Privacy Policy

Effective: 14 October 2026

1. What we collect

Authentication data: When you sign in with Google, Firebase supplies an account identifier and token claims, which can include your email address and display name. We use these to authenticate and display your account.

Session metadata: We process machine identifiers, hostnames, session names, connection state, and dimensions to route your sessions. Paired-machine records remain until you remove the machine or request account deletion; live session state is held in memory.

MCP client credentials: If you authorize a local scomp-mcp client, we store a one-way hash of its opaque access token plus its label, owner account, approved host identifiers, scopes, creation time, expiry, and optional revocation time. The plaintext token is returned once to your laptop and is not stored by the relay. Pending browser-approval requests are short-lived and process-local.

Session recordings (opt-in): Recording is off by default. If you explicitly turn it on — for your account or for a specific machine, after accepting the in-app recording notice — we store terminal output for sessions on the machines you enabled. Commands can appear when the terminal echoes them, but the relay does not separately record hidden password input. Recordings are readable only through your account and are kept until you delete them.

Push notification tokens: If you enable notifications, we process your browser subscription or Android messaging token to deliver terminal-ready and session-ended alerts. Notification previews hide host names by default.

Server logs: Operational logs can include timestamps, IP addresses, user agents, error details, and route paths. Authentication tokens and terminal content are not intentionally logged.

2. What we do not collect by default

By default we do not retain terminal session content. The relay must process terminal input and output in readable form to deliver the service, so Scomp is not end-to-end encrypted from your machine to your viewing device. When recording is off — the default for every account — terminal content passes through relay memory and is not written to recording storage.

3. How we use your data

Data collected is used solely to: (a) authenticate you and authorized MCP clients; (b) enforce host- and scope-specific terminal access; (c) route your terminal sessions; (d) deliver push notifications you have enabled; (e) diagnose and resolve technical issues.

4. Data sharing

We do not sell or rent your personal data. We use service providers as needed to operate Scomp, including Google/Firebase for authentication and Android messaging, browser push providers, AWS for content delivery and optional recording storage, and OVH for relay hosting. We may also disclose data when required by law.

5. Data retention

Account and paired-machine data is retained while your account is active. MCP credential metadata remains until account deletion; credentials have a finite expiry (30 days by default and no more than 90 days) and can be revoked independently. Pending MCP approvals, live session state, and push registrations are currently process-local. Operational-log retention follows the relay host's rotation policy. Session recordings, if you enable them, are kept until you delete them — there is no automatic expiry. You may request deletion of your account and associated data by contacting us.

6. Security

Your browser, agent, and MCP client connect to the public service using TLS-protected HTTPS and WebSocket connections. TLS terminates within Scomp's service infrastructure, where the relay processes terminal content in readable form; this is transport encryption, not end-to-end encryption. Access to sessions and recordings is account-scoped, machine pairing requires local PIN confirmation, and MCP access requires explicit browser approval of hosts, scopes, and a finite lifetime. Remote terminal output is untrusted data and can contain prompt-injection content.

7. Your rights

Depending on your jurisdiction, you may have the right to access, correct, or delete your personal data, or to object to certain processing. Contact us to exercise these rights.

8. Changes

We may update this policy. Material changes will be communicated via the Service or by email where we have your address.

9. Contact

Privacy questions: contact@scomp.me