Privacy

Last updated 4 August 2026

The short version. Bento Term is a terminal and SSH client. It connects your device to a computer you already administer. There is no Bento account, and your terminal sessions are between you and your own machine — they are never sent to us. Two things can leave your device, both under your control: optional usage analytics, which are off until you turn them on, and voice audio, only if you choose a cloud speech engine over the on-device default.

Who this covers

This policy applies to the Bento Term apps for iOS, iPadOS and macOS, published by Chi On Ho. It is one policy for all of them; where a platform differs, it says so.

There is no account

Bento Term has no sign-up, no login, and no user profile. We do not know who you are, we cannot list your machines, and there is no server holding your data. You point the app at a host you can already reach over SSH, and it connects directly to it.

What stays on your device

Host credentials. SSH passwords and private keys are stored in the system Keychain and are used only to open the connection you asked for. They are never transmitted anywhere except to the host you are connecting to, as part of the SSH handshake.
Your host list — hostnames, ports and usernames — is stored locally. On macOS the app can also read your existing ~/.ssh/config to offer those hosts; it reads that file, it does not upload it.
Preferences — theme, font size, layout, speech engine, and your consent toggles — are stored locally in the app's own settings.
Terminal content. Everything printed by the programs you run stays between your device and your host. Bento Term does not log it, back it up, or send it to us.
Files you preview. Tapping a file path in the terminal reads that file over the same SSH connection and renders it on your device. The file is not copied anywhere else.

Optional usage analytics

Off by default. Nothing is sent unless you turn analytics on in Settings. When it is on, the app sends a small batch to our server containing exactly these fields:

Field	What it is
`install_id`	A random identifier minted on this install. Not linked to an account, an email, an advertising identifier, or your device's identifiers.
`platform`	iOS or macOS.
`app_version`	The app version you are running.
`events`	Names from a fixed list defined in the source code — for example `voice_send`, `workspace_created`, `app_active_day` — each with a timestamp.

An event is a name and a time. It never carries terminal output, commands, hostnames, file paths, transcripts, or any content you typed or read. Turning the toggle off stops the sending and deletes the random identifier, so a later opt-in produces a new one that cannot be joined to the old.

Voice input

Voice is optional and the microphone is only accessed while you are holding the voice control. iOS asks for microphone and speech-recognition permission the first time, and the feature is unavailable until you grant it.

The default engine is Apple's on-device recognizer. In the shipping configuration your audio is transcribed on the device and does not reach any server of ours.
If you choose a cloud engine (OpenAI or Qwen) without supplying your own API key, audio is streamed through our proxy at relay.bentoai.dev to that provider so it can be transcribed. The proxy forwards the stream in real time; it does not store audio or transcripts. The speech provider's own handling is governed by their terms — OpenAI and Alibaba Cloud (Qwen).
If you supply your own API key, the app calls that provider directly and our proxy is not involved.
Recognition accuracy is improved by biasing it with words already visible in your session. That happens on your device.

What we never do

No advertising, no ad identifier, no ad networks.
No third-party analytics or crash SDKs are embedded in the app.
No tracking, in Apple's sense: nothing collected is combined with data from other companies, or shared with data brokers.
We do not sell data. There is no data to sell.
We do not read your terminal sessions, and we could not — they do not pass through us.

Diagnostics

Development builds write a local diagnostic log to help us reproduce bugs. Released builds do not write it, and delete any file left behind by a development build. If you send us a log to help with a bug report, that is a file you choose to attach to an email or an issue — the app never uploads one on its own.

Children

Bento Term is a developer tool and is not directed at children. We do not knowingly collect information from children.

Your choices

Analytics: Settings → Privacy. Off by default; turning it off deletes the random identifier.
Microphone: revoke at any time in the system Settings for the app.
Everything else: deleting the app removes the local data it stored, including Keychain items it created.

Changes

If this policy changes in a way that affects what leaves your device, the date at the top of this page changes with it and the change is described in the app's release notes.

Contact

Questions, or a privacy request: open an issue at github.com/NovaShang/BentoTerm/issues. See the support page for the other ways to reach us.

Bento Term is open source. Every claim on this page is checkable in the source: analytics in Telemetry.swift, credential storage in KeychainService.swift, speech engines in the voice module. Read the code.