Privacy policy

This website

The website sets no cookies, stores nothing in your browser to recognise you and runs no advertising or cross-site tracking. It counts visits and measures how fast pages load with Cloudflare Web Analytics, which works without cookies and does not fingerprint you: it records the page, the page you came from, your browser, operating system and country, and the load times, and nothing that identifies you. Cloudflare serves the website and, like any web host, handles your IP address and the details of each request to deliver the pages and keep attacks out. For the star count in the header, your browser asks GitHub’s API about the repository, so GitHub sees that request; the browser keeps the count in its own storage for an hour and never sends it anywhere.

The app

The app keeps everything on your computer, encrypted, and sends nothing to us unless you sign in to sync. Your connections go from your computer to your hosts, never through us. A few features reach other services when you use them: icons picked from the icon library load from jsDelivr, the colour scheme catalogue loads from GitHub, and a website session fetches that website’s own icon.

Your account and sync

When you sign in to sync, we keep:

• Your account: your name or username, email address and profile picture, as your sign-in provider shares them, and the provider’s identifier for your account.
• Timestamps: when you made the account, when you signed in, and when each sync was uploaded.
• IP addresses: those of your sign-ins, with the browser’s or the app’s user agent, and of each upload, with the city and country they point to, which the app shows you when two devices disagree.
• Your encrypted data: your sessions, folders, shared logins, tunnels, snippets, saved layouts, trusted host keys and the name of the device that uploaded them, all sealed on your device before upload, and your recovery key, which is your data key sealed under your recovery passphrase. To us it is unreadable bytes, and the passphrase never leaves your devices.
• Your subscription: from Creem, whether you have Pro, on which plan, and when it renews, with Creem’s identifiers for your customer record and subscription.

We keep no passwords, since you sign in through your provider, and no card details, which Creem handles. Signing in happens on account.xtermium.com in your browser, which sets one cookie there, needed to keep you signed in; this website sets none.

Why, and on what grounds

We use this data to run your account and your sync, which is our contract with you (GDPR article 6(1)(b)), and to keep the service secure and stop abuse, which is what the IP addresses are mostly for: the sync server counts each address’s requests for a minute, in memory only, to slow abuse down (our legitimate interest, article 6(1)(f)). We do not sell it, show you ads, or profile you with it.

Where it is kept, and who else handles it

The sync server and everything it keeps are hosted in Thessaloniki, Greece, by Synapsecom Telecoms S.A., inside the European Union. These others also handle personal data for XTermium:

• Synapsecom Telecoms S.A., Greece: hosts the sync server.
• Cloudflare: serves this website and stands in front of the sync server at account.xtermium.com, so each request to it passes through Cloudflare, which sees it on the way and keeps none of it for us. It also delivers the emails the sync server sends us about account deletion requests, which name the account’s email address.
• Hetzner Online GmbH, Germany: holds encrypted backup copies of the sync server’s database, in Finland or Germany, for 30 days.
• Creem: sells Pro as the merchant of record and takes the payment, under its own privacy policy.
• Your sign-in provider: confirms who you are when you sign in, under its own privacy policy.

How long we keep it

Your account data and encrypted files stay as long as your account does. Delete the cloud copy in the app and your encrypted files go with it; request your account’s deletion on your account page, or ask us, and we delete the rest within 30 days of your request; backup copies age out up to 30 days after that. Creem keeps its payment records as long as tax law requires.

Your rights

Under the GDPR you can ask for a copy of your data, have it corrected or deleted, take it elsewhere, or object to or restrict a use of it. Download a copy or request deletion yourself on your account page; the download leaves out your recovery key on purpose, so that a copied file can’t be used to guess your recovery passphrase. Or write to support@xtermium.com and we answer within a month. If you think we handle your data wrongly, you can complain to the Hellenic Data Protection Authority (dpa.gr) or to the authority in your own country.

Changes

When this policy changes, the date at the top changes with it, and we email account holders about changes that affect them.