Privacy policy
Termlet is free desktop software developed by ruan as an individual. This page explains when Termlet goes online, what it sends and what we keep.
In short
Your hosts, credentials, commands, terminal content and files stay on your computer (with cloud sync on, they are encrypted and written to a location you choose); they never pass through our servers. We receive only two things: anonymous usage statistics, which are on by default and can be turned off, and crash reports, which are sent only after you turn them on. This website also uses Cloudflare Web Analytics to count visits, without cookies; see “Website analytics”.
When Termlet goes online
| What | Where | What is sent | Default | How to turn it off |
|---|---|---|---|---|
| Connecting to your servers | The addresses you enter | The SSH, SFTP, Telnet and other protocols themselves | — | — |
| Checking for updates | dl.termlet.dev (Cloudflare R2) or GitHub | Downloads the update description, its signature and the remote configuration; requests carry User-Agent: Termlet/<version> |
On | Settings → About → “Check for updates automatically”, or the environment variable TERMLET_UPDATE_URL=off |
| Usage statistics | api.termlet.dev | See below | On | Settings → About → “Send anonymous usage statistics”, or the environment variables TERMLET_USAGE_URL=off or DO_NOT_TRACK=1 |
| Crash reports | api.termlet.dev | See below | Off | Settings → About → “Send crash reports automatically” |
| Cloud sync | A folder or WebDAV server you choose | Your data, encrypted with your sync password | Off | Settings → Sync |
Both dl.termlet.dev and api.termlet.dev go through Cloudflare. To prevent abuse, Cloudflare rate-limits requests by network address; blocked requests may briefly appear with their address in Cloudflare’s security logs. Termlet itself does not read or store addresses.
Usage statistics
What is sent: at most one message a day, containing only:
| Item | Example |
|---|---|
| Termlet version | 0.1.0 |
| Operating system and major version | Windows 11 25H2, macOS 15, Ubuntu 24.04 (no build or patch numbers) |
| CPU architecture | x86_64, aarch64 |
| Interface language | 简体中文, 繁體中文, English |
| How long it has been in use (a band) | First day, within a week, within a month, within six months, longer |
| Whether this is the first message this week and this month | Yes / no (used to count how many computers use Termlet each week and month) |
In addition, the receiver records your country or region (such as CN, TW or US). Termlet does not send this: it is a two-letter code that Cloudflare works out from the IP address of the connection and hands to the receiver. The IP address itself is not stored; if you use a proxy or VPN, the country or region recorded is where its exit is.
What is never sent: host addresses, user names, credentials, commands, terminal content, file names and paths; device IDs, installation IDs or anything else that identifies you or your computer; precise times or time zone; any location finer than the country or region (such as city or coordinates).
How it is received and stored:
- The receiver is our own program running on Cloudflare Workers (api.termlet.dev); no third-party analytics service is involved.
- The program does not read your IP address or request headers such as the User-Agent, and keeps no request logs. Of the location information Cloudflare provides, it reads only the country or region; the city, coordinates, network operator and everything else are not read.
- When a message arrives, each item is added separately to that day’s counts (for example “version 0.1.0: +1 today”, “Windows 11: +1 today”, “CN: +1 today”); the message itself is not stored. So the server holds no record that ties several items back to one computer, and we cannot tell on which days a given computer was used.
- Daily counts are kept for 400 days; after that, only monthly totals remain.
- As our network provider, Cloudflare processes your IP address while forwarding requests (for example to defend against attacks and to work out the country or region), under Cloudflare’s privacy policy. We cannot see it and do not store it.
Where this is stated, viewing and turning it off:
- Usage statistics are on by default. Termlet shows no prompt; once installed, it sends them as described here. This is stated in section 4 of the license agreement, on this page, and in the “Privacy” section under Settings → About.
- Settings → About → “View what is sent…” shows the exact message to be sent; each message sent is also written to the log on your computer (kept for 14 days).
- You can turn off “Send anonymous usage statistics” under Settings → About at any time: it stops immediately, with nothing sent later to make up; the records kept for it on your computer (the dates of the first and the last message) are deleted too.
- The
termletcommand-line tool sends no statistics itself.
Crash reports
Off by default. Once turned on, Termlet sends a report when it runs into an error: the version, operating system, the thread and place where the error happened, the message and the call stack. User folders, user names, URLs, IP addresses, host addresses, quoted text and secrets are removed before the report is even written to your computer, and memory dumps are never sent. The receiver does not read IP addresses or the User-Agent; reports are kept for 90 days, and counts grouped by where the error happened for 400 days. While it is off, crash records stay on your computer, where you can view and delete them under “Crash records…”.
Website analytics
termlet.dev uses Cloudflare Web Analytics to understand how much the website is visited. The website is served through Cloudflare, which adds its analytics script (loaded from static.cloudflareinsights.com) to the pages; when a page has loaded and when you leave it, the script sends information about that page view (the page, the referring site, the page-load performance reported by the browser and so on) to this website’s /cdn-cgi/rum.
According to Cloudflare, Web Analytics does not collect or use visitors’ personal data: it doesn’t use cookies, localStorage or other storage in the browser to track visitors, and doesn’t identify (“fingerprint”) visitors by their IP address, User-Agent or anything else.
In the Cloudflare dashboard we only see aggregate figures: visits and page views, and counts by page, referring site, country or region, browser, operating system and device type. We can’t see individual visitors or tell that several visits came from the same person, and we don’t combine these figures with any other data.
This is unrelated to the Termlet app’s usage statistics; the two are collected separately and are not linked. If your browser blocks the analytics script, the website works as usual.
Your rights
Neither usage statistics nor crash reports contain anything that identifies you, so we cannot look them up or delete them per person; to stop sending them, turn off the corresponding setting. Questions: [email protected].
Changes to this policy
If what we collect changes, this page is updated first, and the change is noted in the changelog and in the “Privacy” section under Settings → About.