LEGAL / LAST UPDATED OCTOBER 18, 2026

Caterm privacy policy

Caterm ("we," "us," or "our") provides the service at caterm.com and companion Caterm apps for remote access to computers you own or have permission to use. This policy explains what we collect, how we use, share, protect, and retain information, and your choices. For privacy questions or requests, email support@caterm.com.

Google sign-in and Google user data

What we access

When you choose Continue with Google, Caterm uses Google Sign-In through Firebase Authentication to request your Google account identifier, name, email address, email-verification status, and profile picture URL, when available. The sign-in permissions are OpenID Connect identity, email, and profile (openid, email, and profile). Firebase also supplies an account identifier (Firebase UID), sign-in provider, and authentication timestamps. Caterm does not receive your Google password. Google sign-in does not grant Caterm access to Gmail messages, Google Drive files, Calendar events, contacts, or other Google Workspace content; we do not request those API permissions for sign-in.

How we use Google user data

We use this identity information to authenticate you, create and update your account, display your profile, associate devices and conversations with your account, and enforce access permissions. Your verified email helps secure device sharing. Sharing participants can see your name or email as described below. If you purchase a subscription, your account email may be supplied to Stripe for billing. We also use account information to respond to support requests and protect your account.

How we store and share Google user data

Firebase processes sign-in credentials and maintains the authentication account. Caterm stores your Firebase UID, name, email, verification status, photo URL, sign-in provider, and account and sign-in timestamps in its server database. Our apps exchange a Firebase ID token at sign-in for a Caterm session, then clear the transient Firebase login. Subsequent requests use the Caterm session. Caterm does not store passwords, Firebase ID or refresh tokens, or Google access tokens in its account database.

Google/Firebase and our hosting providers process this information to deliver authentication and account services. Stripe receives billing information when you use paid features. Device-sharing participants receive the identity information described below. Other disclosures are limited to the operational, legal, security, and business-transfer purposes in this policy. Google profile data follows the retention and deletion rules below.

We handle Google user data in accordance with the Google API Services User Data Policy, including its Limited Use requirements. We do not sell Google user data, use it for advertising, or use it to develop, improve, or train generalized AI or machine-learning models. We do not obtain Google Workspace data through Google Workspace APIs for model training. Google sign-in profile information is not automatically sent to the AI agents you run on your devices.

Other information we collect and why

Accounts and support

For email sign-in, Firebase Authentication processes your email, password, and verification or password-reset requests. The Caterm API does not receive or store your password. For Sign in with Apple in a supported app, we receive the identity information Apple supplies, which may include your name and an email or private relay address. We store the resulting profile for account and access features. If you contact us, we receive the contact details, message, and attachments you send to resolve your request.

Devices and remote access

We process device identifiers, names, operating-system and app details, enrollment credentials, connection state, access permissions, and connection events to connect and manage devices. Remote features process requested system and resource information, screen images, input events, terminal input and output, file paths and contents, and file-transfer metadata to carry out your requests. Enabled tunnels relay traffic to the service you select on your device. Remote streams and file contents pass through Caterm servers or gateways; active sessions may keep temporary buffers for delivery and reconnection. Files saved to your device remain there until you or another authorized user removes them.

Agent conversations and workflows

We store messages, prompts, agent responses, tool events and results, approval and question state, project settings, workflow definitions, schedules, and run history to provide conversations and automation. These records can include file contents, command output, or personal information you or an agent includes. Agents execute on your device, but Caterm relays and stores conversation history on its servers. Model requests follow the locally installed agent's provider configuration and that provider's privacy terms. Review those settings before including sensitive information.

Payments

Stripe processes checkout and subscriptions. We process customer and subscription identifiers, plan, subscription status, billing email, and payment-event metadata to provide paid features and manage billing. Caterm does not receive or store complete card numbers or card security codes.

Logs, local storage, and app analytics

Servers and infrastructure providers process network and request information, such as IP addresses, timestamps, request paths, status codes, latency, and errors, to deliver traffic, investigate failures, and prevent abuse. Firebase uses browser or app storage for sign-in persistence. The website also stores preferences such as theme, language, sidebar state, and selected terminal window locally. Clearing site storage may sign you out or reset preferences.

