Last updated October 20, 2026 (workspace preview)
Terminal Commands connects ChatGPT, Claude, Codex, or another MCP-compatible AI client to a computer or server that you choose to run the companion on.
The service may process your authentication identity and verified email, connected-device metadata, authorized file paths and contents, program names, arguments and output, task states, and operational errors when needed to deliver a request.
Data is used to authenticate your account, route requests to paired machines, return results, prevent cross-account access, and support service operations. Auth0 processes authentication information. Tool data passes between the AI client, the Terminal Commands gateway, and your companion. It is not sold or used for advertising.
The gateway holds device connections, in-flight requests, and routed file contents in memory. Its PostgreSQL task database stores account/device identifiers, task IDs, states and timestamps, bounded stdout and stderr, errors, process-event receipts, idempotency metadata, and device-pairing hashes. The live terminal view also stores a bounded display copy of the program, arguments and working directory, with reported companion receipt and approval status. Common credential-bearing arguments are masked before storage; this does not guarantee detection of every secret. Commands and output can contain personal information or secrets. The task database does not intentionally store arbitrary file-read contents outside the optional workspace baseline described below.
The optional workspace preview stores saved project names, machine IDs,
paths and folder identities until the project bookmark is forgotten.
Starting a coding run stores its goal, operation IDs and a bounded copy of
source-text files on the gateway for before/after comparisons. Known
credential filenames, VCS data, links, dependencies and generated folders
are excluded, but source files can still contain sensitive data;
.gitignore is not interpreted. Coverage omissions are shown
in the workspace. Run baselines become inaccessible after seven days and
are removed by periodic cleanup, which may be delayed by an outage.
Deleting a run snapshot removes that baseline without stopping commands or
deleting machine files. Forgetting a project does not delete its existing
run baselines or task logs. Earlier backups follow their separate
retention.
Process output, error text, command display/approval details and event receipts become eligible for removal seven days after a task is terminal or uncertain by default. Cleanup is periodic and may be delayed by downtime or backlogs; operators may configure a different period. Task metadata and idempotency records remain longer to prevent accidental command re-execution, without automatic expiry today. Earlier database backups can retain deleted output under separate backup retention rules.
The companion stores OAuth credentials, a device identity and private
pairing secret, and bounded execution receipts locally. Execution receipts
may remain for up to 30 days. Running
terminal-commands logout removes local OAuth credentials, but
does not automatically revoke the server-side device pairing.
OAuth permissions and account-bound device pairing control access. Dedicated filesystem operations are limited to locally approved roots; approved executable programs still run with the machine user's OS permissions and are not sandboxed. Commands and writes are disabled by default and locally approval-gated when enabled. Disconnecting the companion ends its active connection. Owners can list paired device IDs, including offline or revoked machines, and revoke a pairing using a fresh device-management OAuth authorization.
For privacy questions, device revocation, deletion requests, or backup retention details, email postmaster@terminalcommands.fr or visit our support page. Do not send passwords, tokens, private keys, or sensitive output.