Terminus Privacy Policy

Terminus signs in with your recovery phrase or with your wallet. The phrase is used on your phone to create a posting key for this app, then discarded unless you choose to keep your account key on this phone behind Face ID or Touch ID (on Android, your fingerprint, face or screen lock). Keys are kept in the iPhone's Keychain, aren't included in backups, and are never sent to us or anyone else. Only signatures made with them leave the phone.

On Android, the same happens with the Android Keystore: keys are encrypted by the phone's secure hardware, an account key you keep is unlocked with your fingerprint, face or screen lock, and Terminus's data is left out of Android backups.

On the web, the posting key is made in your browser, which keeps it so that it can only be used to sign, never read out, not even by Terminus's own page. The recovery phrase is used in the browser to approve that key and then discarded; the web app never keeps your account key, so renewing a key asks for the phrase or your wallet again. A key made this way lasts 90 days, as on the phone; one approved from the Terminus iPhone app lasts 30. Both show under Signers in the app, where you can remove them.

Browser extensions you have allowed on the site can read the page, and so could see a phrase as you type it. If you use extensions you don't fully trust, sign in with a wallet, from your iPhone, or in a window where they are off.

Posts, replies, likes, recasts, follows and profile details are signed on your phone or in your browser and sent to a Hypersnap node, a server that is part of the public network. By default that is haatz.quilibrium.com, run by Quilibrium. On iPhone and Android you can choose your own nodes in Settings; the web app always uses haatz.quilibrium.com. Nodes share everything with each other, so it is public and permanent:

• Anyone, in any app, can read it, along with your account number (FID), username and profile.
• Deleting a post marks it as removed on the network, but copies others already made may remain.

Reading goes to the same node. The node operator can see your IP address and which posts, profiles and searches you load. We don't run that node and can't control what it keeps. Our services aren't involved in reading your feed. Our notification and upload services always ask haatz.quilibrium.com about your account and posts, whichever nodes you choose.

Terminus uses three small services of our own, run on Cloudflare. We don't keep request logs. Cloudflare handles your IP address to deliver each request.

Notifications (push.onterminus.com)

Only if you allow notifications. To send them, we keep:

What	Why	How long
Your FID and username, this phone's notification token (for a browser, its push subscription: the push service's address for it and the two keys pushes are encrypted to), the kinds of notifications you chose, and the public posting key that registered it	To know whose activity to send to which phone, and to stop when that key is removed	Until you sign out, turn notifications off, or Apple, Google or the browser's push service reports the token or subscription is no longer valid
Muted and blocked accounts, muted words and threads, and the filters you set in Activity	So notifications follow the same filters as the app	Until no phone or browser of yours is registered
Which notifications were already sent, your unread count, and when you last opened Activity	So nothing is sent twice and the app badge is right	Until no phone or browser of yours is registered; sent-notification records expire after 2 hours
Names and avatars of people who recently liked or recast your posts	To group them into one notification	24 hours

To learn about new activity quickly, the service also asks the Hypersnap node to tell it about activity involving registered accounts, so the node operator can see which accounts get Terminus notifications. Notifications are delivered by Apple Push Notification service on iPhone and by Google's Firebase Cloud Messaging on Android. On Android, Terminus contacts Firebase only after you turn notifications on, Firebase's analytics are turned off, and turning notifications off deletes the phone's token.

On the web, notifications use your browser's push service: Google's for Chrome and browsers built on it, Mozilla's for Firefox, Apple's for Safari, Microsoft's for Edge. Each notification is encrypted to keys only your browser holds, so the push service can't read who or what it is about; it sees that a notification was sent to your browser from Terminus, how large it is, how urgent, and when. The browser asks for permission only after you turn notifications on.

Adding a browser from your iPhone (push.onterminus.com)

If you sign in to the web app by scanning its code with the Terminus iPhone app, the browser sends this service the public half of its new key. Until the pairing is approved, declined or expires, we keep that key, the kind of browser (such as "Chrome on macOS", from what the browser says it is) and roughly where it is (city, region and country, as Cloudflare places it, not its IP address), so your iPhone can show you who is asking. It is deleted once the browser has its answer, or after a few minutes.

Photos and videos (upload.onterminus.com, media.onterminus.com)

When you attach a photo or video to a post or set a profile picture or banner, it is uploaded to us and published at a public address so every app can show it. Photos are redrawn before upload, which removes location and camera details; videos are converted the same way. We keep the file, plus a record of your FID, its size, type and upload time, for as long as the post may be shown. Contact us to have a file removed.

Link and image loading (proxy.onterminus.com)

Posts link to images, pages and videos on servers anyone can run. Terminus loads previews, images and video playlists through this service, so those servers see Cloudflare instead of your IP address. It passes on nothing of yours: no IP address, cookies or identifying headers. It keeps nothing about who asked. To answer faster, it keeps copies of what it fetched in Cloudflare's cache, by address and not by who asked: images for 7 days, link previews for a day, X posts for 10 minutes, video playlists for a minute, Farcaster's public channel list for an hour, and GIF searches (by their words) and Farcaster opt-in statuses for an hour. Video files themselves aren't kept. Playing a video, which you have to tap, connects to the video's own host, which then sees your IP address.

