Privacy
Your logs deserve restraint.
Terminal3 handles some of the most sensitive text a developer has. This page describes what actually happens to it — including the parts that aren't reassuring.
Last updated 13 August 2026
The short version
- Saved incidents, runbooks and preferences stay in your browser on your device.
- Text you submit for analysis is sent to a third-party AI provider to be analysed. It leaves your device.
- There is no Terminal3 account, and we don't store your incidents on a server.
- Remove secrets before pasting production logs.
What's stored on your device
Incidents you analyse, runbooks you save, and your app preferences are written to your browser's IndexedDB storage (or localStorage where IndexedDB isn't available). That data never leaves the device, isn't readable by us, and isn't synced anywhere.
Clearing your browser's site data — or using Clear local incident history in the app's profile screen — removes it permanently. There is no backup, because there is no server-side copy.
What leaves your device
When you run an analysis on your own input, that text is sent to the Terminal3 server and forwarded to a configured AI provider. We don't write it to a database or log it as part of normal operation, but it is processed by that provider under their terms and retention policy, which we don't control.
The bundled sample incidents are the exception: their analyses ship with the product and are returned without contacting any model provider at all.
Secret detection
Before anything is submitted, Terminal3 scans your input in the browser for patterns that commonly indicate credentials — cloud access keys, API keys from major providers, JSON Web Tokens, private key blocks, bearer tokens, and passwords embedded in connection strings. If it finds any, it stops and shows you what it found, masked, with the option to redact them automatically.
This is a heuristic and should be treated as one. It will miss credential formats it doesn't recognise, and it will occasionally flag text that isn't a secret. It is a safety net, not a substitute for reading what you paste. If a live credential does reach the field, rotate it — by that point it has been in your clipboard, and likely your shell history, too.
What we don't claim
Not end-to-end encrypted. Analysis requests travel over HTTPS, but the server and the model provider necessarily see the plaintext in order to analyse it. Claiming end-to-end encryption would be false.
Not zero retention. We don't retain your input, but the model provider's retention policy applies to their copy of the request, and the architecture doesn't guarantee zero retention end to end. We won't claim otherwise.
No compliance certifications. Terminal3 is a beta product from a single developer. It has no SOC 2, ISO 27001 or HIPAA attestation, and it should not be used with regulated data.
Analytics and cookies
Terminal3 sets no analytics or advertising cookies and runs no third-party trackers. One functional cookie is set only if you explicitly ask to view the marketing site on a mobile device, so that preference is remembered.
Children
Terminal3 is a developer tool and isn't directed at children under 13. We don't knowingly collect information from them.
Changes
If this policy changes in a way that affects what happens to your data, the date at the top of this page changes with it.
Contact
Questions about any of the above: hello@terminal3.fun.