BoxDo Terminal — Privacy Policy

BoxDo Terminal is a free macOS app that runs AI coding agents on your own Mac. It works without an account: signed out, your files, your transcripts and the contents of your sessions stay on the Mac. Signing in with a BoxDo account is optional — and it is the thing that moves some of your work off the Mac. A few things leave it either way, and this page says exactly what, and when.

Local use without an account

Install the app and it works: pick an agent, open a session, start writing. There is no sign-up wall and no account requirement.

Everything the app keeps lives on your disk, in ~/Library/Application Support/BoxDo Terminal/: your workspaces and sessions, the transcripts of your conversations, the live activity of a running agent, your themes, shortcuts and preferences. These are ordinary files, protected by whatever protects your disk (FileVault). We have no copy of them and no way to reach them.

A few things do leave the Mac even when you are signed out. All of them are about the app, none of them about your work:

• App updates — once a day the app asks GitHub whether a newer version of BoxDo Terminal exists, and downloads it if you accept.
• Agent catalog — once a day it downloads a signed JSON file from boxdo.com/terminal/catalog-v1.json containing the agent definitions. Nothing about you is sent to fetch it.
• Version checks — when you open the agent settings, the app asks the npm registry for the agents' current version numbers.
• Anonymous usage data — a one-time ping on first launch, a daily report and crash reports, all described just below, all behind one switch.

Anonymous usage data

Unless you turn it off, the app sends three kinds of small JSON messages to boxdo.com. None of them is about your work.

A first-launch ping. The very first time the app opens, it sends the install ID, the app version, the macOS version and the processor architecture — nothing else, not even the agent list. It tells us that a download turned into an installed app.

The daily report. At most one every 20 hours. The app checks whether one is due when it launches and then once an hour while it stays open, so a Mac that keeps BoxDo Terminal running for days is still counted. This is the complete list of what it contains:

• A random install ID (a UUID created on this Mac) — so one Mac reporting daily isn't counted as a new user every day
• App version, macOS version and processor architecture (arm64 or x86_64) — to know which versions and builds we must keep supporting
• For each supported agent: its id, whether it is installed, its version number, and how many sessions you have with it
• The calendar days (dates only, no times) on which the app was open since the previous report — so a report that arrives late still says which days the app was used, and we can tell whether people come back

Why the agent list matters: BoxDo Terminal ships adapters for agent CLIs that release constantly. Knowing which ones people actually run, and at which versions, is how the model lists, slash commands and install commands in the app stay correct.

Crash reports. When the app crashes, macOS hands it a crash diagnostic (MetricKit) on the next launch, and the app forwards it with the install ID: the app and macOS versions, the time of the crash, the exception type, code and signal, macOS's termination reason, and the stack of the thread that crashed as binary names and memory offsets (for example BoxDoTerminal + 0x1a2b). Only the file name of each binary is sent — never its folder — and our server cuts any path it still finds, in a binary name or in the termination reason, down to its last component before anything is stored. A crash report contains no variables, no memory contents, nothing you typed and nothing an agent wrote. It lets us group identical crashes and fix the ones that happen most.

Agent installs that fail. BoxDo Terminal can install an agent for you. If an install fails and the app cannot fix it by itself, it asks our server what went wrong and sends: which agent, the install command, the kind of failure, the app and macOS versions, your Mac's processor type, and the last lines the installer printed — with your home folder and account name replaced before they leave your Mac. Our server passes that to an AI model (Anthropic, through Vercel's AI gateway) to get an explanation and a suggested fix, and stores none of it: the log line it keeps has the agent and the kind of failure only. No install ID and no account are attached. This is not covered by the switch below, and it only ever happens after an install you started has failed. Pressing “Send to BoxDo” on a failed install is separate and deliberate: it emails that same information to us so we can fix the cause.

What none of these ever contains: no name, no email, no account, no file names, no folder paths, no workspace or session titles, no prompts, no agent output, no source code, no Apple ID, no hardware serial or advertising identifier. The install ID is generated randomly by the app, is not derived from anything about you or your Mac, and is never joined with any other BoxDo data — including your account, if you have one. It is still a pseudonymous identifier, stable for this installation, so we treat these messages as personal data under the GDPR and describe them accordingly here. They are deleted automatically after 12 months.

The switch lives in Settings → Privacy → “Share anonymous usage data” and the same pane shows you the install ID, with a button to copy it. Turning it off stops the daily report and crash reports immediately and permanently — there is no separate “essential telemetry” that keeps running. The first-launch ping is the one exception to “you can switch it off first”: it leaves on the very first launch, before you have opened Settings, and it is sent only once. Development builds never send any of this.