Translation (push.onterminus.com)

Posts are translated only when you tap Translate on one. Terminus then asks this service for the translation, sending which post it is, the language to translate it into, and the model you chose in Settings: not the post's text, and not who you are. The service reads the post from the Hypersnap node and sends its text to OpenRouter, which passes it to a company that runs the model: for DeepSeek, the default, whichever company hosting it answers quickest; for Gemini, Google. Long posts always go to Gemini, and if one model can't translate a post, the other tries. Those companies handle the post under their own privacy policies.

We keep each translation, by post, language and model, for 30 days, so a post is translated once for everyone who asks. To limit how many posts one IP address can have translated, we count them against a hash of the address, not the address itself, for an hour.

If you choose On This iPhone instead, Apple's translator works on your iPhone and nothing is sent; each language downloads from Apple the first time. On Android the choice is On This Phone, which uses Google's ML Kit translator on the phone in the same way, with each language downloaded from Google the first time. Terminus also uses the on-phone translator when this service can't translate a post.

• Wallet sign-in. Signing in or approving with a wallet on your phone uses WalletConnect (Reown), only when you choose it. Requests to your wallet are end-to-end encrypted. WalletConnect sees your IP address and app identifiers. Its usage reporting is turned off in Terminus. On the web you can also use a wallet extension in your browser instead, which works under its own privacy policy.
• YouTube and X. A YouTube video plays from YouTube when you tap it; until then nothing of YouTube's loads. On the web it plays from youtube-nocookie.com in a frame made only after the tap. X posts are shown using X's public embed data, loaded through our proxy.
• Links you open. Opening a link takes you to that website, under its own privacy policy.

Settings, drafts, muted words, and copies of things you've viewed are kept on your phone to make the app faster. On iPhone, drafts and settings are included in your backups; on Android, nothing Terminus stores is backed up. Signing out removes your keys from the phone; deleting the app removes everything else it stored.

The web app keeps your key, settings, drafts, bookmarks and lists, posts waiting to send, muted words and accounts, and copies of things you've viewed in your browser's storage for this site. None of it is sent to us, except as described above, and nothing is synced between your devices.

• Sign Out asks the network to remove the browser's key, deletes the key, and clears the caches. It keeps the account's drafts, bookmarks, lists, mutes and other settings for when you sign in again.
• Sign Out and Remove Data also deletes everything kept for that account. Settings that aren't any one account's, and other accounts signed in here, stay.
• Clearing this site's data in your browser's settings removes all of it, for every account, along with the keys. A key removed that way can no longer be used by anyone, but stays listed under Signers in the app until it expires or you remove it there.

The web app has no analytics, no ads and no cookies of its own, and its pages load no scripts from anyone else. They tell your browser to connect only to haatz.quilibrium.com, our own services and, when you choose a phone wallet, WalletConnect. Images, previews and GIFs come through our proxy; a video you tap plays from its own host, and a YouTube video from youtube-nocookie.com.

Cloudflare serves the web app and runs our services, so it handles your IP address to deliver each request, as it does for the phone apps.

Unlike an app from the App Store or Google Play, a web page is sent by its server each time it loads, so whoever controls the server could change the code your browser runs, including code that can ask your key to sign. This is true of every web app. Each release is built so that anyone can rebuild it and check it against file fingerprints we publish, and the web app stays on the release it already has and tells you when a new one arrives. These make a change easier to notice; they can't stop a server that means harm, because browsers fetch part of the web app's code on their own. If this matters to you, use the iPhone or Android app.

Terminus is for people 16 and older. It shows posts from a public network that we don't moderate.

• Turn notifications off, or sign out, to remove this phone's or browser's registration from our notification service. Data kept for your account is deleted once no phone or browser of yours remains.
• On iPhone and Android, use your own Hypersnap nodes in Settings so that reading and posting don't go through haatz.quilibrium.com. Our notification and upload services still ask haatz.quilibrium.com about your account and posts. The web app has no choice of nodes.
• Choose On This iPhone (On This Phone on Android, On This Device on the web, where your browser has a translator of its own) under Settings › Feeds › Translate With, so translating a post sends nothing to us.
• On the web, use Sign Out and Remove Data, or clear this site's data in your browser, to remove what the web app keeps there.
• Ask us to remove photos or videos you uploaded, or for a copy of what our services hold about your FID.

We can't remove posts from the public network for you, because no single party controls it. Deleting a post in Terminus is the most anyone can do.

If what Terminus collects changes, we'll update this page and the date at the top.

Rune Art Ltd — contact@rune.art