← thurm.rs

Privacy

Thurm for iPhone and iPad, and its push relay. Effective 15 October 2026.

In short

Thurm has no accounts, no analytics, no ads and no tracking. The app connects to machines you pair with it, over SSH. What your terminals show goes between your device and those machines, and never through a server of ours.

On your device

The app keeps the hosts you paired, their host keys and its settings on the device. It makes an SSH key for the device and keeps it in the Keychain, behind Face ID or your passcode; the private key never leaves the device. The camera is used only to scan the pairing code your Mac shows, and nothing it sees is kept.

On your machines

When you pair, your Mac adds the device's public key to its authorized_keys, under the device's name. If you turn on notifications, each host also keeps the device's name, its push relay address and the secret it signs notices with. That stays on your machines, which you control.

Notifications and the push relay

Notifications are off until you turn them on with an invite code. Then the device registers with Thurm's push relay, which keeps, per device:

  • a random device id and a secret, made by the relay;
  • the push token Apple gives the app, and whether it is a development build;
  • the invite code it registered with.

When an agent on one of your hosts needs you, the host asks the relay to send a notice, and the relay passes it to Apple's push service. A notice carries the host's name, the pane's title and number, what the agent wants (permission, or your attention) and, for Live Activities, the agent's name and status. Never terminal output. The relay forwards these and does not store them. When a pane is read on another device, the relay sends a silent push naming that host and pane, so the notice leaves your lock screen.

The relay's logs name device ids, never notice contents. Its traffic goes through Cloudflare, which sees connection details such as IP addresses. The relay does not log them.

Turning notifications off in the app deletes the device from the relay. A device whose push token Apple reports as gone is deleted too.

Who else is involved

  • Apple delivers notifications and Live Activities through its push service, and runs the App Store and TestFlight, under Apple's own privacy policy.
  • Cloudflare carries the relay's traffic, under Cloudflare's privacy policy.

Nothing is sold or shared for advertising.

Your choices

Turn notifications off at any time in the app, under Notifications. Removing a host from the app, or revoking the device on your Mac, ends its access. To ask what the relay holds about your device, or to have it deleted, write to the address below.

Changes and contact

Changes to this policy are published here, with a new effective date. Thurm is made by Nikola Milojević. Questions: [email protected]. Source and issues: GitHub.