The short version
We collect the minimum needed to run the service. We don't profile you or sell your data. Any usage metrics we collect are first-party and self-hosted — never sent to third-party analytics services. Your apps and data are yours.
What we collect
- Account information: email address, username, and display name
- Authentication data: a secure hash of your password (we never store your actual password) and session cookies for login
- Your app data: whatever you put in your apps — music, notes, recipes, audiobooks, and so on
- Server logs: standard access logs that may include IP addresses, request timestamps, and error information, retained for operational and debugging purposes
What we don't collect
- No third-party analytics or tracking services
- No cookies besides your session authentication cookie
- No fingerprinting, tracking pixels, or third-party trackers
- We do not sell your personal information
Where your data lives
All infrastructure is in the US West (San Jose, CA) region.
| Service | What it does | What data it has |
|---|---|---|
| Fly.io | Runs your apps on isolated servers | Your app data lives here |
| Tigris | Cloud storage for shared media | Music, audiobooks, and other media files |
| Neon | Database hosting | Account info and app metadata |
| Resend | Email delivery | Your email address (for account emails and occasional product updates) |
That's it. No other third-party services have access to your data. We may send occasional product updates via email — you can unsubscribe from those anytime. Account-related emails (verification, password reset, security notices) can't be unsubscribed from.
How we protect your data
- All traffic is encrypted over HTTPS
- Passwords are securely hashed — we never store your actual password
- Each app runs on its own isolated server with its own storage volume
- CSRF protection on all forms
- Rate limiting on authentication endpoints
- Storage credentials are encrypted at rest in our database
- We keep hosted apps updated and apply security patches promptly
Your rights
You can:
- Access your data anytime through the dashboard and each app's interface
- Export your data through the file manager on your app's card, or each app's built-in export features
- Correct your account information in Settings
- Delete your account and all associated data by contacting us
- Opt out of product update emails at any time
If you'd like to exercise any of these rights and need help, emailsupport@getterrarium.app.
Data retention
- Active account: your data is kept as long as your account exists
- Uninstalled app: archived for 30 days (restorable), then permanently deleted
- Deleted account: all data removed within 30 days
- Server logs: retained for up to 90 days for operational purposes
Children
While we don't collect age information or knowingly target any age group, Terrarium is not designed for children under 13. Please don't create accounts for children under 13.
Changes
If we make material changes to this policy, we'll email you before they take effect. Previous versions are available on request.
Contact
Questions about your privacy? Email us at support@getterrarium.app.