Privacy

Effective 27 September 2026 (what the relay keeps, and reporting, corrected) · applies to the Tern beta on iPhone, Android, Mac and Windows

Tern is built so that there is as little as possible to have a privacy policy about. This page says exactly what exists, where, and what we can and cannot see.

What we never collect

• No account. There is no sign-up, no phone number, no email. Your identity is a cryptographic key generated on your device.
• No message content, unless you send it to us. Messages, photos, videos, voice notes, calls, statuses, polls and call history are end-to-end encrypted (MLS / DTLS-SRTP). Our server relays sealed bytes and holds no keys to decrypt them. Tern receives a message only when you choose to send it: in a report to Tern, or in a task you approve in Tern Orbit.
• No contact upload. Inviting from your contacts happens on your phone; your address book never leaves it.
• No analytics or tracking. The apps and this website contain no third-party SDKs, trackers, ad IDs, or crash reporters, and fetch nothing from third-party hosts.
• The AI stays home. Summaries, reply suggestions, search and transcription run on your device. Your words are never sent to an AI service unless you approve a task in Tern Orbit, the separate agent app, which then sends only what you approved.

What our relay necessarily sees

Any messaging service needs a server to pass sealed envelopes between devices. Ours sees, and only while operating:

• Connection metadata — your IP address and when your device connects, like any server you reach on the internet. Today our relay keeps connection records (IP address, times, and room and device identifiers that include your display name); we are cutting this to counts kept for 7 days.
• Encrypted traffic shape — sizes and timing of sealed envelopes, and one deliberate visible bit that marks "this envelope is a call ring" so locked phones can be woken. Never the content. Today each envelope also carries a device identifier that includes your display name, and call requests carry display names; we are removing both.
• Call media relay — group and video calls pass through a media server (an SFU) that forwards each participant's frames to the others. Every frame is encrypted on your phone before it is sent, under a key that exists only on the phones in the room, so the server sees encrypted frames, who is in which call, and when — never the sound or picture. It keeps no recordings; there is no code path that could.
• Push tokens — the Apple/device token needed to wake your phone, kept until your device unregisters. iPhone push notifications themselves are content-free ("You have new messages"); Android previews are generated on your own phone.

Where your data lives

On your devices. Your history syncs between the phones and computers in your rooms, encrypted, and can be removed by deleting the app. We hold no copy of it; what our servers do keep is listed on this page. If you install the on-device AI model, it downloads once from our file server (a model file, nothing about you goes up).

Beta distribution

iPhone builds are delivered through Apple TestFlight, which shares install and crash statistics with us under Apple's privacy terms. Android builds are downloaded directly from this site with no store in between.

Reporting and safety

Private, not unmoderated. Tern's relay forwards sealed messages and holds no message keys. Anyone in a room can report a message: the report carries that message to the room's moderators, and to Tern if you choose to send it there. Moderators remove reported messages with a written reason the author can appeal. Restricting abusive identities across the service is being built.

You can report a message or block a person from within the app. A report goes to the room's moderators, and the person you report can see that you reported them. You can also send a report to Tern by email; Tern then receives what you include.

Children

Tern is not directed at children under 13, and the beta is invite-based.

Changes and contact

If this page changes, the date above changes with it. Questions, or anything you'd like deleted that we actually hold (a push token, an email you sent us): smaan@hellotern.com.