The website

The download button on boxdo.com goes through boxdo.com/download/terminal before it reaches the DMG on GitHub. Each click is counted with the campaign tag in the link, if any (for example ?ref=hn), the name of the site that linked to the page (its host name only, never the page address), the country your connection comes from, and a coarse operating-system family (Mac, Windows, Linux…). Your IP address and your full browser identification are not stored, and nothing ties a click to the app you later install.

The public pages of boxdo.com (the home page and the BoxDo Terminal pages) use Vercel Web Analytics to count page views, referrers, countries and device types. It sets no cookies and stores nothing on your device; visitors are not tracked across days or across sites. The BoxDo app and its dashboard do not use it.

Signing in

Signing in is optional. It does not change what the app does locally; it adds features that need a server, and each of them is described in its own section below.

• Remote workspaces and agents — the sessions of a workspace you publish are mirrored as chats in the BoxDo app: what you type into that session and what the agent answers become ordinary chat messages on our servers, in plain text, so you can read and steer them from the BoxDo app. Only the workspaces you publish, and only you can see them.
• Cloud Resume — a session started on one Mac can be picked up on another Mac of yours, because a sealed copy of its transcript is parked with us.
• Machine presence — the BoxDo app can see that this Mac is running and flip its keep-awake switch remotely.
• Diagnostics — the opt-in event log described under “Your choices”.

How the sign-in itself works: the app opens boxdo.com/terminal/connect in your browser with a loopback port, you enter your BoxDo credentials there, and the two session tokens are handed straight back to the app on 127.0.0.1. Signing in on that page deliberately does not create a boxdo.com session in that browser — you are signing in on behalf of the Mac app, not on behalf of the browser. If you use the in-app sign-in form instead, your password goes from the app straight to our authentication provider; the app never stores it. Either way, what the app keeps is the pair of session tokens, in your Mac's keychain.

Signing out stops all of it. Anything already uploaded stays until you delete it — see “Your choices”.

Remote agents and chats

A remote agent is an agent that lives in one of your workspaces and that you can call from a BoxDo chat by mentioning it. This is the one part of the app that involves other people, so it is worth reading closely.

When you — the owner — mention your agent in a chat:

• BoxDo Terminal on your Mac picks up the mention and runs the agent locally, in the CLI engine you chose for it (Claude Code, Codex, Kimi, and so on).
• Along with your request it gives the agent the recent messages of that chat it hasn't seen yet — a bounded window, capped at 60 messages or 12,000 characters, and reaching no further back than midnight on the first delivery.
• If chat files are enabled for that agent (they are by default, and the setting is in BoxDo Terminal), files shared in those messages are downloaded to a private inbox folder on your Mac — ~/Library/Application Support/BoxDo Agent Inbox, never into one of your project folders — so the agent can read them. Anything older than 14 days is swept from it. With the setting off, the agent sees that a file exists and what it is called, never its content.
• The agent's answer is posted into the chat under its own name, and everyone in the chat receives it like any other message.

Three consequences we want to state plainly:

• Other people's messages are read by the engine you run. Those words travel to whichever AI provider you chose, under your own subscription or API terms with them. BoxDo does not proxy that traffic and never sees it. Only mention an agent in a chat where that is acceptable to the people in it.
• Only you can instruct your agent. A mention is delivered only when the person who wrote it owns the agent, and that is enforced in the database rather than in the app — nobody else can make your agent run. The agent is also told to treat text written by other people as information, never as instructions.
• Everything except the answer stays yours. Approval prompts, questions, tool steps and the agent's own session transcript live in a private session that only you and the agent are in. The chat itself only ever gets your mention and the agent's answer.

The first time an agent is mentioned in a chat, BoxDo posts a notice there telling the members that the agent can read recent messages and files when its owner mentions it. In a group chat the agent's messages carry an AI mark next to its name, and the agent is instructed to say that it is an AI agent, run by you, whenever anyone asks.

Cloud Resume

Cloud Resume asks before it starts. The first time there is something to park, a screen lists the folders it would cover and nothing is uploaded until you accept it; afterwards you can pause saving, or switch individual folders off, in Settings → Cloud. With it on, at the end of a turn the Mac that owns a session uploads that session's engine transcript — the conversation itself — to a private BoxDo storage bucket, so another Mac signed into the same account can continue it mid-thought.

