Safety

Privacy and Data Handling

In this handbookContents

AITerm is built to keep your data on your machine by default. There is no AITerm-hosted proxy for model requests: local providers stay entirely on your Mac, and cloud providers receive requests directly from your Mac using the account or key you configured. AITerm is never in the middle.

Local vs. cloud

Local providers (Ollama, managed MLX, or a custom server pointed at localhost) send nothing off the machine. They always receive the full session context, because it never leaves your Mac.
Cloud providers (OpenAI, Anthropic, Bedrock, Azure, and the rest) receive only what your Cloud Context Level allows, and only after redaction.

Cloud Context Level

Cloud Context Level (Settings ▸ Privacy, "How much the AI sees") controls the ambient session context sent to cloud providers:

Nothing — no ambient session context at all.
Recent commands only — recent command lines and exit codes, with no output bodies. This is the default.
Recent commands + output — recent commands, exit codes, and tail-truncated output bodies.

The setting only ever caps what cloud models see. Local models always get the full context because it stays on the machine.

Redaction before cloud requests

Before anything goes to a cloud provider, AITerm redacts obvious secrets in your request and the command and terminal text it sends; your system prompt is your own configured text and is sent as you wrote it. It redacts these categories:

API keys & tokens (OpenAI, Anthropic, Slack, GitHub, Google, JWTs)
Authorization / Bearer headers
Passwords & secrets in KEY=VALUE form
Connection-string credentials (user:pass@host)
Private-key blocks (PEM / SSH)
Long hex / base64 blobs (hashes, keys)

Redaction happens at a single egress point — the same code path that actually sends the request — so a local model can still see real values while a cloud model only ever sees the redacted version. Redaction is a safeguard, not a guarantee that every secret-shaped string is recognized. For sensitive work, keep Cloud Context Level at Nothing or Recent commands only, or use a local provider.

The eye chip

After each AI request that carried context, the eye chip on the input bar shows exactly what the provider received. For a cloud provider it shows the redacted payload — the same redaction applied to the real send — so you can confirm what left your Mac. For a local provider it shows the raw local context, because nothing left the machine. If AI is off — the selected connection couldn't start — the chip says Not sent — AI is off instead: nothing was sent anywhere.

The connection check and Report a Problem

A connection check sends one fixed sentence — “Reply with the single word OK.” — plus your system prompt, exactly as you wrote it (redaction covers the message text, not the system prompt), to the applied connection, and nothing from your terminal. It runs when you click Check in Settings ▸ AI or Check connection in the menu of the connection chip in the status bar, and by itself after you switch connections, after an Apply (not when it changed nothing and the connection already works), after you save the connection in use, after you allow cloud use, and at launch (not when the connection answered in the last 24 hours). It is one request, like any other, and it never goes to a cloud connection before you have allowed cloud use. AITerm remembers the outcome, the connection and the time — never the reply or a key. Saving a key in setup first lists that provider’s models with it, to choose one.

Help ▸ Report a Problem…: AITerm itself sends nothing. It hands your browser a link to the tracker's bug form with your AITerm version, macOS version, your Mac's chip (for example Apple M4), AI provider type and safety profile filled in — never a key, server address, model, command or anything from your terminal. GitHub sees those lines when the page opens; nothing is submitted until you choose to.

API keys

Provider keys live in the macOS Keychain, not in a plain config file. Each named custom server, Azure connection, and Bedrock static-key connection uses its own Keychain slot, so keys never leak across saved connections.

History stays local

Your command history and the search indexes built from it (including the Pro semantic index) never leave your machine, and are never sent to any provider. They feed the ⌘K palette only.

One detail worth being precise about: the Pro semantic index is built by a local embedding model (all-minilm) served by Ollama on 127.0.0.1, so the text being indexed does leave AITerm's own process to reach that local engine — it does not leave the computer, and no remote service is contacted. The saved index itself is keyed by a hash and stores no command text. See History and Search.