What Termic sends, and where

Termic has no server, so there is nowhere for your work to go. What is left is a short list of requests that carry nothing about you, and one of them only happens when you click Update.

The interface is bound by a content security policy that makes anything outside that list fail rather than merely not happen, and the policy is one line in a file you can read before you install.

No account

Open the app, add a folder, start an agent. There is no sign-in, because there is nothing to sign in to.

No backend

Termic has no server. Nothing to breach, nothing to go down, nothing that can start charging you later.

No upload

Prompts, transcripts, diffs and file paths stay on disk. Not encrypted in transit somewhere. Not sent.

the whole list

Every request the app makes

Including the ones triggered by your agent rather than by Termic, because that distinction matters more than it sounds.

What	Where	When	Avoidable?
Changelog JSON	termic.dev/updates/changelog.json	When the app checks for a new release.	Skip it by not updating. Nothing else depends on it.
Changelog markdown	termic.dev/updates/changelog.md	When you open the What's New dialog.	Only fetched if you open the dialog.
The release itself	github.com	Only when you click Update, or install with Homebrew.	Download the .dmg by hand instead if you prefer.
Your agent's own traffic	Anthropic, OpenAI, Google, GitHub, your package registries	Whenever the agent you launched calls its own API.	Termic is not in that path. With the sandbox on, it is restricted to a hostname allowlist you control.

Last reviewed: 2026-08-12, against the current release. If you catch a request that is not on this list, file an issue and it is a bug, not a footnote.

the enforcement

One line does the work

Termic renders in a system WebView governed by this content security policy, from src-tauri/tauri.conf.json:

connect-src 'self' ipc: http://ipc.localhost ws: wss: https://termic.dev

connect-src is the allowlist for every fetch, XHR and WebSocket the interface can open. Local IPC, local sockets, and termic.dev. An analytics call or a session upload added to the interface would not be a policy violation, it would simply fail.

To be exact about the boundary: this governs the interface, the part that renders and holds your prompts, diffs and file contents. The Rust side downloads the release itself when you click Update, which is the GitHub row in the table above and the only request the policy does not cover.

That is why the list above is short and why it is checkable. You do not have to believe a privacy policy. You can read a config file.

what is not there

The absences are the product

No Termic account. There is nothing to sign in to.
No Termic server. There is no backend to be down, breached, or acquired.
No session upload. Transcripts, prompts and diffs stay on disk.
No project names, repo names or file paths sent anywhere.
No licence check, no seat count, no activation, no phone-home to keep working.
No crash reporter. A crash writes a log to your temp dir and stays there.
No third-party SDK in the app: no analytics vendor, no error tracker, no feature-flag service.

Each of those is a decision that stays made, because AGPL-3.0 means the version you have cannot be taken away from you. If this project ever changes its mind, the last good commit is still yours to build.

the honest part

Local does not mean the agent is safe

The agent you launch is a program with your shell, your filesystem and your credentials. Keeping Termic off the network does nothing about that, and pretending otherwise would be the same marketing this page exists to avoid.

So there is a sandbox. Each task can be locked to its worktree with macOS Seatbelt and a network allowlist, pinned when the task is created so it cannot be switched off halfway through. While testing it, Termic caught Claude Code reaching for ~/.config/gh/hosts.yml and browser profile directories while idle. Inside the cage those reads fail. Outside it, they quietly succeed.

How the sandbox works.

questions

Reasonable follow-ups

Does Termic work offline?

The app does. Projects, tasks, worktrees, the editor, diffs, terminals and the sandbox are all local. The changelog fetch fails quietly. Your coding agent still needs the internet to reach its own model, unless you point it at something running on your machine.

Does Termic collect analytics?

The app ships no analytics today. If usage analytics are ever added they will be opt-in, off by default, anonymous, and pointed at a self-hosted instance, and this page will say so before the release does. This website does use analytics, like most websites. The app and the site are different things.

How do I verify any of this?

Three ways, in ascending order of paranoia. Read the CSP in tauri.conf.json. Grep the source for http. Or run Little Snitch, Lulu or tcpdump and watch the app for a day.

Is it really open source, or open core?

AGPL-3.0, the whole app, one repo. No paid tier, no enterprise build with the good features in it, no CLA that lets the licence be changed later. The AGPL is the part that stops a future version of this project quietly closing up.

What about the sandbox and the proxy? Those touch the network.

They restrict it. The sandbox runs an in-process CONNECT proxy so a caged agent can only reach hosts on an allowlist you control. It is a filter on the agent's traffic, on your machine. Nothing is copied anywhere.

Why does this page exist?

Because "local-first" is easy to say. Every claim here is one file or one packet capture away from being disproven, which is the only kind of privacy claim worth making.

Install Termic

Free. AGPL-3.0. macOS and Linux releases now.

Read the source / Direct .dmg / Compare