// Security & privacy
Termax holds the keys to your servers. So here is, in plain words, which data reaches us, which never does – and where the exceptions are.
As of September 2026 · details in the privacy policy (German)
// Transparency
Without an account it sees none of this: your connections then stay on your device only. With an account, Termax syncs a vault that only your devices can open.
This isn't just a promise, it follows from how Termax is built: the vault is encrypted on your device before it is uploaded, and the key to it is derived from your password only. That is why "Forgot password" can give you back your account, but not your vault – for that you need your recovery key. Whoever got access to our server would only find encrypted blocks.
// Said openly
You only use either of them if you explicitly choose to.
A browser can't open an SSH connection. In the web app, our gateway on our server in Germany does it for you: for the duration of the connection it receives the server address, user name and password or key, and the terminal session passes through it. All of that stays in memory only and is neither stored nor logged. If you don't want that, use the Windows or Android app – there is no detour through us.
When you click the microphone, the recording goes to our dictation service and from there to Groq in the USA for recognition (covered by the EU Standard Contractual Clauses). You see the recognized text before you insert it. Neither the recording nor the text is stored; we only count the minutes used. Without your click, Termax never touches the microphone.
// How we secure Termax
The vault is encrypted with AES-256-GCM, its key derived from your password with Argon2id. Windows and Android use exactly the same scheme, so a vault created on your PC opens on your phone.
Saved credentials and your sign-in are encrypted on the device – with Windows data protection (DPAPI) or the Android Keystore. On Android, none of it moves along when you switch phones or into cloud backups.
Termax remembers your server's key on the first connection. If it changes later, the connection is refused and you see the new fingerprint – protection against impostor servers.
Account, sync, web app, gateway and statistics run on our own server in the IONOS data center in Germany. No advertising or tracking services; the website counts visits without cookies. The only exception: for the browser terminal without an account, Cloudflare Turnstile checks that a human is in front of the screen.
Every code change runs through automated tests, including the encryption. On top of that we review the apps and servers for vulnerabilities ourselves on a regular basis, most recently in September 2026, and ship fixes through the update function.
Found a vulnerability? Here's how to report it (German) – you get a first assessment within three working days. Machine-readable at security.txt.
// Who is behind it
Termax is developed and run by Mark Tietz in Waltenhofen in the Bavarian Allgäu, Germany. Termax earns its money with the optional Premium subscription, not with your data. The core features are free and work without an account.
Questions about security or privacy are answered directly: support@termax.app or via the contact form. Provider details are in the imprint, what we do with which data in the privacy policy. What changed recently is listed in the release notes.