Privacy

The short version

We cannot see your sessions. Not as a policy commitment we are asking you to take on faith, but because sessions are encrypted end to end with keys the relay never holds. Everything below is the detail behind that sentence.

What we hold

• Your account. An account name and a password stored only as a salted, deliberately slow one-way hash. We cannot recover your password because we do not have it.
• Your email address. Given when you create an account, so there is a way to reach you about it: a payment that failed, or notice that the service is changing or closing. It is stored and not used for anything else: it is never added to the waitlist or to any mailing list, and at the time of writing no mail is sent to it. Accounts created before we began asking do not have one and were not made to supply one.
• A sealed copy of your machine list, if you sign in on the web client. It holds the names of the computers you have paired, the keys that identify your browser to them, and nothing about what you did. It is encrypted in your browser before it is sent, with a key derived from your password, so what we store is bytes we have no key for and no code to read. It exists so that signing in on a second computer shows your machines without pairing each one again.
• Your authenticator secret, if you turn on two-step sign-in. Only if you choose to; it is off by default.
• Records of revoked access. When you cancel a share code or a device grant, the identifier of the cancelled grant and the time it was cancelled. This is what makes a cancellation stick, so it is kept for as long as the account exists.
• The waitlist, if you join it. Your email address, your answer to “What do you want to reach?”, the date you joined, and the link that brought you, for example a tag such as ?ref=x. It is used only to email you about TETHERÆ until it launches, about every two weeks, and to invite you to test it if you ask. Every email has a one-click unsubscribe. No IP address is stored with it. The waitlist is separate from accounts: joining it creates no account, and an account’s email is never added to it. To be removed entirely, write to hello@tetherae.com.
• Website request logs. When you visit tetherae.com, its server records which page or file was requested, when, the site that linked you here, and your browser’s name. It does not record your IP address, and the site sets no cookies. The log exists only to count visits and downloads: it is deleted on a rolling basis, usually within a few weeks, and what we keep is daily totals that identify nobody.
• A deletion record, if you delete the account. The account name and the date it was deleted, kept permanently. It is what stops a re-registered name from inheriting the old account’s access.

That is the whole list. Connection records are not in it. The relay keeps one running total per account of how many megabytes it has carried for you, and the date that count started. It does not record what you connected to, when, or for how long.

This changed, and we would rather say so than let you notice. Until recently the list of computers you had paired was held on your device and nowhere else, and this page said so. On the iPhone and Android apps that is still true. On the web client it is not: signing in on a new computer used to mean pairing every machine again by code, so the list and the key that identifies your browser now travel with your account. They are sealed before they leave the browser.

What that sealing is and is not: it protects the list where it rests, against a stolen disk, a leaked backup, or anyone who reaches the file. It is not end to end. Your password passes through our servers when you sign in, so a dishonest or compromised service could derive the same key at that moment. We do not, there is no code here that does, and the file is of no use without it. But it would be wrong to tell you we could not.

While a session is being set up the relay also holds two things briefly, in memory, never written to disk: a share code’s pairing payload until it is claimed or expires, which is at most 24 hours, and the source address of a request for a few minutes, to rate limit sign-in attempts and code guessing.

What we do not hold

• The contents of any session: no frames, no keystrokes, no clipboard, no files.
• Session keys. They are agreed between your two endpoints and never sent to us.
• Your weekly activity record. It is computed and stored on your device.
• Any record of which of your machines you connected to, or when, or for how long.
• Advertising identifiers or behavioural profiles. There are none, and there is no arrangement under which there could be. We do not sell your data to anyone. One optional feature sends text to a processor on your instruction, and it is described in full below.

Revv, and the one thing that leaves the encrypted path (iPhone and iPad only)

This section applies to the iPhone and iPad app. The Android app has no Revv and never contacts the server named below.

Inside a session, Revv can rewrite the text in the focused field on your computer: fix the grammar, make it formal, translate it. Doing that means the text has to be read by something that understands it, and that runs on a server.

So when you use Revv, and only then, the text in that field and the instruction you typed are sent to api.gorevert.com, rewritten, and sent back. Nothing identifying you goes with it: no account name, no token, no device identifier. It is not used to train anything and it is not kept to build a profile of you.

The app asks before this happens the first time, and it does not happen at all until you say yes. You can withdraw that at any time under Settings, Preferences, Revv cloud rewriting. With it off, Revv runs on your device or not at all. Every other part of a session, the video, the keystrokes, the clipboard and any file you move, stays sealed between your phone and your computer and is never readable by us.

The Speak button is separate and does not use Revv on any platform. On iPhone and iPad it uses Apple’s speech recognition and asks for the on-device model where your language has one. On Android it uses the speech recogniser built into the system, which on most devices is Google’s, and that means the audio of what you say may be sent to the recogniser’s own servers to be turned into text. Either way the words it hears are typed straight into your computer over the encrypted session, and we never receive the audio or the text.

The QR scanner on Android

The Android app reads the pairing QR code with Google’s ML Kit barcode scanner. The scanning itself happens on your phone and the picture never leaves it, but the component reports its own diagnostics to Google: device model and operating system, the app’s name and version, an identifier for that installation, and how long scans took. We do not receive any of it. The iPhone and iPad app uses Apple’s own scanner and sends nothing.

Your week stays on your device

The minutes-worked record that powers “Your week” is written to local storage on the phone or tablet that measured it. It is not uploaded, not synced between your own devices, and not readable by us. Deleting the app deletes it.

Notifications

The weekly summary and the dormancy reminders are generated and scheduled on your device. Their content is composed locally from data that never left it, so no server is involved in deciding what they say.

Where data lives

Your account, meaning the name, the email address, the password hash and the sealed machine list, is held on our infrastructure in Europe. Relay nodes run in Europe and North America; a relay forwards ciphertext and stores no session content. The service assigns which node your device uses when you sign in, and may move a session to another one.

One thing does travel between regions and you should know it: so that cancelling access works everywhere and not only in Europe, each relay node holds a copy of the account names, the revocation records and the deletion records. Passwords and their hashes never leave Europe. The North American node therefore knows that an account called yours exists and what access has been cancelled under it, and nothing else.

Retention and deletion

You can delete your account from Settings in the app, and the steps are written out on the account deletion page. Doing so removes the account name, the password hash and every token issued under it, immediately and on every node. The sealed machine list goes with it, in the same moment and without waiting for anything to expire. Any share code you had outstanding stops working too. On the iPhone and Android apps the machine list lives on the device rather than on our servers, so deleting the app removes that copy as well.

Two things deliberately survive it, and we would rather say so than let you find out. The account name and the date you deleted it are kept permanently, so that the same name registered again by anyone cannot inherit what the old account could reach. The record of access you had already cancelled is kept for the same reason. Neither contains a password, a key, a device or anything about what you did.

Children

TETHERÆ is not directed at children under 13, and we do not knowingly create accounts for them.

Changes

If this document changes in a way that affects what we collect, the change will be described here rather than absorbed silently into a new revision date. Two such changes have been made: we now ask for an email address when you create an account, and on the web client the machine list is kept with your account in sealed form instead of on your device. Both are set out above, in the places they belong rather than in a note at the bottom.

Contact

Privacy questions and deletion requests: hello@tetherae.com.