promise that every screenshot byte is deleted at that same moment.

Scheduling, downtime and errors can delay physical cleanup. Attachment references and separately expiring uploaded files have different lifetimes. Optional administrative Inbox cleanup can also create backup copies of whole threads; these copies have no automatic age limit and are not removed by ordinary thread pruning or account-directory cleanup.

The relay replay ring is per account and pane, with a ten-minute age limit and approximately 1 MB serialized-content budget per pane, enforced on reads/appends. It is RAM only; an idle ring can remain allocated until activity or cleanup. The budget measures string length, not total process memory.

Disconnecting a phone or browser does not clear replay. It bridges reconnects. The account ring is cleared when its last connected Mac daemon disconnects, or lost when the relay process exits. Disconnecting one of several Macs does not clear the whole account ring.

Raw terminal attachments use separate memory-only passthrough sessions. Pending frames flush when the daemon attaches; session state is released on close or idle eviction (five minutes by default). Neither buffer clears tmux scrollback, local history or client caches. Content copied into an Inbox message, task, screenshot or feedback report follows that persisted surface's lifetime.

The Mac stores pairing credentials in ~/.termio/daemon/.env and local history in ~/.termio/messages.sqlite, with owner-only permissions. History defaults to seven days and approximately 100 MB of estimated row content, enforced at startup and every 100 inserts. Oldest rows are removed with incremental vacuum; this is not a hard total-file size limit or a timer while the daemon is stopped.

The Mac audit log records request metadata such as text length, not request text; it rotates at a 10 MB threshold and retains two previous generations. This is not a hard total disk-space cap. Native clients also keep local credentials, preferences and caches. iOS stores its JWT in Keychain and warm message cache in its app sandbox. Uninstalling the app removes sandbox data but should not be treated as guaranteed Keychain erasure.

iOS automatically queues MetricKit crash diagnostics and attempts to upload them to our relay. Android automatically records crashes and attempts to send pending reports through its relay connection. Turning off the mobile anonymous-diagnostics setting does not disable these self-hosted crash-reporting paths. The Mac’s Share Crash Reports setting controls Mac crash collection/upload and defaults to enabled. Separately, iOS can send crashes to third-party Sentry when configured; Share anonymous diagnostics controls that path and defaults to enabled. Turning it off stops Sentry reporting, but not the separate MetricKit reports to our relay.

Mac crash reporters scrub home-directory and username strings, but diagnostic free text can still contain other paths or sensitive details. Product analytics are separate from terminal-stream storage; there are no advertising or cross-app tracking SDKs. The public site can load configured Umami analytics and uses a 30-day first-touch referral/campaign cookie; source attribution can be passed to download links.

Sign in with Apple shares a team-scoped Apple identifier, your chosen real/private-relay email and an optional name. We never receive your Apple ID password. An Apple-only account does not need a password hash; setting or linking a Termio password can add one. Revoking Apple authorization does not delete your Termio data.

Sign out to clear the current device's authentication and account-scoped caches. This does not delete the relay account or other devices' data. Stop the Mac daemon before removing local state; local deletion does not revoke the relay credential by itself.

Settings → Delete Account in iOS or Android removes the account and its dependent authentication, device, task, feedback and other owned database records. Audit/telemetry attribution is scrubbed where specified; selected billing facts remain without the account ID. The route closes live sessions and attempts cleanup of Inbox, Board, notification, uploaded-file and image files after the database transaction. File cleanup and external billing cleanup are best effort, not an atomic guarantee that every byte is gone.

This applies to Apple sign-in accounts too. If you cannot sign in, email us to request account deletion.