Privacy

Effective 2026-10-07. Tenax shows a terminal session that lives on a computer you own. This page lists what leaves your computers and what Tenax stores. It is written to match the implementation, not a template.

What stays on your computers

Shell text, command history, files, and photos never touch Tenax's servers in readable form. They move end-to-end encrypted between your device and your host, over a direct path when one exists and through our forwarding server otherwise. Snippets and paste history live on the device only.

What the account service stores

The account service maps your account to your devices and hosts so the app can find them. For each account it keeps:

• Your sign-in identifier from Apple, Google, or GitHub. This is the provider's account ID, not your email address.
• A salted hash of your verified email, so the same email cannot start a second account through another provider. The email itself is not stored.
• If you sign in with Apple: Apple's refresh token. It is kept only so we can revoke Tenax's access when you delete the account.
• Device public keys and whether each is approved.
• Per device: the device model it reports (for example "iPhone 16 Pro" or "macOS 26.5 · Mac mini"), and an approximate place resolved from the connecting IP address. The place is stored only as "City, Country" plus when it was resolved — the IP address itself is never stored on the device row. Resolution uses the free DB-IP City Lite database (IP geolocation by DB-IP, licensed CC BY 4.0).
• While a sign-in code waits, its row keeps the requesting computer's source IP address and resolved place so the approve prompt on your device can name who asked. They are cleared when the sign-in code is approved or denied and on the first read or sign-in start after the sign-in code lapses; the row itself is deleted on a later sign-in start.
• Per host: public key, the name you gave it, published connection addresses (which include IP addresses), its transport certificate, OS/architecture/version, and the last time it checked in.
• Per device: the notification token Apple issues, and which notification types you turned on.

This lives on our server (tenax.jackolab.com). Rows are deleted when the device or host is removed from the account, or when you ask for the account to be deleted.

What the forwarding server sees

When no direct path exists, the forwarding server passes bytes between your device and your host. The bytes are encrypted end to end; the server cannot read shell content or files. It sees the two endpoints' IP addresses, the host's public key (which names the connection), timing, and byte counts. It keeps no content logs.

Error reports

The app may send a soft-error report to tenax.jackolab.com/errors: app build, device model family, OS version, which screen raised it, the error's type and message, and a truncated device key. Reports carry no tokens, keys, shell text, or file contents. They are stored as dated files on our server, readable only by the service, and deleted after 14 days.

On your device

The iOS Keychain holds the device key, your sign-in tokens, the provider and email shown in Settings, and the host list that notifications check. All of them use afterFirstUnlock. The device key and host list are shared with the app's share and notification extensions. Tokens and sign-in details stay in the app's private group. Signing out deletes them.

The site itself

The host checks /releases/ for updates by default (tenax remote-update off opts out). The edge server writes ordinary request logs — method, path, status, client IP — for operations only. No analytics, no ads, no tracking, no sale of data. Apple, Google, or GitHub sees the sign-in itself under its own policy.

Deleting your data

In the app: on iPhone, open Settings and tap Delete account, the tinted link below Sign out. On Android, open the host list's App settings menu and tap Delete account…. Both ask you to type DELETE first. Without the app, email support@jackolab.com from the address you signed in with.

Deletion removes the account record: approved devices, hosts and their connection addresses, notification tokens, and the salted sign-in hash. If you signed in with Apple, we revoke Apple's refresh token. Hosts stop and must be set up again. The device you asked from is signed out at once; the account itself is deleted 24 hours after you ask, and signing in again before then cancels it.

Error reports already sent are dated files that name only a truncated device key; every report is deleted after 14 days. Signing out removes this device's keychain items, and removing a host or a device drops its account rows.

Who runs Tenax

Jackolab runs Tenax at tenax.jackolab.com. This page is not legal advice; it describes what the software does.

Private development. Source: github.com/revolt3r/tenax