The archive is sealed on your Mac before it goes anywhere, with AES-GCM-256 and a key kept in your Keychain. BoxDo never receives the key and cannot read what is inside; if the Keychain refuses the key, the upload is skipped rather than sent in the clear. The key is marked to sync through iCloud Keychain — that is what lets your other Mac open the archive — so it travels between your own devices through Apple, and never through us. The bucket is private and its access rules are owner-only: not even other members of a workspace can read your transcripts. One session is one object, at a path derived from your user id and the session id, and the server re-derives that path rather than trusting the app.

What is not sealed is the label on the box: the session's name, its status, which machine it belongs to, the times, the object path and the byte count. Since a session is usually named after a folder or a chat, assume that folder and chat names are visible to us — the conversation is not. Permanently deleting a session in BoxDo Terminal deletes its archive too.

What we store

Signed out: nothing that identifies you — only the anonymous usage data above (the first-launch ping, and the daily report and crash reports if you left them on).

Signed in, on our servers (hosted on Supabase, reached through our website on Vercel):

• Your BoxDo account — the same account as the BoxDo app.
• Workspaces and sessions as rows: names, kind, status, timestamps. A workspace is named after the folder you published, and a session after the folder or the chat it belongs to — so those names are with us in the clear.
• The mirrored conversation of a published session: your prompts, the agent's replies, its approval and question cards, and any file it hands over — stored as ordinary chat messages and chat media, in plain text, visible to you (and to the members of a chat, for what an agent answers there).
• Machine presence, while the app is running: the Mac's name (normally its computer name), the BoxDo Terminal version, a heartbeat every 30 seconds, and a small status snapshot — whether keep-awake is on, whether the Mac is on power, its battery percentage. There is also a field for a direct peer-to-peer address, which current builds never fill in. Only you can see any of it.
• Sealed session transcripts, only if you turned Cloud Resume on.
• Diagnostics events, only if you turned them on: event names, categories, levels, counts, app and macOS versions, your Mac's model identifier (never a serial), which agent an event is about, error names. Never what you or the agent wrote, never terminal output, file paths, folder or workspace names, account names or credentials — those are stripped on your Mac as each event is written. Kept for 14 days, then deleted automatically.

We do not read the contents of sealed transcripts. Files the agent downloads from a chat stay on your Mac; they are never copied to our servers.

Third parties

• The AI agents you install and run. BoxDo Terminal is a host: it launches the CLI you already have and shows its output. Those agents send your prompts and parts of your code to their own providers, under their own terms and privacy policies, using your own accounts and API keys. BoxDo never sees, proxies or stores that traffic. When you ask the app to install one, the install script is fetched from that agent's own site. Please read the privacy policy of each agent you use.
• Apple — the app is signed with a Developer ID and notarized, so macOS checks it with Apple the first time you run it.
• GitHub — updates are downloaded from our public releases repository. GitHub sees the request.
• Supabase — BoxDo's database, storage and authentication provider.
• Vercel — hosting for boxdo.com, which the app talks to for the catalog, the sign-in page and the anonymous usage data, and the cookieless Web Analytics on the public website.

As with any web request, the connection itself is visible to those providers' infrastructure and may appear in short-lived technical logs, including the originating IP address. We do not store the IP address with the usage data or the download count, and we do not use it.

Your choices

• Don't sign in. The whole local app works signed out, and nothing in this policy after “Signing in” applies to you.
• The daily report and crash reports. Settings → Privacy → “Share anonymous usage data”. One switch, off for good.
• Diagnostics. Settings → Privacy → “Share anonymous diagnostics”. Off by default, and only possible while signed in. The same pane shows you the real event lines before you decide; Export Diagnostics writes a sanitized bundle you can read before you send it to us; and after an unclean shutdown the app offers to send one line about it, showing you that exact line first. With the switch off, the log is still written — on your Mac, where it stays.
• Chat files. Per agent, in its settings in BoxDo Terminal. Off means the agent never receives the content of a file shared in a chat.
• Cloud Resume. Nothing is parked until you accept the screen that asks. Settings → Cloud pauses saving or drops a folder; deleting a session deletes its archive; signing out stops any further upload.
• Deletion. Anything tied to your account — messages, sessions, transcripts, presence, diagnostics — we delete on request from the account's email address. The anonymous usage data has no account attached, so for that one send us the install ID (Settings → Privacy shows it, with a button to copy it) and we delete every report, ping and crash report matching it.
• Objecting. Under the GDPR you can object to the usage data; the switch is that right, implemented as a switch. Our legal basis for it is legitimate interest (Art. 6(1)(f)). Everything else described here happens because you asked the app to do it.

BoxDo Terminal is a developer tool and is not directed at children under 16. If we change what any of this collects, we update this page and the description inside the app before the change ships.

Contact

Questions, deletion requests, anything else: privacy@boxdo.com