moshterm Privacy Policy

Effective 12 November 2026

moshterm is a terminal for coding agents, made by Mick Giles. This policy explains what the moshterm apps and their optional services collect and why.

What stays on your devices

• Everything you type and see in the terminal travels directly between your phone and your own computers. moshterm's servers never see your terminal output, your files, your prompts, or your agent conversations.
• Host credentials — passwords, SSH keys, and pairing tokens — are stored only in your device's secure storage (iOS Keychain, Android Keystore) and sent only to your own computers.
• The moshterm companion (the optional host-side helper) runs on your own machine, under your own account. Its state lives in your home directory.

What the moshterm relay receives (optional)

Push notifications and the disconnected inbox are optional features served by a small relay (mickmosh-relay.mick-fb5.workers.dev). If you use them, the relay stores:

• an anonymous, per-install license identifier (a random UUID) and its key (stored hashed);
• the host records you register: a host id, a hashed host secret, and the name you gave the host;
• device push tokens (Apple APNs or Google FCM) needed to deliver notifications;
• compact metadata about agent activity on your hosts — event kinds, session identifiers, and counts. Never terminal content, never prompts, never file bodies;
• sealed inbox snapshots: end-to-end sealed payloads the relay cannot read;
• files you share through the built-in pastebin, until they expire and are deleted.

Purchases

moshterm Pro subscriptions are processed entirely by Apple or Google. To verify a purchase we receive only the transaction identifiers those stores provide — never your name, email, or payment details. Purchases bind to the anonymous license id of your install; no account is created.

Usage and diagnostics data (anonymous, opt-out)

The apps can send anonymous, opt-out usage and crash diagnostics. The data is limited to a published allow-list: event names (for example app opened or purchase completed), device model/OS/app-version facts, and crash details (the failing code location and device state at the time of the crash). Events are tied to a random identifier that is not linked to you and rotates whenever you turn sharing off and on again. The anonymous diagnostics never store IP addresses or use them to infer your location.

• Never collected: terminal content, prompts, commands, agent conversations, hostnames, SSH usernames, SSH keys or other credentials, file paths in your home directory, clipboard contents, or dictation text. The anonymous diagnostics never include an advertising identifier and are never used for advertising or tracking — the separate, permission-gated install attribution below is the only exception, and only if you allow it.
• Processors: Sentry (Functional Software, Inc. — crash and error reports) and Mixpanel, Inc. (usage events). They process the data on moshterm's behalf and nothing else. The relay itself is hosted on Cloudflare Workers under the same zero-knowledge posture.
• The switch: Settings → General → “Share anonymous usage and diagnostics” (on by default). Turning it off stops both services — nothing further is sent — and rotates the anonymous identifier.
• The companion is separate: crash reporting on the host companion is off by default and only runs if you turn it on (the host's Options in the app, or moshterm-hook set telemetry on). Reports are scrubbed of your home directory, hostname and usernames before they leave your machine.
• The relay: the push relay's own error reporting records only a route, a status and an error code — never request bodies, headers, tokens, identifiers or IP addresses.

Install attribution (only with your permission)

If you allow tracking, the apps use Linkrunner to learn which link or campaign an install came from and to open the page that link pointed to. On iOS a short explainer comes first, then Apple's tracking prompt; on Android the app asks the same question itself. Allowing it sends Linkrunner:

• the install's device facts (device model, OS and app version, language and time zone) and, on iOS, the advertising identifier;
• the internet address its requests come from, which Linkrunner resolves to a country, state or city;
• the link the install arrived from, and the allow-listed purchase events (for example “purchase completed”) so a subscription can be credited to the campaign that brought it.

• Declining changes nothing: without your permission the attribution software is never started and nothing is sent to Linkrunner — every feature keeps working.
• Never sent to Linkrunner (or anyone): anything from the never-collected list above — no terminal content, prompts, commands, agent conversations, hostnames, usernames, keys, file paths in your home directory, clipboard contents, or dictation text.
• Turn it off any time: Settings → General → “Share anonymous usage and diagnostics” stops it, and on iOS the system tracking choice (Settings → Privacy & Security → Tracking) is honored at every send.

What we never do

• No accounts, emails, names, or addresses.
• No advertising in the apps, and no selling or sharing of your data for anyone else's purposes. Install attribution is used only if you allow tracking (above); declining changes nothing.
• The relay never receives terminal content.

Retention and control

• Relay records exist while your license is active. Deleting your license in the app removes the license and its relay records.
• Shared pastebin files expire and are deleted.
• You can stop all relay use at any time — without push, moshterm keeps working: connections, the terminal, approvals, chat view, and reviews all run directly between phone and computer.