What Terminal knows about you

Terminal is a flight tracker for iPhone, built by one person. It works without an account, it shows no ads, and it does not sell anything about you to anyone. This page says exactly what it keeps, where, and how to make it forget. Every sentence here was checked against the code that runs today, and where the code falls short of what we intend, the page says so.

01On your phone

Almost everything lives on the phone and nowhere else.

• Your flights. Every flight you save, with its times, gates and status, is stored on the device. There is no per-person copy on our server.
• Flights from your email that the airline has not published yet. Flight number, date, route and booking reference, kept on the phone until the airline's schedule catches up.
• Reminders. Scheduled on the phone by the phone.
• Your Google email address and a first name taken from it, if you sign in with Google. They are used only to greet you and to keep your saved list separate from a guest list on the same phone. They are never sent to our server.
• A session token, if you sign in with Google: a random code our server issued when the sign-in completed, kept in the phone's secure storage. It tells the server which sign-in a Gmail pull belongs to. It is not a Google token. The phone never holds one.
• Your location, if you allow it. It is used on the phone to work out the nearest airport, whenever the app needs that. It never leaves the device.
• A random install id. A code the app makes up the first time it runs. It identifies the install, not you, and it is the only thing the server knows you by.

Delete the app and all of this is gone.

02On our server

The server runs on Google Cloud, in Google's Mumbai region. It holds five kinds of thing. The first is tied to you, the second to your phone, and the rest are flight data with no person in them.

• A record for your Google account, if you sign in. This is the one thing on the server tied to a person. It holds Google's id for the account, which is a number and not your email; a refresh token, which is Google's lasting permission for us to read your Gmail on your behalf; the short-lived Gmail access token in use; the permissions Google granted; and the hashed codes of your sessions. Both tokens are stored encrypted. The key lives in Google Secret Manager, only the server can read it, and the storage that holds the record holds only ciphertext. No email and no name are in the record. Signing out deletes it.
• The watch list. One entry per flight you save: the random install id, a flight number, a date, and a push notification token if you have allowed notifications. No names, no email addresses, nothing that says who holds the phone. Unsaving a flight in the app deletes its entry at once; otherwise entries are cleared once the flight's date is two days behind, the next time the list is written. The token is what a notification is sent to. Notifications are live: when a watched flight is cancelled, delayed, changes gate or lands, our server sends a message to the phones watching it. Nothing else is ever sent to your phone, and there is no marketing of any kind.
• A state file per watched flight. The server checks watched flights on a schedule so that changes can be noticed without every phone asking. For each flight it keeps a file named by flight number and date, holding the last schedule and status the data providers returned: times, terminal, gate, whether the aircraft has landed, when we last asked, and a list of the changes it noticed. This is flight data, not data about a person. The same file serves everyone watching that flight. It also records which notifications have already been sent, so that one is never sent twice, and that record names the random install id of each phone the message went to. It holds no push token, no email address and no name. Each file is deleted about a day after the flight finishes, once any notification about it has been sent, and every file is deleted within five days of the flight's date whether or not anyone is still watching it.
• A small cache of recent landings from Flightradar24, dropped three days after the flight, and the notifications Flightradar24 sends us about watched flights, kept as received. Both are flight data with no person in them.
• Request logs. Google Cloud keeps a log of requests to the server: the time, the path, which for a lookup includes the flight number and date, and the IP address the request came from. Google keeps these for thirty days. We do not write anything about you into them. Email text and access tokens never appear in them.

03Gmail, if you connect it

You can let Terminal find your flights in your inbox. This is optional and off until you turn it on. When you do:

• We ask Google for read-only access to Gmail. Terminal cannot send, delete or change anything in your mail.
• The sign-in completes on our server. Google hands the phone a one-time code, the phone passes it to our server, and the server exchanges it with Google. Google answers with a refresh token, which the server stores encrypted as described in section 02. That token is what lets the connection last: you sign in once, not every time.
• Our server does the reading, not the phone. When you ask the app to pull flights from Gmail, the phone sends its session token to our server. The server uses your refresh token to obtain a short-lived Gmail access token, then calls Gmail on your behalf: it asks for messages received in the last year whose subject looks like a booking, fetches only those, and does not see the rest of your mail.
• No Google token is ever written to a log, and none is ever sent back to the phone.
• The text of each matching email is sent to Google's Gemini model, which pulls out the flight number, date, route and booking reference. That text is cut to a fixed length before it is sent, is never written to a log, and is never stored. Once the flight details are out, the email is forgotten.
• The flight details go back to your phone, and only there.

PDF tickets are read too, and this is new. Airlines often send the itinerary as an attached PDF and leave the message itself nearly empty. When a matching email carries one, the file is sent to Gemini along with the text, for the same purpose and under the same rules: it is never written to a log and never stored, and it is forgotten once the flight details are out. Only PDFs are read, only from emails that already look like a booking, and only up to one megabyte and four pages — a larger file is ignored rather than sent. No other kind of attachment is opened.

The assistant inside the app works the same way: what you type is sent to our server and on to Gemini to be answered, and is not kept. If you ask it about your next flight while signed in, it reads Gmail in the same way.

Terminal's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In plain words: what we read from your Gmail is used only to find your flights and show them to you. It is not used for advertising, it is not sold, and no person at Terminal reads it, except with your permission, for security reasons, or where the law requires.

04Who else sees anything

Four companies, and only what each needs:

• Google Cloud hosts the server, the files in section 02, the encryption key in Secret Manager, and the request logs.
• Google Gemini receives the text of booking emails you let us read, and what you type into the assistant.
• Flightradar24 and AeroDataBox receive flight numbers and dates, so the app can show schedules, gates and whether the aircraft has landed. They never receive your install id or anything about you.

That is the whole list. There is no analytics kit, no crash reporter, no advertising network and no data broker.

05What we do not do

• No account to create. Signing in with Google exists only to reach Gmail, and the record it makes on our server is the one described in section 02.
• No advertising, in the app or anywhere else.
• No selling, renting or sharing of your data.
• No tracking across other apps or sites.

06Disconnecting and deleting

• Disconnect Gmail: sign out of Google inside the app. That deletes the session from your phone, deletes your account record with its refresh token from our server, and revokes Terminal's access at Google. You can also revoke it yourself at myaccount.google.com/permissions, which cuts it off from Google's side no matter what the app does.
• Delete a flight from the server: unsave it in the app. That deletes the watch entry at once; the flight's state file, which names no one, is deleted within five days.
• Delete everything on the phone: delete the app.
• Anything else: message @Jayo10o on X with your request. Since the server holds no name or email, tell us the flights on your list and we will remove them.

07Changes

If any of this changes, this page changes, and the date at the top moves. The app will not start collecting something new without saying so here first.