Privacy Policy

1. Information You Connect

Otter Beam connects your device to machines that you own, control, or are authorized to access. Terminal sessions, source code, files, and agent transcripts normally flow directly between your devices and machines and are not stored by us in readable form. When a signed-in account feature uses cloud sync, the limited content identified below is sealed on your device before upload and stored only as ciphertext.

2. Local Storage

Otter Beam stores host configurations, session caches and drafts (including readable transcripts of your agent sessions), the browser's last-visited address, browser-dial favicons and last-opened times, and other app data locally on your device. If you use Copy screenshot on Android, a temporary copy of the image stays in the app's cache so the clipboard can read it. SSH private keys are stored only locally on your device and are never uploaded. You can remove local app data with the app and operating-system storage controls. Uninstall behavior varies by platform, and protected keychain or credential-store entries may require separate removal.

3. Cloud Account Data

Otter Beam uses Supabase to store your login email, account ID, device platform, opaque device and project IDs, public SSH keys, host capability and readiness details (system permission status, app version, last check time, and an SSH host-key fingerprint), navigation state (selection, starred-session, and file-pin metadata such as agent type, order, and timestamps), and last-seen time. Your device names and the SSH username and port needed to connect to a registered device are sealed on your devices with per-device keys; the cloud stores only ciphertext plus a generic platform label (such as "macOS device"), and the stored records cannot reveal the actual name or connection details. The periodic device report travels over TLS; on fully upgraded (sealed-only) accounts any readable copies it still carries are discarded before storage, and newer app versions omit them from the request entirely. If your account still includes a device running an older app version, these fields remain stored in readable form until every device is upgraded. SSH private keys are never uploaded. Project names and paths, synced file-browser paths, synced composer draft content, and saved ideas (their title, body, and status) are sealed on your device with a per-host key before upload; the cloud stores ciphertext and cannot read that content. Browser dials created while you are signed in are also encrypted on your device before upload: their URL, title, saved time, and pinned order are readable only by the account's eligible devices. Supabase stores only ciphertext and opaque account, row, version, device-origin, and timestamp metadata. Browser dials created before this feature remain only on the device unless you remove and save them again. When address sync is on (the default; you can turn it off per device), the browser's most recently opened page address ("Continue On") is likewise sealed on your device before upload so your other signed-in devices can pick up where you left off; the cloud stores only ciphertext, and turning sync off keeps the address on the device. Private-network and Tailscale IP addresses are transmitted only as short-lived private presence data while a host is online and are not retained as durable account data. Checking for app updates on macOS fetches a release feed from our website; that request carries standard web-request data such as an IP address and app version and is not linked to your account.

4. Direct Connections and Otter Relay

Direct connections on the same local network or through your own Tailscale network never pass through our servers.

Otter relay is used only when a direct connection is unreachable. It forwards end-to-end encrypted SSH byte streams. We cannot decrypt those streams and do not inspect terminal content. Relay systems process limited metadata such as account and machine IDs, connection timestamps and durations, transferred-byte totals, concurrent-connection peaks, reconnect and throttling counters, and connection-close reasons for routing, abuse prevention, support, and billing; they do not record commands, terminal output, or file contents.

Real-time collaborative editing sessions (such as shared document editing) pass through our sync service. Document updates and content are held in memory only and are not written to durable storage on our servers; the service durably keeps only opaque coordination markers (such as content hashes and connection identifiers) that contain no document text. These markers are deleted automatically after about 30 days without activity in the corresponding editing session, including after account deletion.

5. AI Coding Agents and Voice

AI coding agents run on your own machine using your own account and keys. Their data handling is governed by the respective provider's terms, not ours.

If you deliberately start in-app voice transcription and grant microphone access, the audio you choose to record is sent to Alibaba Cloud (QwenCloud, formerly Model Studio) to produce text. The recording is sent together with fixed transcription settings and a random request identifier; nothing else from your screen, terminal, prompts, or hosts is included. Do not use voice transcription for information you do not want transmitted to that provider.

Otter Digital does not store the audio or the resulting transcript on its servers, and does not use voice input for advertising or to train its own models. Alibaba Cloud processes voice audio as our processor, on our instructions, under a contract that limits its use of that content to providing the service and to complying with applicable law; it also states that it does not use your data to train its models. It may retain a request for a period under that contract, and we do not claim zero retention on its side. The app asks for your permission before any audio is sent, and you can withdraw that permission at any time in Keyboard settings. To enforce plan limits and billing, we also keep account-linked monthly transcription totals — seconds used, request count, plan tier, billing month, and our processing cost. These totals contain no audio or text and are deleted with your account.

6. Notifications

If you enable notifications, we store the delivery address for your device: an Apple Push Notification service token, a Firebase Cloud Messaging registration token, or — in web browsers — a Web Push subscription (its endpoint URL and encryption keys). Remote needs-input notifications contain only a generic status plus opaque routing IDs; they do not include the agent's question, terminal output, source code, or file content. Apple, Google, or your browser vendor's push service processes delivery metadata under its own privacy practices; turning notifications off in the app removes our stored web subscription. On Android, Firebase may also maintain a separate installation identifier under Google's policies and your device and app-storage controls.

7. Payments

Subscriptions may be processed by Apple, Google, or Stripe, depending on the platform where you purchase. We receive subscription and transaction identifiers, product, status, billing period, and limited refund information, but do not store full card numbers. Starting a Stripe checkout sends Stripe your account email and account ID together with the selected plan so the transaction can be matched to your account; refund handling sends the related transaction, subscription, and refund-reason details. Each payment provider processes payment information under its own privacy policy.

