Privacy Policy

This policy explains what personal data the hosted termynl service collects, what we do with it, who we share it with, how long we keep it, and the rights you have. termynl is operated by HODY, based in Maryland, USA ("termynl", "we", "us"). Questions and requests: [email protected].

1. Scope

• This policy covers the hosted termynl service (the web app at console.termynl.com, the API and MCP endpoint at api.termynl.com) and our websites termynl.com and docs.termynl.com.
• termynl is a business-to-business work platform for tasks, issues, projects, docs, saved views and AI agents. It is sold to organizations, not to consumers.
• Self-hosted termynl is not covered. If your organization runs the self-hosted build on its own infrastructure, that organization decides how data is handled and is responsible for it. We do not host, receive or process the data in a self-hosted installation, and we are not a processor for it.

2. Our role: processor and controller

• Customer Content (what a workspace's users create or upload: tasks, issues, projects, docs, comments, views, files, and AI conversations) is processed on behalf of the customer organization that owns the workspace. For that data the customer is the controller and we are its processor (a "service provider" under U.S. state laws). If you use termynl through your employer or another organization, send requests about Customer Content to that organization; we will help them respond.
• Account, billing, security and website data (who you are, how you sign in, subscription and payment status, security logs) is processed by us as controller, as described below.

3. What we collect

3.1 Account and profile

• Your email address, name, and a random internal account identifier (never derived from your email address).
• The sign-in methods linked to your account (Google, Microsoft work or school, GitHub, or an emailed sign-in link) and the provider's identifier for you.
• Profile details you choose to add, such as display name, pronouns, time zone and a profile picture. Profile pictures are stored on our servers with image metadata removed.
• Your workspace membership: role (owner, admin, member or guest), status, how you joined (invitation, verified domain, group, SCIM), and the teams you belong to.
• Your preferences, such as theme and keyboard settings.

3.2 Sessions and security records

• For each signed-in session: the device's user-agent string and a coarse IP prefix (the first three parts of an IPv4 address, or the first 48 bits of an IPv6 address). We do not geolocate it. You can see and end your sessions in your profile.
• Security events, such as sign-ins, linking or unlinking a sign-in method, and deletion requests.
• A membership audit log per workspace: who invited, changed, deactivated or removed whom, and when.
• An audit log for connected apps (MCP clients) that records authorization events. It never holds raw tokens or the arguments of tool calls.
• Our servers and Cloudflare (see section 7) process IP addresses, request details and user agents in operational and security logs.

3.3 Customer Content

• Teams, projects, tasks, issues, docs, comments, labels, saved views, and conversations with Tyn, the in-app assistant.
• termynl records every change as an entry in an append-only change history. This powers activity, notifications and version history. Deleting an item in the app marks it deleted and hides it. Its earlier versions remain in the workspace's change history.
• On our current hosted service, docs are also written as Markdown files to our server's disk, as a one-way copy of the doc content.

3.4 Files and attachments

• A workspace admin chooses where attachment files are stored: the organization's own Google Drive, OneDrive, or an S3-compatible bucket. The file bytes are stored there, not in our database. Storing files on our own servers ("local storage") is offered only in the self-hosted build.
• We keep the information needed to find and show each file: its name, type, size, checksum, storage location, and the item it is attached to.
• Uploads and downloads pass through our servers. While an upload is checked and transferred, it is written to a temporary file on our server that only the service can read. The temporary file is deleted when the transfer finishes or fails. Moving files between storage backends uses the same kind of temporary file.

3.5 Connected accounts and the permissions we request

termynl uses OAuth to connect to Google, Microsoft and GitHub. We request only the permissions below, each for the stated purpose. Access and refresh tokens are encrypted at rest (AES-256-GCM).

• Group gate. Membership is re-checked on a schedule. Someone who is no longer in a chosen group is deactivated after a grace period. We store when each member was last checked, not the group's full member list.
• SCIM provisioning. If an admin connects an identity provider over SCIM 2.0, that provider sends us user records (name, email, active status) and group memberships.
• Verified domains. An admin proves a domain with a DNS TXT record. People who sign in with a verified address on that domain can join the workspace automatically.

