This policy says what personal data pairterm (“we”, “us”) collects when you use
pairterm.com and the SSH address ssh.pairterm.com, why we collect it, who else sees it, how long
we keep it, and what rights you have. The terms of service
cover the rest of the agreement.
1. Who is responsible
We are the controller of the data described here. We are based in the State of Colorado, USA. Write to privacy@pairterm.com for anything about your data.
2. What we collect
- Identity. You log in through Auth0. We receive and keep your Auth0 subject identifier and your email address. We never see a password.
- SSH public keys you add on the dashboard, with their fingerprints. These are public keys: we never ask for a private key.
- API keys. We show an API key once, when you create it, and keep only a one-way hash of it, with the time you created it and the time you revoked it.
- Session records. For each tmate or zmate session: its kind, its name, the edge server that holds it, the time it opened and closed, the time of its last heartbeat, and a one-way hash of its token. These records are how we count your hours and show your live sessions.
- Purchase records. Each pack you buy, refund or dispute: the time, the hours, the amount paid, the tax in it, your billing country, and the Stripe payment and invoice references. Stripe collects your card and billing details; we do not see or keep your card number. We also keep a copy of each event Stripe sends us, as received, which can hold your name, email address, billing address and tax ID.
- Activity log. A record, with the time, of your logins, of API keys and SSH keys you create, revoke, add or remove, and of refunds you ask for.
- Server logs. Our web and SSH servers log each connection: the IP address and source port it came from, the time, the SSH user name and key fingerprint it presented, the session name it asked for, and whether it was accepted. We use IP addresses to run the service, to limit abuse and to rate-limit requests.
3. What we do not collect
We relay your terminal session between you and your peers. The relay holds what it must to do that, such as the current screen so that a peer who joins sees it, in memory while the session is live. We do not write terminal content to disk, to our database or to our logs, and we do not inspect it beyond what routing, limits, billing and abuse prevention need. Anyone you give a join command to sees your terminal: that is your choice, not ours.
We do not sell personal data, and we do not use advertising or analytics trackers on the site.
4. Why we use it, and our legal basis
- To provide the service you ask for (contract): your account, your keys, your sessions, your hours, your purchases and refunds.
- To keep tax and accounting records (legal obligation): purchase records, with the tax and the country.
- To keep the service secure and fair (legitimate interests): server logs, the activity log, rate limits and abuse prevention.
We do not rely on consent for any of this, so there is nothing to withdraw.
5. Who else handles your data
We use these processors, and share with them only what their part of the service needs:
- Hetzner hosts our servers and the encrypted backups of our database.
- Auth0 handles your login and holds the identity you log in with.
- Stripe takes your payment and issues your invoices and refunds.
- Stripe Tax works out the tax on a purchase from your billing address.
We also disclose data when the law requires it, for example to a tax authority or in answer to a valid court order.
6. How long we keep it
- Your account, keys and session records: until you ask us to delete your account.
- Purchase records and the Stripe events behind them: as long as tax and accounting law require us to keep them, even after you delete your account. They are kept without your email address and keys once you ask.
- The activity log: as long as your account exists.
- Server logs: in a size-limited journal, which overwrites its oldest entries when it is full.
- Backups: a deleted record stays in a backup copy until that copy is replaced, and is not restored into the live service afterwards.
7. Your rights
Under the EU GDPR and the UK GDPR you have the right to access your data, to have it corrected or erased, to restrict or object to its use, and to receive it in a portable format. Write to privacy@pairterm.com. We answer within one month. We may need to check that the request comes from you. Erasure has the limit set out under retention: we cannot delete records the law requires us to keep.
You can also complain to your data protection authority, for example the ICO in the UK or the authority of the EU state where you live. If you live in a US state with its own privacy law, use the same address for your rights under it.
8. International transfers
Our servers are in the European Union, and we operate from the United States. Auth0 and Stripe process data in the United States and elsewhere. When personal data of people in the EU, the EEA or the UK leaves those areas, we rely on a transfer mechanism the law accepts: the European Commission’s standard contractual clauses (with the UK addendum) or a processor’s certification under the EU-US Data Privacy Framework.
9. Cookies
We set one cookie: a session cookie that keeps you logged in. It holds your account number, signed so it cannot be changed, and is sent only to us. It is strictly necessary, so it needs no consent banner, and it is deleted when you close your browser or log out. We set no analytics, advertising or tracking cookies.
10. Security
API keys and session tokens are stored only as hashes. Connections to the site use HTTPS. Only the people who run the service can reach the servers. No system is perfectly secure: if a breach puts your data at risk we tell you and the authorities as the law requires.
11. Children
The service is not for anyone under 16. We do not knowingly collect data from children. If you think a child has given us data, write to us and we will delete it.
12. Changes to this policy
We may change this policy. We tell you of a material change by email or on the dashboard at least 30 days before it takes effect.
13. Contact
Questions and requests about your data: privacy@pairterm.com.