Escapeburn SuperTerminal Privacy Policy

1. Controller and contact

The controller for the data described here is Escapeburn, a technology company in the process of registration in the Republic of Serbia; until registration is complete, its founder, doing business as Escapeburn. Contact: contact@escapeburn.com. We will add the registered company details here once available. We have not appointed a data protection officer; write to the address above for any privacy request.

This policy follows the Serbian Law on Personal Data Protection and, where it applies to you, the EU General Data Protection Regulation (GDPR).

2. What stays on your computer

The desktop app does not upload your projects, files, terminal output, prompts, session history, voice recordings or browser activity to Escapeburn. It contains no analytics, advertising or crash-reporting trackers. On your computer it stores, among others: your session history and terminal scrollback (up to 5,000 lines per session, with saved access-note secrets masked), project memory files, an application log, the embedded browser's profiles and sign-ins, your settings, and your access notes and keys (encrypted with Windows data protection).

Uninstalling the app does not delete this data, so that a reinstall keeps your history. You can delete it in SETTINGS → Storage or by removing the app's data folder.

3. Your Escapeburn account

When you create an account we process your email address, name, password (stored only as a one-way scrypt hash), preferred language, sign-up and last sign-in times. If you sign in with Google, Google shares your Google account ID, email address and name with us after you agree; we request nothing else.

When the app signs in on a computer we store a random device identifier, the device name (your computer's name), the app version and sign-in and last-seen times; the app checks your access at launch and then at most every five minutes while you use it. Your access status, plan, access period, invite code use and changes to them are recorded in an access log.

Purpose and legal basis: providing the account and the beta, applying the device limit, preventing abuse and sending account emails (confirmation, password reset, access approval). Legal basis: performance of our contract with you, and our legitimate interest in protecting the Services.

4. Bug reports and feedback

If you send a report from the app, we receive what you write (title and text), up to three images you attach, your device identifier, app version, operating system and language and, unless you untick it, technical details shown to you in the dialog before sending: app, Electron and Node versions, operating system and version, CPU, memory, GPU and driver, displays and window size, time zone and locale, which CLIs are installed, the account state, recent error messages, the app area in use and recent clicks (element names only, never text you typed). Reports exclude project paths, session titles, your user name and terminal text. We also store a keyed hash of your network address to limit abuse.

If you flag a Pixel reply on your phone, we receive the reason, your optional note, the flagged reply and the assistant and model that wrote it.

Purpose and legal basis: fixing problems and improving the product (legitimate interest) at your request. We notify our team by email with your email address, name and report title.

5. Phone push notifications

If you pair the Android app, the desktop app can wake it through our push relay while it is offline. The relay receives your phone's Firebase Cloud Messaging tokens and a message that is end-to-end encrypted for your phone; it cannot read the content and does not store tokens or messages. Google receives the push token and delivers the encrypted message.

6. Updates and downloads

The app checks download.escapeburn.com for signed updates when it starts and when your computer resumes, and downloads optional components (such as the voice runtime) when you ask. These requests carry no account or device identifier, but our server receives your IP address and the app's user agent, as with any download.

7. Data that goes to services you choose

The Third-Party CLIs you use send your prompts, code and files to their providers under your own accounts and the providers' privacy policies. To show your remaining limits, the app uses your own sign-ins on your computer to ask the providers for your usage (for Claude, directly from api.anthropic.com about once a minute; for Codex, through its own CLI). Optional features send data to the services you set up with your own keys or sign-ins: cloud speech-to-text or text-to-speech (audio or text to ElevenLabs, OpenAI, Microsoft Azure or another server you enter), Pixel voice calls on the Codex engine (audio to OpenAI), Pixel sources (your mail, calendar or GitHub, read with the access you grant), web search and media analysis through the Antigravity CLI (to Google) and image generation through Codex (to OpenAI). We do not receive this data.

Team features, the project link and the phone app connect your devices directly, encrypted end to end; if a direct connection is not possible, encrypted packets pass through public relays of the Tailscale network, which cannot read them. Team servers that you or your team add see everything that runs on them. Teammates and peers receive what you share with them.

8. Recipients and processors

We do not sell personal data and do not use it for advertising. We use: VibeGAMES B.V. as our server provider, hosting account.escapeburn.com, api.escapeburn.com and download.escapeburn.com in a data centre in Frankfurt, Germany; Hostinger as our email provider for account and notification emails; and Google (Sign-In and Firebase Cloud Messaging) for the features above. Our processors act only on our instructions. We may disclose data if required by law or to protect rights and safety.

Some recipients (for example Google) may process data outside Serbia and the EU, including in the United States. Where required, such transfers rely on adequacy decisions or standard contractual clauses.

9. How long we keep data

• Account data, access status and active devices: while your account exists.
• Signed-out sessions and one-time codes: deleted within 7 days after they expire; sign-in codes within 1 day.
• Devices you sign out: deleted 180 days after sign-out.
• Bug reports, their images and the access log: 24 months, or earlier when you delete your account.
• Backups: kept for 14 days, then overwritten.
• Website and server logs: 14 days (see the website privacy notice).

10. Your rights

You have the right to access your personal data, to correct it, to have it deleted, to restrict or object to its processing, to data portability and to withdraw consent where processing is based on consent. Write to contact@escapeburn.com from the email of your account; we answer within 30 days. Deleting your account removes your account data, devices, reports and related log entries.

You may also lodge a complaint with the Commissioner for Information of Public Importance and Personal Data Protection of the Republic of Serbia (www.poverenik.rs) or, in the EU, with the data protection authority of your country.

11. Security

Connections to our servers use TLS. Passwords are hashed, refresh tokens are stored only as hashes on the server and protected by Windows data protection on your computer, updates are signed, and the server's secrets are encrypted at rest. No system is perfectly secure; tell us at contact@escapeburn.com if you find a vulnerability.

12. Children

SuperTerminal is not intended for children under 16, and we do not knowingly collect their data. If you believe a child has created an account, contact us and we will delete it.

13. Changes

We will publish changes to this policy on this page with a new date and tell you in the app or by email about material changes.