The Caterm iOS app uses Google Analytics for Firebase to understand app use and improve navigation and sign-in. It records screen views, login, sign-up, and logout events, authentication method, and standard app and session metadata, including an app-instance identifier. We do not send custom user IDs, email addresses, device names, conversations, file paths, terminal content, or raw errors to Analytics. Advertising-identifier collection and advertising-personalization signals are disabled in the app.

Who receives information

• Service providers. Google/Firebase provides authentication and iOS analytics; Stripe processes payments; hosting, database, and network providers process data needed to operate and secure Caterm, for the functions described in this policy.
• Device sharing. A signed-in invitation recipient can see the device name and the owner's display name, or email if no name is available. After acceptance, the owner can see the member's name and email to manage access. Authorized members can access enabled device features and may encounter files, terminals, or other content on that machine. Device sharing does not itself share your Caterm conversation history with other members.
• Services you choose. Local agents can send prompts, files, and tool output to your configured AI providers. Applications accessed through a tunnel process the traffic you send them under their own privacy policies.
• Legal, security, and business needs. We may disclose information when required by law, to address fraud or security incidents, or to protect users' rights and safety. A merger, acquisition, or sale may involve transferring information, subject to applicable law and Google's restrictions on Google user data. We provide notice where required.

We do not sell personal information or share it for cross-context behavioral advertising. Personnel access is limited to authorized support, service operations, security, or legal obligations.

How we protect information

The hosted service uses HTTPS and secure WebSockets to encrypt data in transit. Caterm verifies signed Firebase tokens and checks account and device permissions before allowing authenticated remote operations. Device credentials can be revoked and file browsing is restricted to the configured file root. We restrict access to stored account data and service systems. Remote content is processed by Caterm and its providers to deliver the service; transport encryption does not mean end-to-end encryption. No storage or transmission system can guarantee absolute security.

Retention and deletion

We retain account information, including Google sign-in profile data, while your account is active and as needed to provide the service. Device and access records, events, conversations, and workflows are retained for history, automation, and security. Archiving a conversation or removing a device from view does not necessarily erase its history. Active-session buffers are temporary rather than permanent session recordings; content included in a conversation may remain in its history.

You can delete your Caterm account in Web Settings → Account or iOS Settings → Delete account. After confirmation, Caterm cancels your Stripe subscription immediately without an automatic refund and physically deletes your account data from its active database, including profile data, device registrations, chats, projects, workflows, notifications and login sessions. Deleting devices you own also deletes shared chat history associated with those devices. Your Firebase Authentication user is also deleted. Local files on your computers, external provider accounts and Stripe billing records remain. Registering again or signing in with a provider creates an empty Caterm account. Backups may retain copies until replaced through their normal lifecycle. For additional access, correction, deletion or retention questions, contact support@caterm.com.

Your controls and Google access revocation

You can sign out, stop or uninstall the device app, revoke device credentials, remove sharing access, restrict the file root, disable terminal access, and cancel your subscription. These actions control future use but do not themselves delete account records or history. You can revoke Caterm's Google authorization in your Google Account connections settings. Revocation stops future Google authorization through that connection; it does not automatically erase data already received or necessarily end an existing Firebase session immediately. Use account deletion in Settings to remove stored Google profile data from Caterm, or contact us for additional privacy requests.

International processing and children

Information may be processed where Caterm and its providers operate, including outside your country. Depending on your location, you may have additional rights to access, correct, delete, or receive a copy of your information, or object to or restrict processing. Contact us to exercise those rights. Caterm is not directed to children under 13, and we do not knowingly collect their personal information. Contact us if you believe a child has provided personal information so we can investigate and address it.

Policy updates and contact

We update this page when our data practices change and revise the date above. For material changes, including changes to how we use Google user data, we provide notice through the service or account email and request additional consent where required before the new use. Contact Caterm at support@caterm.com for privacy questions or requests. This policy applies to the hosted service at caterm.com; independently operated, self-hosted deployments are governed by their operators' privacy policies.