3.6 Paused email, calendar and contacts module

• Earlier versions of termynl let a user connect a Google or Microsoft mailbox and calendar. That connection requested broader permissions: for Google, gmail.modify, calendar and drive.file; for Microsoft, Mail.ReadWrite, Calendars.ReadWrite, Contacts.Read and Files.ReadWrite.
• While it was active, termynl synced and stored copies of connected email threads in our database, including subject, sender, recipients, date, a short preview and the message body (HTML was sanitized). It also stored calendar events and contacts, so they could be searched and linked to work items.
• Since 2026-09-25 this module is paused. It is hidden from the app and nothing is synced.
• On 2026-10-07 we deleted every stored copy of that data from our database: mail threads, calendar events, contacts, shared mailboxes and the activity, comments and attachment records derived from them, and the mail-change subscriptions at Microsoft. Your Google and Microsoft connections themselves stay (we did not revoke them or delete their encrypted tokens): they are also how you sign in, how the workspace stores files in your Drive or OneDrive, and how your profile syncs, and they will carry email, calendar and chat when those features return. You can remove termynl from your Google or Microsoft account's app permissions at any time; signing in and file storage through that account then stop until you connect again. Attachment files that were stored with that data are removed in a later clean-up.

3.7 AI features

• Your messages to Tyn, Tyn's replies, and the content Tyn reads through its tools while answering. Tyn conversations are stored in the workspace like other content.
• AI usage per user per month (token counts), to enforce the included allowance. We do not show dollar amounts per user.
• API keys an admin adds for their own AI provider account, encrypted at rest.

3.8 Billing

• Payments are processed by Stripe. Card details are entered directly with Stripe. termynl does not receive or store card numbers.
• We store the Stripe customer and subscription identifiers, subscription status, number of paid seats, current period end, and identifiers of processed Stripe events. The billing contact email is shared with Stripe.

3.9 Email we send

We send service email: sign-in links, invitations, account and workspace deletion notices (including the warnings before a cancelled workspace is deleted), security notices, export notices, seat and membership notices, alerts about directory or domain settings, and, unless you, your team admin or your workspace admin turn them off, notification email about work items: being assigned, changes, and being @-mentioned (an item's key and title, who did it and a link; never its description or comments). You choose which notifications email you, and whether they come one by one or as one daily summary, in Settings → Profile; team and workspace admins set defaults and may require or turn off a type. We do not send marketing email.

We keep a delivery log for each message (the recipient, the kind of message, the email provider's message id and the delivery status, never the subject or the content) for 90 days. Addresses that bounce permanently or report a message as spam stop receiving notification email.

3.10 Websites

termynl.com and docs.termynl.com are static pages. They use no analytics, advertising or tracking scripts. Cloudflare adds a small script to docs.termynl.com that hides email addresses from spam harvesters.

4. Cookies and browser storage

We use only cookies that are strictly necessary to sign you in and keep the service secure. We use no analytics or advertising cookies, so we do not show a cookie banner.

The app also keeps a local cache of the workspace data you can already see (up to 20 MB, in your browser's IndexedDB) so it loads quickly. The cache is wiped when you sign out or your session ends. Small preferences and a pending invitation link are kept in your browser's local or session storage.

5. How we use data and our legal bases

For people in the EU, EEA and UK, these are the legal bases we rely on as controller. For Customer Content, we act on the customer's instructions.

• We do not sell personal data, share it for cross-context behavioral advertising, or use it for targeted advertising.
• We do not train AI models on your data, and we do not make decisions based solely on automated processing that have legal or similarly significant effects on you.

6. AI processing

• Tyn works through the same permission checks you do. It can read and change only what the signed-in user can, and its changes show in activity as "via Tyn".
• When you use Tyn, we send the AI model provider your message, the conversation so far, instructions from termynl, and the content Tyn reads with your permissions to answer. Each tool result sent back to the model is size-limited.
• Models on termynl's account are Anthropic Claude models: an included model and premium models. Their usage counts against a monthly per-user allowance, and only the included model is available during the trial. For these, Anthropic is our sub-processor.
• Models on your own key. Some Anthropic models and all OpenAI models run only on an API key the workspace admin adds for the organization's own provider account. That data is sent under the organization's own agreement with that provider, and those runs are not metered by termynl.
• Under the provider's API terms, Anthropic and OpenAI state that they do not use API inputs and outputs to train their models by default, and may keep them for a limited time for purposes such as abuse monitoring. The provider's terms govern that processing.
• Connected apps (MCP). Any MCP client, such as Claude Code, can connect over OAuth 2.1 after you approve it on a consent screen. It then acts as you, within the scopes you granted (termynl:read, termynl:write, termynl:admin). Its changes show in activity as "via" the app, and apps that registered themselves are marked "unverified app". Authorization events are recorded in the audit log. You can revoke an app at any time in Account → Connected apps. Data the app reads is then handled by that app and its provider under your own terms with them.
• External agents. A workspace admin can register an external agent endpoint. Messages sent to it go to the address the admin chose.