8. How We Use Information

We use the information described in this policy to provide, maintain, and protect the service, process billing, prevent abuse, and comply with legal obligations. We do not sell personal data and do not use it for ad-based profiling.

9. How We Share Information

Supabase and Cloudflare provide hosting, database, authentication, routing, and security services on our instructions. Alibaba Cloud (QwenCloud, formerly Model Studio) receives voice audio as our processor, only when you use transcription and only after you grant permission. Apple, Google, and Stripe process store or payment transactions under their own terms and may act independently for those activities. We may also disclose information when required by law. We do not sell personal data or share it with data brokers.

10. Your Controls and Account Deletion

You can disable notifications in system settings and use app or operating-system storage controls to remove local data; uninstall and protected credential-store behavior varies by platform. You can permanently delete your Otter Beam account in the app under Profile → Account → Delete account. See our account deletion page for details and an email alternative.

Deletion hard-deletes your Auth user and removes renewable sign-in sessions, cloud profile, registered cloud devices, uploaded public-key records, sealed project, navigation, composer-draft, browser-dial, browser Continue On, and saved-idea data, transcription usage totals, our database push-token copies, and other deletable database rows. It is not a reversible soft deletion. On Android, the app also asks Firebase Cloud Messaging to delete its current registration token. Firebase may retain or recreate a separate installation identifier under Google's policies; Otter Beam does not keep it linked to the deleted account.

Database relay usage rows are deleted with the account. Before deleting the Auth user, the deletion endpoint sends a separately authenticated purge request to Otter relay. Relay closes the account's known machine and display sockets, deletes known routing, reconnect, notification-deduplication, usage, and abuse-prevention state, and confirms every current registered machine plus its bounded recent-machine history. If any known target cannot be confirmed, account deletion stops and reports an error instead of claiming success.

The endpoint cannot actively reach every Cloudflare Durable Object because Cloudflare does not provide namespace-wide enumeration. A legacy orphan object that was removed from Supabase before machine-history registration existed, and is absent from that bounded history, cannot be synchronously discovered. Known objects retain only a 24-hour anti-race tombstone so a late socket callback cannot recreate deleted state; opaque metric receipt IDs expire under the 14-day cleanup below. Cloudflare provider logs remain under Cloudflare's operational retention. None of this state is used to recreate the deleted account. Deletion does not remotely erase local device data or authorized SSH keys already installed on connected machines; remove those separately.

Only minimized pseudonymous billing records remain in our database for the periods below: subscription and refund evidence, store event identifiers used to prevent duplicate processing of Apple and Google billing notifications, refund records referenced only by a subscription, and a pseudonymous deletion receipt. Pseudonymous means the record is still protected as personal data; it is not anonymous. A normal self-service deletion does not retain your email in a post-deletion ban list. Before deletion, Otter Beam automatically stops renewal for active Stripe subscriptions and aborts deletion if it cannot do so. Apple and Google subscriptions continue until you cancel them with the applicable store.

11. Retention

• Active account, sealed sync, database push-token, and database relay-usage rows: while the account or related registration is active, then deleted through account deletion.
• Known Relay account and machine state: synchronously purged before Auth deletion; a minimal anti-race tombstone containing an expiry and, only during a partial retry, bounded machine IDs remains for at most 24 hours. Opaque Relay metric receipt IDs expire under the existing 14-day cleanup.
• Pseudonymous subscription and refund evidence: six years from creation of the deletion archive, unless a documented legal hold or unresolved payment dispute requires longer. A daily database job deletes expired records after any hold ends.
• Store billing event identifiers (duplicate-processing protection for Apple and Google notifications): up to two years from receipt, then deleted by a daily database job.
• Refund records referenced only by a subscription rather than an account: up to six years from creation, then deleted by a daily database job.
• Pseudonymous deletion receipt: two years from the deletion request, unless a documented legal hold requires longer. A daily database job deletes expired receipts after any hold ends.
• Apple, Google, Stripe, Supabase, Cloudflare, and Alibaba Cloud provider logs, backups, transaction records, installation identifiers, or legal records: under the applicable provider's controls and retention rules. They are isolated from normal product access and are not restored to recreate a deleted account.

12. Your Privacy Rights

Subject to applicable law, you may ask to access or correct personal data, delete your account, withdraw consent for optional processing, or object to or restrict certain processing. Withdrawal does not affect processing already completed and may make the related optional feature unavailable. Email peter@otterd.com from your account email so we can verify the request. You may also raise a complaint with Singapore's Personal Data Protection Commission or the competent authority where you live.

13. Security

We use TLS and SSH encryption in transit. Relay traffic remains end-to-end encrypted, and SSH private keys never leave your device. Device semantics, signed-in browser dials, and the synced Continue On address are sealed on the device for eligible device-recipient keys before cloud storage. No method of transmission or storage is 100% secure.

14. International Processing

Our primary Supabase project is hosted in the Singapore region. Cloudflare, Alibaba Cloud, Apple, Google, Stripe, and support personnel may process limited data in other countries where they operate. Their applicable terms and data-processing arrangements govern those transfers. Privacy protections and government-access rules can differ by location; contact us if you need information about a particular transfer.

15. Children

Otter Beam is not directed to children under 13, and you must also be old enough to consent to account and data processing under the law where you live. If you believe a child provided personal data without valid permission, contact us so we can investigate and delete it.

16. Changes

We may update this Privacy Policy. The date at the top of this page shows when it was last updated.

17. Who We Are and Contact

Otter Beam is provided by Otter Digital Pte. Ltd. (Singapore).
Privacy and support contact: peter@otterd.com