Skip to content

legal

Privacy policy

Last updated: October 2026

This policy covers the tmuxnet website, its support service, and the tmuxnet iOS app. The short version: the only personal data we hold is what you deliberately send us: a support ticket, or an email address for the one launch email (section 2c). The website and the app also record aggregate, cookieless usage metrics that identify nobody (section 2b; in the app they are two switches in Settings, one for the usage counts and one for crash reports). The app sends nothing about your terminals, your machines, or you.

1. Controller & contact

The data controller for this site and its support service is the tmuxnet project. Contact: support@tmuxnet.com, L7223 7F, 9 Daecheong-ro, Hanam-si, Gyeonggi-do 12950, Republic of Korea.

2. What we collect

We collect three categories of data. The first is the support and feedback tickets you send, from the form on this site or from the report screen in the app. The second is the usage metrics the website and the app record about themselves, described in section 2b. The third is the email address you leave for the launch email, described in section 2c. Every ticket contains:

  • kind: bug, feedback, or misclassification report,
  • source: whether it came from this site or from the app,
  • subject: your summary, in one line.

And only what you choose to add:

  • description: details, in free text,
  • email: only if you want a reply,
  • screenshot: an optional PNG image (up to 5 MiB) you attach yourself; review and redact it before attaching, exactly like screen text.

A misclassification report, sent when tmuxnet detected the wrong app or the wrong status, additionally contains:

  • the claim: the app and status tmuxnet detected, and the app and status you say are correct,
  • terminal screen text: optional, shown to you in an editable field before sending,
  • tool metadata: when sent from the app, the app version, iOS version, device model, locale, and the installed tmux, Claude Code, and Codex versions.

Explicitly not collected: there are no accounts, no cookies, no analytics from third parties, and no ad tracking or tracking across sites, on this site or in the app. The app never sends a host name, address, user name, session or pane name, keystroke, screen text, credential, or any device, user, or session identifier. Your terminal traffic is SSH, end to end between your phone and your machines on your own networks, peer to peer when the network allows and over Tailscale's encrypted relays when a tailnet needs one, and we operate no server that could read it.

2b. Usage metrics: the website and the app

To learn which pages are read, which links lead somewhere, and whether the site loads quickly and without errors, this website records its own usage metrics. They are cookieless and carry no identifier: no cookie is set, no user, session, or device identifier is generated, and nothing is shared with an outside analytics or advertising service. A website metric record contains only:

  • the page path: never the query string or anything you typed,
  • the action: a link you followed on this site (the App Store link, the share control), that a launch email was requested or confirmed (never the address), a submitted ticket's kind (never its content or id),
  • the campaign code of the link that brought you here (a ?ref= value such as share), remembered only for the browsing session,
  • page timings: the standard Web Vitals measurements of how fast the page loaded,
  • script errors: the error type, message, and code location when this site itself fails in your browser.

The iOS app records the same kind of metrics about itself, on the same terms (anonymous counts, no cookie, no identifier). The whole payload is a closed list the app shows you under Settings › Metrics & crashes › What is sent, where the two switches that turn it on also live (both off by default: the app sends nothing until you turn one on, and turning it off again discards anything not yet sent). An app metric record contains only:

  • the screen: which of four screens is showing (the session list, a pane, Settings, the setup on first run), never which pane, device, or session,
  • the step: that the app launched, a device connected, a pane was opened, a report was delivered, or setup finished,
  • the error kind: one word from a fixed list naming what failed (a connection, an authentication, a host key check, a crash by signal type), with a fixed sentence, never the failure's own text, which can name a host,
  • the app version: so a count can be read per release,
  • the crash report: when the app has crashed, or ended while you were using it with no crash recorded (because it stopped responding, ran out of memory, or for no reason it could see), the crash's type, the screen it was on and its stack frames (the code path it took, as addresses, offsets and function names inside the app), the iOS version and the phone model, and, with every report the app recorded itself (not one iOS delivered), how long it had run and been in use, whether it was still responding, the memory it held and had left, how hot the phone was running, and the screens and app states of its last moments, sent on the next launch when its own switch, Send crash reports automatically, is on. That switch is separate from the usage-metrics one: you can have crash reports sent and no usage counts, or the reverse. Never the screen's content, a name, or a message. With the crash switch off the report stays on the phone, and the app offers it to you on the next launch to send yourself or discard.

Your IP address is used only momentarily, to protect the service from abuse, and is never stored with a metric. These records cannot be traced back to you, which is why no consent banner is shown on the site, and you can object at any time: This browser is measured. The choice is one flag kept in this browser's own storage (no identifier) and holds until you undo it here. The app asks first, because App Store rules ask for consent to usage data even when it is anonymous, so its switches rest off, and each is a setting you turn on once rather than a prompt.

2c. The launch email

Until the app is on the App Store, the form at the end of the home page takes an email address so that we can write to it once, on the day tmuxnet is on the App Store. That is the only thing the address is used for.