7. Who we share data with

7.1 Sub-processors

We will update this list before we add or replace a sub-processor.

7.2 Services the customer chooses

These act on the customer's own account and under the customer's own terms, not as our sub-processors: Google and Microsoft (sign-in, file storage, group checks), GitHub (sign-in), the customer's S3-compatible storage provider, Anthropic or OpenAI when used with the customer's own API key, MCP clients a user connects, and external agent endpoints an admin registers.

7.3 Other disclosures

• Within your workspace: owners and admins can see members' names, emails, roles and status. Members see content in the teams and projects they can access.
• Legal requirements: we may disclose data when the law requires it, or to protect the rights, property or safety of our users, the public or us. Where the law allows, we will tell the customer first.
• Business transfers: if termynl is sold, merged or reorganized, data may transfer to the successor, which remains bound by this policy's commitments for data collected under it.

8. International transfers

We are based in the United States and host the service in the United States. If you are in the EU, EEA, UK or Switzerland, your data is transferred to the United States. Where required, we rely on appropriate safeguards for these transfers: the European Commission's Standard Contractual Clauses (with the UK Addendum for UK data), or a recipient's certification under the EU-U.S. Data Privacy Framework and its UK and Swiss extensions.

9. How long we keep data

• Customer Content is kept for as long as the workspace exists, including the change history of deleted items. Workspace owners and admins can export it (JSON and files) in the app at any time while the subscription is active and for 30 days after it ends; an owner exports the whole workspace, and an admin who is not an owner exports only the spaces they can read. Members' personal items are left out of an export unless a workspace owner chooses to include them. Only the person who started an export can download it, and each export is deleted after 7 days. An owner can delete the workspace in the app: everything in it, including the files termynl stores, is deleted automatically 30 days after the request (any owner can cancel until then); the subscription won't renew and ends when the workspace is deleted. A cancelled workspace is deleted automatically 60 days after its subscription ends; its owners and admins are emailed when it ends and on days 30, 45 and 59, and starting a paid subscription again before then cancels the deletion. A deletion can be paused while a legal obligation requires us to keep the data (a legal hold). Files in the customer's own Google Drive, OneDrive or S3 storage stay there.
• Your account. You can ask to delete your account in Settings → Profile (or through the request_account_deletion MCP tool):
  1. We email a confirmation link to your primary address. The link is valid for 24 hours and works once.
  2. When you confirm, the deletion is scheduled for 30 days later. Your connected apps are revoked and your other sessions are signed out. You can cancel at any time during those 30 days.
  3. After the 30 days, your account's personal data is deleted automatically: sign-in methods, identity records, profile and profile picture, preferences, connected-app grants and provider connections. Your other sessions and connected apps are signed out when you confirm; the remaining session records are deleted within 30 days after the purge. Your work items are kept by each workspace: your personal items (the private space only you could see), the items assigned to you and the items you created are handed to a member a workspace admin picks (by default the workspace owner), who can then see your personal items; if nobody else is in the workspace, your personal items are deleted. Mail, calendar events and contacts synced through your account, and everything attached to them (including shared mailboxes), are deleted, never handed over. Stored attachment files are removed in a later clean-up. Files you stored in your own Google Drive or OneDrive stop opening in termynl. What else stays: content you created in shared spaces (it belongs to the workspace), the history of who did what (it is not rewritten), audit entries about your account (without your email address), and your address in our email delivery log for up to 90 days. A deletion can be paused while a legal obligation requires us to keep the data (a legal hold); it cannot be cancelled while on hold.
  If you are the only owner of a workspace that has other members, you must transfer ownership first. Content you created in a workspace's shared spaces belongs to that workspace and stays there, under the customer's control.
• Sessions: an access token lasts 15 minutes and a session can be renewed for up to 30 days. Session records (device and coarse IP prefix) are deleted automatically 30 days after the session ends or is signed out.
• Connected-app tokens: access tokens last 1 hour and refresh tokens 30 days, rotating, with a hard limit of 90 days per authorization. Expired tokens are deleted periodically once they have been expired for a day. The connected-app audit log and the membership audit log are kept for security and accountability for as long as the account or workspace exists.
• Paused mail, calendar and contacts data: deleted on 2026-10-07 (section 3.6).
• Logs: our policy is to keep operational and security logs (our servers, web server and database) for 90 days and then delete them. The email delivery log is kept 90 days.
• Backups: we back up the database, including before each software deployment; our policy is to keep each backup for 1 year and then delete it. Deleted data may remain in a backup until that backup is deleted.
• Billing records are kept as long as tax and accounting laws require.

