What we collect

If you connect your own Gitsi account, Termiyo sends authorization requests and the repository operations you request directly to www.gitsi.com. Gitsi receives your account token, the requested repository identifiers and any content needed for those operations. Termiyo supplies no shared account. Credentials are encrypted locally using OS-protected storage. Disconnect removes the local connection; it does not revoke authorization at Gitsi.

Hosts, identities, private keys, passwords, snippets and known-host pins are stored encrypted on your own machine, under a key derived from your master password. We do not have that password and cannot derive it.

If you enable sync, the encrypted records are copied to our servers so your other devices can pull them. The encryption happens before anything is sent. A server operator — including us — sees record sizes and timestamps, not contents.

We do not collect the contents of your terminal sessions, the addresses of the servers you connect to, your usernames, or your keys. There is no keystroke logging and no session recording unless you turn on session logs, which are stored under the same encryption as everything else.

Voice typing sends nothing until you have agreed to it: the first time you press the microphone, Termiyo says what it does and records nothing until you agree. After you agree, what you say is sent through our server to Deepgram, a speech-to-text service, and the text comes back to you as a draft. Our server passes the audio on and keeps none of it. Voice typing needs you to be signed in to a Termiyo account, and it counts against your plan’s included AI each month.

While you speak, the audio is held in the app’s memory on your computer, and the app cuts it at your pauses into short pieces and sends each one to Termiyo’s server (during a long dictation while you are still speaking, and the rest when you stop). Termiyo’s server keeps no audio: it is not written to our database, to a file or to a log, and what is recorded against your allowance is how many AI tokens each piece was charged, worked out from its length.

On every request we ask Deepgram to leave it out of its Model Improvement Program, and Deepgram’s documentation says data from such requests is kept only for as long as it takes to process them; its page “Your Data at Deepgram” says that Deepgram then does not store the audio or the transcript after it has answered, and does not use them to train its models. Nothing you dictate reaches a terminal or the AI assistant until you press a button in the draft.

Termiyo sends one short report about itself, at most once every 24 hours, and it is on from the moment you install it. It carries the version of the app, your platform and processor, how this copy was installed, the interface language, whether update checks are on, and how many crash dumps are in its own folder. That is the whole list. It goes with no identifier of any kind, so one report cannot be joined to another or to you, and nothing is held here about you to look up. Nothing from your sessions travels with it: no host names, no usernames, no commands, no output, no paths, no keys. Termiyo tells you this the first time it runs, and the switch that turns it off is one click away in Settings → Help. Crash reports are a separate thing: off on a fresh install, off after an update, and off until you go and turn them on.

When the app crashes, the operating system's dump is written to a folder on your own machine. Settings → Help lists what is in that folder, says in plain words what a dump can contain, and opens it. With uploading off — which is how every install starts — the dump stays there, and one leaves only if you attach it to a bug report yourself.

If you do turn it on: the dump is sent over HTTPS to termiyo.com and kept so the people who build Termiyo can open it in a debugger. It carries the dump itself under the name your own machine gave that file, the version, the platform and architecture, and an id for that installation — created the first time something is sent, so an install that never turns this on has none. We do not record the address it came from. A dump over 2 MB is not sent at all. The same screen lists everything that has been sent and has a button that asks our server to delete those reports and the dumps with them.

This is not a stance about privacy in general. An SSH client sees the hostnames, usernames and commands you use to reach production systems. A crash dump can contain any of them, and there is no filtered version of a memory image — it is memory, not a form. That is why this is a switch you have to find and turn on, why the screen it is on tells you what is in the file before you do, and why it is the only thing on this page that changes when you do.

What changed here, said rather than quietly edited: this section used to declare that crash reporting was absent rather than merely switched off, that there was nothing here to switch on, and that a report had nowhere to go. All three were true of every build before the one that added the upload address, and that release made them false. The part that has not changed is the part that matters, and it is the better sentence anyway: nothing leaves your machine unless you turn this on.

Termiyo asks you to make an account on a fresh install, and you can decline and go on using it. An account holds an email address, a password verifier (not the password), your public keys, your subscription state, and — for each machine you sign in on — a label, which is that computer’s own hostname with its operating system in brackets after it, alongside when that machine last reached us. The label is stored as written rather than encrypted, because the point of it is that you can read the list and recognise your own machines. Delete the account and all of it goes with it.

Questions about any of this go to info@termiyo.com.

Termiyo is made and operated by HONCO India, which is responsible for the data this page describes. Write to info@termiyo.com.

Last updated: 5 October 2026.