Privacy Policy

Effective: August 8, 2026

Data controller: BarbarOS Technologies LLC, a New Mexico limited liability company, 1209 Mountain Road Pl NE, Ste R, Albuquerque, NM 87110, United States.
Privacy contact: info@barbarostechnologies.com

1. The short version

Ormur is a remote terminal for computers you are authorised to control. Terminal input and output, commands, keystrokes and selected file transfers travel through an end-to-end encrypted device link. BarbarOS Technologies LLC cannot read that content. We do not use advertising, cross-app tracking or behavioural analytics.

To pair devices and keep them reachable, we process limited connection metadata. This policy explains that metadata, optional voice input and your choices.

2. Data we process

• Device and connection identifiers: device labels, device public keys, device-scoped pairing credentials and temporary private mesh addresses.
• Pairing and reachability: short-lived pairing codes, online/offline state, last-seen time and IP information observed during connection setup.
• Diagnostics: limited connection and error records used to provide, secure and troubleshoot the service. They are designed not to include terminal bodies or file contents.
• Purchase status, if a paid feature is offered: an entitlement or transaction status supplied by Apple or another disclosed payment provider. We do not receive payment-card details.
• Support requests: information you choose to send when you contact us.

3. Terminal content, files and AI tools

Terminal traffic and files you explicitly transfer are encrypted between your paired devices and are not collected by our coordination or relay services. A relay may carry encrypted packets but cannot decrypt their content.

AI command-line tools run on your computer under accounts you control. If you choose to use a cloud-backed tool, that tool may send prompts, code or files to its provider under the provider's terms. Ormur does not receive or store your AI-provider login credentials and does not make that separate provider processing part of its own service.

4. Microphone and speech recognition

Ormur requests microphone and speech-recognition permission only when you choose voice input. Ormur does not retain raw microphone audio or upload it to Ormur servers. Apple or the speech-recognition service selected by your device may process audio to return recognised text under its own privacy terms and device settings. You can deny these permissions and type instead.

5. Purposes and legal bases

We process the limited data above to pair and authenticate devices, provide reachability, prevent abuse, deliver support, maintain security and comply with legal obligations. Where the GDPR or UK GDPR applies, the legal bases are performance of a contract, our legitimate interests in security and reliability, consent where requested by the operating system, and compliance with law.

6. Service providers and disclosures

We use infrastructure providers to host the coordination service and public website. App stores may process downloads, purchases and device-level services under their own terms. These providers act for their stated service purpose. We do not sell personal information, share it for cross-context behavioural advertising or use it to track you across apps or websites.

• Hetzner Online GmbH: hosts coordination infrastructure in Germany and processes the limited connection metadata described above.
• Apple: distributes the iOS app and may process speech-recognition requests you explicitly start, subject to Apple's settings and privacy terms.
• Google Play services / ML Kit on Android: the system code scanner used for QR pairing may collect device or app information, a per-install identifier, performance information and scan-event diagnostics as described in Google's ML Kit disclosure. Ormur does not receive this Google diagnostics stream.
• Optional Android wake relay: release builds keep this path off by default. If a reviewed relay is configured and you explicitly enable background wake, a content-free signal can prompt the app to reconnect. The relay can observe the random topic, IP address and delivery timing, but the wake message contains no terminal text.

We may disclose information when required by law or when reasonably necessary to protect users, the service or our legal rights. Because terminal content is end-to-end encrypted, we do not have readable terminal content to disclose.

7. Retention

• Pairing codes are deleted when used or expire, normally within about ten minutes.
• Device registration and reachability metadata is retained while a device remains paired, subject to security cleanup of stale records.
• Revoking a device removes its active access. Related operational records are deleted or de-identified when no longer needed for security, support or legal obligations.
• Support and purchase records are retained only as long as needed for the request, accounting or legal obligations.

8. Your controls and rights

You can revoke a paired device in Ormur. To request access, correction, deletion, restriction, portability or to object to processing, email info@barbarostechnologies.com. We may verify device ownership before acting on a request. Instructions are also available at ormur.app/account-deletion.

Depending on where you live, you may complain to your local data-protection authority. We do not discriminate against users who exercise privacy rights.

9. International processing and security

Service providers may process limited metadata in countries other than yours. Where required, we use appropriate safeguards. We use transport encryption, end-to-end encryption for terminal traffic, device-specific credentials and revocation controls. No security system is perfect, so protect a paired phone as you would a signed-in computer.

10. Children

Ormur is a developer tool and is not directed to children under 16. We do not knowingly collect personal information from children.

11. Changes and contact

We may update this policy as the product or law changes and will revise the effective date. Questions or privacy requests: info@barbarostechnologies.com.