  • what is kept: the address, the version of the notice shown beside the form, when you asked, and when you confirmed.
  • confirmation first: we send one email asking you to confirm the address. Until you open its link the address is not on the list and nothing else is sent to it; an address that is never confirmed is deleted 7 days after it was last entered. Asking again sends at most one email a minute and three a day.
  • one email: the launch email, on the day the app is on the App Store. No newsletter and no other mail. Our emails carry no tracking pixel and no redirecting link, and we do not record whether you open them or what you click.
  • leaving: every email has a link that takes the address off the list at once, and the Unsubscribe button mail apps show does the same. You can also reply to any of them, or write to support@tmuxnet.com.
  • deletion: the address is deleted as the launch email goes out, when you leave, or 12 months after you confirmed if the launch never comes, whichever is first. After the launch email we keep only a record that an address agreed to the notice and when: a keyed fingerprint of the address, never the address itself, kept 3 years so we can show the consent if anyone asks.
  • abuse protection: your IP address is used only momentarily, to limit how often the form can be used, and is never stored with the address. Before we write, we check that the part after the @ is a domain that receives email.

3. Purpose

We process tickets for three things: triaging bugs (including any screenshot you attached) and tracking each report until it is handled, fixing the status classifier using the screens people report, and responding to you if you left an email address. Ticket data is not used for anything else. An address left for the launch email is used for that one email and its confirmation, and for nothing else. Usage metrics, the website's and the app's, are processed for one thing: understanding how the site and the app are used and keeping them fast and working, in aggregate, never per person.

4. Legal basis

Tickets: consent, under Art. 6(1)(a) GDPR. A report is only transmitted after you enable the explicit toggle on that specific report; there is no blanket consent to hunt down and disable. You can withdraw consent at any time by requesting deletion of the ticket (see Your rights below). The launch email: consent too, Art. 6(1)(a) GDPR, given by sending the form and confirmed by the link in the confirmation email; the link in any of our emails withdraws it and deletes the address. The record kept after the launch email rests on our duty to be able to show that consent (Art. 7(1) GDPR) and our legitimate interest in answering a claim about it, Art. 6(1)(f). Usage metrics on the website: the records are aggregate, cookieless, and cannot identify you, so the GDPR's rules on lawful basis do not reach them. The rule that does is the one on information stored on or read from your device (Art. 5(3) of the ePrivacy Directive and its national transpositions; UK PECR reg. 6). The site relies on the allowance those rules make for a site measuring its own audience: a limited, fully disclosed measurement with a simple way to object, the control in section 2b, and no consent banner. The momentary use of your IP address to protect the service from abuse rests on legitimate interest, Art. 6(1)(f) GDPR. Usage metrics in the app: your consent, the Share usage metrics switch in Settings › Metrics & crashes, which is the consent that same device rule (and the App Store) requires; crash reports in the app, the same, through their own switch on that page. Each is off until you turn it on, and turning it off withdraws that consent and discards anything not yet sent.

5. Retention

Tickets are kept for 365 days from submission, then deleted automatically, with any screen text and screenshot attached to them. You can request earlier deletion at any time. A ticket is also copied into our internal tracker, where we follow up the report it makes: its subject, description, the end of any screen text you attached, the claim and the tool metadata, never your email address. Its words are deleted from the tracker when the ticket expires; the tracker keeps only how many tickets made the report and when, and the subject the report was first filed under. An address left for the launch email is deleted 7 days after it was last entered if it is never confirmed; a confirmed one when the launch email goes out, when you leave the list, or 12 months after you confirmed, whichever is first; the record that it agreed, which holds no address, 3 years after the launch email. Usage metrics from the website and the app are kept as aggregate counts for 15 months and the event and error records behind them for 3 months. A crash report from the app is also recorded in our internal tracker, where we follow up fixing the crash: the kind of crash, the screens it happened on, the functions of the app's code it passed through, the app and iOS versions and phone models it happened on, what each report says of the app's last moments, and how often and when it happened, never anything that identifies you or your phone. That record is kept until we delete it.

6. Storage & processors

Tickets (with any screen text and screenshot attached), usage metrics, crash reports, the launch email list and our internal tracker are stored in the United States by the hosting and software providers we use, which also deliver our emails and process all of it only on our behalf. Nothing is sold or shared for advertising. If you are in the EU or EEA, this means your data is stored in the United States; those providers are certified under the EU-U.S. Data Privacy Framework.

7. Your rights

Under the GDPR you have the right to access, rectify, erase, restrict the processing of, and port your data, and to withdraw consent at any time. To exercise any of these, email support@tmuxnet.com and quote your ticket id. It is shown once when your report is submitted, and because tickets are otherwise anonymous, it is the only key we can look your data up by. Deleting a ticket removes its words from our internal tracker too. For the launch email you need no ticket id: the link in any of its emails takes the address off the list, or write to us from that address. You can also lodge a complaint with your local supervisory authority.

8. The iOS app

Reporting is consented per report and off by default. Correcting a wrong app or status is purely local: it changes what your phone shows and sends nothing. When you do send a report, the app shows the full payload first, and the screen text is editable, so you can redact anything before it leaves your device. Separately, the app sends the anonymous usage metrics listed in section 2b (which screen is showing, whether a connection and a pane opened, what kind of failure occurred, and the app version), never a host, a session name, a keystroke, screen text, or any identifier. That is governed by the Share usage metrics switch in Settings › Metrics & crashes, off by default: the app sends nothing until you turn it on, and turning it off again discards anything not yet sent. A crash report has its own switch beside it on that page, Send crash reports automatically, off by default too, and the two do not stand in for each other.

9. Changes

When this policy changes, we will update this page and the date at the top. If a change expands what we collect, the app will say so in its release notes before any new field is sent.