Privacy Policy
Last updated: October 2026
Overview
Clu is built with privacy by design. We collect only the minimum data necessary to provide the service. Your terminal traffic is end-to-end encrypted and we cannot read it. This policy explains exactly what data we collect, why, and how long we keep it.
Key Privacy Principles
- ✓Zero-knowledge encryption: All terminal traffic is encrypted on your device (browser or iOS app). We cannot read your commands or output. Per-session forward secrecy ensures past sessions cannot be decrypted even if your device key is later compromised.
- ✓Minimal collection: We only collect data required to operate the service.
- ✓No selling: We never sell your data to third parties.
- ✓Data deletion: Delete your account yourself in Settings → Delete account: your machines are revoked, your subscription is cancelled and every record keyed to your account is removed. What it removes, and the little it keeps.
Data We Collect
User Profile
Subscription and billing information only. We do not duplicate your email or name.
| Field | Purpose | Example |
|---|---|---|
| id | Unique identifier (links to auth) | a1b2c3d4-e5f6-... |
| stripe_customer_id | Link to Stripe for billing | cus_abc123... |
| subscription_plan | Current plan (free, pro, team) | pro |
| created_at | Account creation timestamp | 2026-01-15T10:30:00Z |
Note: Your email, name, and avatar are stored by your OAuth provider (GitHub/Google) and accessed only during login. We do not duplicate this data.
Registered Devices
Information about machines you connect to Clu.
| Field | Purpose | Example |
|---|---|---|
| id | Unique device identifier | d1e2f3g4-h5i6-... |
| name | Display name you choose | Home MacBook Pro |
| os | Operating system (for display) | darwin |
| arch | CPU architecture (for display) | arm64 |
| agent_version | Agent software version | 0.4.7 |
| status | Online/offline indicator | online |
| auth_token_hash | Hashed auth token (not plaintext) | e3b0c44298fc... |
| push_token | APNs token for iOS push notifications | a1b2c3d4e5f6... |
| token_revoked_at | JWT revocation timestamp | null |
Note: Your encryption key is NOT stored on our servers. It exists only on your device and in your browser or iOS app.
Registration Tokens
Codes that pair a machine with your account. A used code is deleted 10 minutes after use; one never used is deleted when it expires.
| Field | Purpose | Retention |
|---|---|---|
| token_hash | Hashed code (not plaintext) | 10 minutes after use, or until it expires |
| expires_at | When an unused code stops working | 5 minutes for a pairing code, 30 minutes for a cloud machine, 1 to 30 days (you choose) for a provisioning code |
| label | The name you give a provisioning code | Deleted with the code |
MFA Recovery Codes
Hashed backup codes for two-factor authentication recovery.
| Field | Purpose | Example |
|---|---|---|
| code_hash | Hashed recovery code (not plaintext) | a9f3e2d1c0... |
Note: Recovery codes are hashed with SHA-256. We cannot recover them for you.
Operational Data
Technical data for service operation, automatically cleaned up.
| Data | Purpose | Retention |
|---|---|---|
| Rate limit counters (keyed by IP address, account or device) | Prevent API abuse | 1 hour |
| Webhook event IDs | Prevent duplicate processing | 30 days |
Note: A database job deletes each kind of record once its period is over: rate limit counters every 5 minutes, registration codes every 5 minutes, webhook event IDs every hour. A record can outlive its period by up to that interval.
What We DON'T Collect
- ✗Terminal commands: Your commands and output are encrypted end-to-end. We cannot read them.
- ✗Encryption keys: Generated on your device, never transmitted to us.
- ✗File contents: We have no access to files on your connected devices.
- ✗Screen recordings: No visual capture of your terminal sessions.
- ✗Behavioral tracking: No fingerprinting or cross-site tracking. We use Sentry for error monitoring (crash detection only -- no terminal content is captured), PostHog for anonymous usage analytics (page views and feature usage only), and Vercel Speed Insights for performance metrics. No terminal content, file content, or command history is ever sent to analytics services. All analytics can be blocked by browser ad blockers.
- ✗Cross-device commands: Remote command execution flows directly between your agents via encrypted relay. No command data is stored on our servers.
Third-Party Services
We use the following third-party services:
Supabase
Database and authentication. Your data is stored in their US-based infrastructure.
Privacy PolicyVercel
Web hosting and performance analytics (Speed Insights). Collects anonymous page load metrics.
Privacy PolicySentry
Error monitoring for crash detection. No terminal content, file content, or command history is captured.
Privacy PolicyPostHog
Anonymous usage analytics. Page views and feature usage only. Autocapture disabled.
Privacy PolicyData Retention
| Data Type | Retention Period |
|---|---|
| Account data | Until you delete your account |
| Device registrations | Until you remove the device or delete account |
| Registration codes | 10 minutes after use; until expiry (5 minutes to 30 days) if never used |
| MFA recovery codes | Until you generate new ones, turn off two-factor authentication or delete your account (a used code is kept, marked used) |
| Rate limit data | 1 hour, then deleted within 5 minutes |
| Webhook records | 30 days, then deleted within 1 hour |
Your Rights
You have the right to:
- Access: Request a copy of all data we have about you
- Correction: Update inaccurate information via the dashboard
- Deletion: Delete your account yourself in Settings → Delete account (what it does)
- Export: Export your data in a machine-readable format
- Restrict: Request we limit how we use your data
To exercise these rights, contact us at privacy@cluterm.com
Deleting your account
Go to Settings → Delete account, type delete my account and enter a current code from your authenticator. Deletion starts at once, cannot be undone, and runs in this order:
- Sign out everywhere. Every browser and app signed in to your account is signed out first, so nothing can pair a machine, start a cloud machine or a subscription while the rest runs.
- Revoke every machine. Unused pairing codes are deleted, and every paired machine and handset is revoked: cluterm.com and the relay refuse its key, and its live connection is closed.
- Cancel billing. Your subscription is cancelled at once, with no further charges, and your customer record at Stripe is deleted.
- Destroy cloud machines. Any CluTerm cloud machine you have is destroyed, with its disk.
- Delete the account. Your sign-in account is deleted, and with it every record keyed to it: profile, machines, keys, passkeys, recovery codes and artifacts.
If a step fails, deletion stops there and tells you which step; the steps before it stay done, and pressing Delete account again finishes the rest. If you cannot use Settings (for example, you lost your authenticator), email support@cluterm.com from your account's email address: support runs the same deletion for you.
Deletion does not remove:
- Records of past payments, which Stripe keeps as financial law requires.
- A deletion receipt: your account’s random ID, when the deletion was asked for and finished, and what each step did. It holds no email address, name or IP address.
- Sign-in events (time, IP address and email address) in our sign-in provider’s security log.
- Copies in our database backups, until those backups expire.
- Log lines that name your account’s random ID, kept by our hosting and error-monitoring providers for their retention periods.
- Anything on your own machines. Uninstall CluTerm there to remove its local data.
Contact
Questions about this policy? Contact us: