Privacy Policy

Overview

INFINIACT CO., LIMITED (hereinafter referred to as "we", "the Company", or "Infiniact") is a technology company registered in Hong Kong SAR. This Privacy Policy explains how we handle your personal information.

IATerm is a terminal emulator application, providing SSH/SFTP connections, serial communication, port forwarding, and other features. This policy applies to IATerm obtained through:

Apple App Store (hereinafter referred to as "App Store Version")
Direct download from IATerm website (hereinafter referred to as "Website Version")

Effective Date: May 14, 2026

Data Collection Statement: We use your data to provide and improve IATerm services. This policy explains what information we collect, how we use it, and your choices regarding this data.

1. Data Storage

IATerm follows a local-first architecture. Your data is primarily stored on your device, and we do not collect and store this data unless you manually activate sync.

1.1 Local Storage (Primary Mode)

Locally stored data:

SSH server addresses, ports, usernames, passwords, or login keys
Connection groups and tags
Port forwarding configurations
Terminal appearance settings (themes, fonts)
Serial port connection parameters (baud rate, data bits, etc.)
Recent server connection lists (for quick reconnection)
Connection timestamps

Encryption: The local database is encrypted end-to-end; encryption keys are stored in the system keychain.

1.2 Command Execution History (Requires Manual Activation)

When you manually activate command execution history saving in Settings:

Command execution content will be recorded
Terminal session input/output content will be recorded
History data is stored only in your local encrypted database
You can disable this feature or clear history at any time
After disabling, no new commands or session content will be recorded

1.3 iCloud Auto Backup (App Store Version only, requires manual activation)

Current status: iCloud Auto Backup is only available on the Apple App Store version. The Website Version does not currently offer cloud sync or backup.

Applies only when you manually enable iCloud Auto Backup in Settings on the App Store version:

Backup Data (if enabled)

Connection profiles (SSH hosts, ports, usernames, passwords)
SSH login keys
Workspace layouts and preferences
Theme and font settings
Port forwarding configurations

Backup Security Model

Client-side encryption: Data is encrypted on your device using your backup password before being uploaded to your iCloud private database
Zero knowledge: We cannot access your plaintext backup password and cannot decrypt your backup data
Storage location: Your Apple iCloud private database (your personal space); we do not operate a server for this data
Security note: Your backup password is the key protecting your backup data. Use a strong password and keep it secure.
Password loss: If you forget your backup password, backed-up data cannot be recovered.

2. Data Storage and Security

2.1 Local Storage Security

Local encryption: Your sensitive data (SSH keys, server passwords, connection configurations) is stored encrypted on your local device
Key management: Encryption keys are stored in the system keychain and are never uploaded

2.2 iCloud Auto Backup Security (App Store Version only, if enabled)

App Store Version only: The Website Version does not currently offer cloud sync or backup.

End-to-end encryption: Data is encrypted on your device before being uploaded to your iCloud private database
Double-layer protection: Local device key + your backup password
Zero knowledge: We cannot decrypt your backup data; your backup password never leaves your device
No server-side storage on our side: We do not store your backup data; backups reside only in your iCloud private database

2.3 Network Security

Transmission Encryption: All network communications use HTTPS/TLS encryption
SSH Connections: Use industry-standard SSH protocol encryption

3. Data Sharing

No Ad Tracking: We will not sell your personal information to third-party advertisers, nor will we integrate SDKs for ad tracking within the application.
Necessary Third-Party Service Providers: To provide our services, we share the minimum necessary information with the following categories of service providers:
- Apple (App Store version only): processes payments, license verification, and iCloud backup storage
- Payment Processors (website version only): process orders and payments; they do not receive your complete payment card details
- Crash Reporting Providers: receive de-identified crash logs used to diagnose stability issues
- Third-Party Login Providers (if you choose Google login): complete account login authorization These providers are bound by their own privacy policies and process data only for the purposes of providing services to Infiniact.
Legal Compliance: In order to comply with legal and regulatory requirements, we may provide necessary information to relevant regulatory authorities.

4. Data Retention

Local Data: Fully under your control, can be deleted at any time
Crash Reports: Retained for no more than 90 days, used solely to improve product stability and security

Account data, backup data, and transaction retention periods are specified in each platform's section.

5. Cookies and Tracking Technologies

No Ad Tracking: We do not use cookies or similar technologies for ad tracking or cross-site tracking
Third-Party Websites: Our website may contain links to third-party websites, which have their own privacy policies that we recommend reviewing

Essential Cookies usage is specified in each platform's section.

6. Children's Privacy

IATerm is intended primarily for adult developer users. We do not knowingly collect personally identifiable information from minors under 18. If you are a parent or guardian and discover that your child has provided us with personal information, please contact contact@infiniact.com and we will take steps to delete that information.

7. Permissions Usage

IATerm requires the following system permissions to provide services:

7.1 Network Access Permissions

Purpose: Connect to SSH/SFTP servers and establish remote terminal sessions
Local Network: Access SSH servers and network devices on the LAN
Port Forwarding: Support SSH -L/-R/-D port forwarding
Data Transmission: All network connections use HTTPS/TLS encryption

7.2 USB Device Access

Purpose: Access USB-to-serial adapters to connect to embedded devices and microcontrollers
Data Content: Only read serial data streams, no access to other USB device content
User Control: Only used when user actively initiates a serial connection

7.3 System Keychain Access

Purpose: Securely store the encryption key for your local database
Encryption: Uses the system keychain's encryption mechanism
Data Isolation: Only IATerm can access its own keychain entries

Your SSH keys, server passwords, and other sensitive data are stored encrypted in the local database; the system keychain is used only to protect the database encryption key.

7.4 File System Access

Purpose: Read and write user-selected files (SSH key files, configuration files)
Access Scope: Limited to files explicitly selected by the user
Background Access: No background file scanning or access

8. Different Platforms and Versions

The general principles in this policy apply to all platforms and versions of IATerm. For platform or version-specific information (such as Apple App Store version or website direct version), please refer to the corresponding sections below.

9. Apple App Store Version Specifics

This section applies only to the IATerm version downloaded from the Apple App Store.

9.1 iCloud Auto Backup

If you enable iCloud Auto Backup, see Section 1.3 for the data included in the backup. Auto Backup is a one-way upload to your own iCloud private database; restore operations are user-initiated inside the app.

iCloud Auto Backup Security

Multi-Layer Security:
1. Apple ID Protection: Access to iCloud data requires your Apple ID credentials
2. Device Trust: Apple's two-factor authentication and trusted device mechanisms
3. iCloud Private Database: Data is stored in your personal iCloud private space, inaccessible to others
4. Backup Password Encryption: All data is end-to-end encrypted with your backup password before upload
Zero-Knowledge Architecture: Neither Infiniact nor Apple can decrypt your data; your backup password never leaves your device
Password Security: Your backup password is never transmitted or stored on any Infiniact server
Password Recovery: If you forget your backup password, backup data cannot be recovered; you can only reset the backup

You can disable backup or reset backup data at any time in Settings. Disabling backup does not affect data on your local device.

9.2 Data Collection & Usage

Information We Collect:

Application crash reports and performance data

Data Usage: We use the collected information to:

Provide, maintain, and improve our services
Send you service-related notifications and updates
Analyze service usage to optimize the user experience

Payment and account-related data for the App Store version is handled by Apple. Please refer to Apple's privacy policy for details.

9.3 Essential Cookies

This version uses essential cookies to maintain basic functionality:

Login State: Maintains your login status when visiting the website
Preferences: Remembers your language and interface preferences

These cookies are used only when you visit the IATerm website and are not used for tracking or advertising purposes.

9.4 Data Retention

Backup Data: Encrypted backup data stored in iCloud will be deleted when you reset the backup or delete iCloud data
Crash Reports: Retained for no more than 90 days, used solely to improve product stability and security

Transaction records and other data are managed by Apple. Please refer to Apple's privacy policy.

9.5 Device Identifier

To distinguish backup data sources across your multiple Apple devices, the App Store version of IATerm generates a random device identifier (UUID) on each device. This identifier:

Is completely random and contains no hardware, account, or personally identifiable information
Is stored only in your device's Keychain and your own iCloud private database
Is never transmitted to Infiniact or any third party
Is not used for advertising or cross-app tracking
Cannot be used to identify you personally

You can remove this identifier by uninstalling the app or clearing IATerm's iCloud data from System Settings.

9.6 Data Storage Location

All backup data for the App Store version is stored on Apple iCloud servers:

Storage Location: Apple's iCloud servers, with specific locations determined by Apple based on your account region
Data Control: Your backup data is stored only in your personal iCloud private space
Zero-Knowledge Architecture: Neither Infiniact nor Apple can decrypt your backup data
Legal Protection: Apple's data centers comply with local laws and regulations, providing legal protection for your data
Data Management: You can manage your iCloud data through your Apple ID, including deleting backup data

9.7 30-Day Free Trial

Local trial status stored in Keychain
Trial start time is first launch date
Trial status is not reported to any server
Full functionality during trial period

9.8 Payment Information

License verification completed through Apple StoreKit framework
No payment information collected (all payments handled by Apple)

9.9 License Authorization

Usage authorization verified through Apple's official authorization mechanism
Authorization status managed by Apple App Store
We do not collect your device identification information for authorization

9.10 Data Isolation

App Store version does not share data with the direct download version from our website
iCloud backup data can only be restored within the App Store version family
Uninstalling the App Store version does not affect the website version's data

9.11 Your Rights

User rights for the App Store version are governed by Apple's privacy policy:

Apple Privacy Policy: Please refer to Apple's Privacy Policy (https://www.apple.com/privacy/)
Data Management: You can manage data related to the App Store version through your Apple ID
Data Deletion: Delete IATerm's iCloud data through the iCloud management interface in System Settings
Account Management: Manage your Apple ID and related data through Apple's official channels

To learn how Apple handles your data, please contact Apple directly or visit Apple's Privacy Policy page.

9.12 Terminal Assistant (BYOK)

The App Store version includes a built-in Terminal Assistant as an opt-in feature, off by default. When enabled:

Data flow: Your input and any terminal content you choose to include as context are sent from your Mac directly to the model provider you configure (BYOK model). IATerm does not proxy, retain, or upload copies to our servers.
API key storage: The API key for your model provider is stored in the macOS Keychain on your device. It is never uploaded and is not synced through iCloud.
Responsibility allocation: The model provider you choose is an independent data controller. Their handling of your data is governed by that provider's own privacy policy and terms of service.
User control: You may enable or disable the Assistant at any time in Settings, delete any stored API key, and clear local conversation records at any time. When the Assistant is disabled, no further network requests are made to any model provider.

10. Website Direct Version Specifics

This section applies only to the IATerm version downloaded directly from the IATerm website.

10.1 Website Services

The IATerm website provides the following services:

Application Download: Direct download of the IATerm application
Account Management: Create accounts, manage personal information, link third-party logins
License Purchase: Online purchase of usage licenses When using website services, we collect necessary data such as login information and operation logs. See details in each subsection below.

10.2 Account System and Login

Free and Paid Features: Free features of the Website Version are available without login. Paid features trigger a paywall requiring sign-in via email or Google. The account is used for license verification, Update Pass management, and personal account management.
Data minimization: The account retains only your email address as the primary identifier and contact method. We do not collect username, avatar, phone number, or other profile fields.
Email address is used only for account verification and important notifications.

Sign-In Methods

Email one-time code: We send a one-time verification code to your email; no password is set, eliminating password-leak risk.
Google Sign-In: We request only the email scope from Google (we do not request the profile scope), so Google does not provide us with your name or avatar.

Credentials Retained After Authentication

After a successful login, we retain only:

Your email address (primary account identifier)
The internal user ID that Google assigns to you (Google sub, an opaque identifier containing no personal information, used so that the same Google account links back to your IATerm account on future logins)
A session token issued by us (held by your client, with a limited lifetime)

We do not retain Google's access token or refresh token; even if the Google authorization flow generates them, they are discarded immediately after your login completes. As a result, we cannot access your Google account or any Google service data on your behalf.

Login Logs (Security Audit)

For security and abuse detection, we log runtime metadata of login sessions:

Login time and IP address
Browser type and operating system
Login success/failure status

These logs are used only for account security and anomaly detection, and are not linked to identity information beyond your email.

10.3 Data Collection & Usage

Information We Collect:

Email address: Retained when you register an account or sign in with Google (the only persistent identifier)
License and purchase data: License number, purchase timestamp, and device identifier (for license verification)
Crash reports and performance data: De-identified, for product stability improvements

Third-Party Login Policy:

We obtain only your email address from Google when you actively choose Google Sign-In. We do not request or retain username, avatar, or other profile information.

Data Usage: We use the collected information to:

Provide, maintain, and improve our services
Verify device identity and license
Send you service-related notifications and updates
Analyze service usage to optimize the user experience
Process license purchases and verification

10.4 Essential Cookies

This version uses essential cookies to maintain basic functionality:

Login State: Maintains your login status when visiting the website
Preferences: Remembers your language and interface preferences

These cookies are used only when you visit the IATerm website and are not used for tracking or advertising purposes.

10.5 Data Retention

Account Data: After account deletion, we will delete your personal information within 30 days. Please record your purchased license numbers before deleting your account, as deletion may unbind licenses from your account and affect online verification. To preserve licenses, contact contact@infiniact.com before deletion.
Crash Reports: Retained for no more than 90 days, used solely to improve product stability and security

10.6 Data Storage Location

The Website Version is local-first. We do not store your connection configurations, terminal sessions, or other sensitive data on our servers. The only server-side data we hold is:

Account and license data: Stored on servers in Hong Kong
Legal Protection: Hong Kong has comprehensive data protection laws (Personal Data (Privacy) Ordinance - PDPO) to protect your data
Transmission Security: All data transmissions use HTTPS/TLS encryption

10.7 Configuration Sync Service

Current status: The Website Version does not currently provide configuration sync or cloud backup. This section will be updated with full details when the feature becomes available; users will be notified of the change.

10.8 Payment Information

Payment processing handled by third-party payment service providers; we do not store your complete payment information

10.9 License Authorization

Usage authorization verified through License matching with device identifier
Device identifier is hashed to generate a unique identifier; original device information cannot be reverse-engineered
Only the hashed identifier is transmitted during authorization verification; raw device information is not transmitted

10.10 Data Isolation

Website version does not share data with the App Store version
You can install both versions simultaneously; their data are completely independent

10.11 AI Features

The website version provides AI-assisted features:

Data Processing: This tool acts only as a channel. Intelligent programming and AI chat are transmitted by the AI tool you choose and are subject to that AI tool's privacy policy.
Data Flow: Input and output content is stored locally; during processing, it is sent to AI service providers. Our servers do not collect or store this data.
Privacy Responsibility: Use of AI services is subject to the respective AI provider's privacy policy.

10.12 Your Rights

Under the Hong Kong Personal Data (Privacy) Ordinance (PDPO), when using the website version you have the right to:

Access: Request access to personal data we hold about you
Correction: Request correction of inaccurate or incomplete personal data
Deletion: Request deletion of your personal data (we will delete within 30 days after account deletion)
Object/Restrict Processing: Request that we stop or restrict specific processing of your personal data
Data Portability: Where technically feasible, obtain your personal data in a structured, commonly used format

If you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, you may have additional rights under the GDPR. If you are a California resident, you may have rights under the CCPA/CPRA (e.g., the right to know, delete, and opt out of the sale/sharing of personal information — note that we do not sell or share personal information). We will respond to your requests in accordance with applicable law.

Cross-Border Data Transfers

When you use the Website Version, your personal information may be transferred across borders to our servers in Hong Kong (the Company's registered jurisdiction). IATerm follows a "global service, regional compliance" model:

Recipient: INFINIACT CO., LIMITED (Hong Kong SAR), operating and controlling servers located in Hong Kong.

Data Transferred: Email address; license number and verification records; login timestamp and IP address; de-identified crash reports.

Purpose: Account management, license verification, Update Pass management, security auditing.

Safeguards: HTTPS/TLS transport encryption; server-side encryption at rest; strict access control and audit logging.

Regional Notices:

Mainland China users (under the Personal Information Protection Law / PIPL): The Website Version involves cross-border transfer of personal data to Hong Kong. The sign-in page explicitly notifies you of this and links to this Privacy Policy; by completing your first sign-in via email one-time code or Google, you acknowledge and agree to the data processing and cross-border transfer described in this policy (the account is created implicitly on first sign-in). You may withdraw consent at any time by deleting your account (see §10.5).
EEA / UK / Switzerland users (under GDPR / UK GDPR / Swiss FADP): Hong Kong is not covered by an EU adequacy decision. Cross-border transfers rely on the European Commission-approved Standard Contractual Clauses (SCCs) or an equivalent legal mechanism. You retain the full set of data subject rights under the GDPR (access, rectification, erasure, restriction, portability, objection, and complaint to your local supervisory authority).
California residents (under CCPA/CPRA): You have the right to know, delete, correct, and opt out of the sale or sharing of your personal information. IATerm does not sell or share personal information. For requests, contact us as described below.
Other regions: Local personal information protection laws apply. Contact us to exercise your rights.

Cross-border data flows through third-party services (Apple iCloud, Google Sign-In) are governed by those providers' own privacy policies.

To exercise the rights described above, or to raise a privacy-related concern, please contact: contact@infiniact.com. We aim to respond within the timeframe required by applicable law.

11. Policy Updates

We may update this Privacy Policy from time to time. As IATerm features evolve and the scope of data processing changes, we may adjust the sections of this policy regarding data collection, use, and storage.

The updated policy will be posted on this page, and we will notify you of significant changes through in-service notifications or the contact information you provided during registration. Your continued use of our services constitutes acceptance of the updated Privacy Policy. We recommend that you review this policy periodically to stay informed of the latest content.

12. Contact Us

For privacy-related questions, data protection requests, or inquiries, please contact:

Email: contact@infiniact.com
Company: INFINIACT CO., LIMITED
Jurisdiction: Hong Kong SAR

We will respond to your request as soon as possible and process it within the timeframe required by law.

Last updated: May 14, 2026