10. Security

• Traffic to our sites and API is encrypted in transit with TLS.
• OAuth tokens, customer AI provider keys and storage credentials are encrypted at rest with AES-256-GCM.
• Session refresh tokens, sign-in links, invitations, ownership-transfer and deletion links, and connected-app tokens are stored only as SHA-256 hashes.
• Workspace content is isolated by tenant with PostgreSQL row-level security, which is enforced even for the application's own database role.
• Our internal staff tooling uses a separate database role that has no access to content, identity or token tables. It sees billing and membership metadata only, and every change it makes to a workspace's billing status is logged.
• termynl does not offer staff access to customer workspaces for support. If we add it, it will require the customer's permission and be limited in time.
• Access to the underlying infrastructure is limited to the operator. We access Customer Content only when needed to operate or secure the service, to comply with law, or at the customer's request.
• Other measures include rate limiting, audit logs, file-type checks on uploads, and short-lived access tokens.

No system is perfectly secure. If a personal data breach occurs, we will notify affected customers without undue delay. Where we are the controller, we will notify the relevant supervisory authority within 72 hours where the GDPR or UK GDPR requires it, and notify affected individuals and regulators as required by applicable U.S. state breach-notification laws.

11. Your rights

11.1 EU, EEA and UK

You have the right to access, correct, delete or export your personal data, to restrict or object to its processing, and to withdraw consent where we rely on consent. You also have the right to lodge a complaint with your local data protection supervisory authority (in the UK, the Information Commissioner's Office).

If we are required to appoint a representative in the EU or the UK, we will name them here.

11.2 California and other U.S. states

• Notice at collection (California). The categories of personal information we collect are those in section 3: identifiers (name, email, account ID, coarse IP prefix), customer records (billing status), internet or network activity (session and security logs), and professional information (work email, organization and role). Account sign-in data is the only sensitive personal information we collect, and we use it only to provide and secure the service. We collect this information from you, from your organization, and from the sign-in and identity providers you use. We use it for the purposes in section 5 and keep it for the periods in section 9.
• We do not sell or share personal information (as those terms are defined in the CCPA/CPRA), and we do not use it for targeted advertising. There is nothing to opt out of, and we treat Global Privacy Control signals consistently with that.
• California residents have the right to know, access, correct and delete their personal information, and not to be discriminated against for exercising these rights.
• Residents of other states with consumer privacy laws, such as Virginia, Colorado, Connecticut, Utah, Texas, Oregon, and Maryland (the Maryland Online Data Privacy Act, effective October 1, 2025), have similar rights under those laws, including to appeal our decision on a request. To appeal, reply to our decision and ask us to reconsider. Where these laws exempt information processed in a business-to-business context, we still honor reasonable requests.

11.3 How to make a request

Email [email protected]. We will verify your identity, usually by confirming control of your account's email address, and respond within the time the applicable law requires (one month under the GDPR, 45 days under most U.S. state laws). You may use an authorized agent where the law allows. If your request concerns Customer Content in an organization's workspace, we will refer it to that organization and support its response.

12. Children

termynl is a business service and is not directed to children. It must not be used by anyone under 16. We do not knowingly collect personal data from children under 13 in the United States or under 16 in the EU, EEA or UK. If we learn that we have, we will delete it.

13. Data processing agreement

Business customers that need a data processing agreement for their use of termynl can request one at [email protected].

14. Changes to this policy

We will post any change on this page and update the "Last updated" date. For material changes, we will notify workspace owners by email or in the app before the change takes effect.

15. Contact

HODY, operator of termynl, Maryland, USA · [email protected]

Terms of Service · Acceptable Use Policy · ← back to termynl