privacy policy

The short version

• Fleet sends usage events and crash reports, and it is on by default. Usage events carry a random identifier that is replaced every day, so it cannot link them to the same Mac from one day to the next. Turn it off under Settings ▸ Privacy, or with DO_NOT_TRACK=1.
• Usage events use a format with no way to carry text, so they cannot send your terminal output, anything you type, session names, directories, file paths or git branches. Crash reports carry macOS's own description of the crash, and nothing Fleet adds from your sessions.
• Your session state, Fleet's configuration files and the agent transcripts it reads stay on your Mac. Usage events do report which settings, from a fixed list, you switch on or off. Agents you run in Fleet can read your sessions through its plugin, and may pass what they read to their providers.
• Fleet checks for updates every few hours. That request carries no identifier and sets no cookie.
• This website sets no cookies, so there is no cookie banner.
• Nothing is sold, used for advertising, or shared beyond the services listed below that run it.

Who is responsible

Fleet Terminal ("Fleet") and fleet-terminal.app are made by Oliver Richman, an individual based in the United Kingdom. There is no company behind it. I am the controller of the personal data described on this page, under the UK GDPR and the Data Protection Act 2018.

Contact: help@fleet-terminal.app

What Fleet reports

Reporting is on by default in every build of Fleet that is distributed, betas included. Fleet starts recording events when it launches but holds them in memory, and sends nothing until the welcome guide has been closed, whether you finished it or skipped it. After that, events go out in batches about once a minute to t.fleet-terminal.app, a server I run on Cloudflare. They are never written to disk. A batch that fails to send is thrown away, not retried. The one exception is a report that an update was rolled back, described below, which is sent at once and tried twice more, after 30 seconds and five minutes, if the network fails.

The app calls these reports anonymous, meaning they are not tied to your name, your account or your Mac. Strictly they are pseudonymous: usage events share a random identifier, and under the UK GDPR that still makes them personal data. This page is written on that basis.

Usage events

A batch carries:

• A random install identifier, a UUID Fleet generates itself. It is not derived from your Mac's hardware, your Apple ID or any account, and it exists only while reporting is on. Fleet replaces it with a new one at the start of each day (midnight UTC) and keeps no record of the old one, so the identifier cannot tie events from different days to the same install. Events recorded before midnight but not yet sent are thrown away rather than sent under the new identifier. Versions of Fleet before 1.1.0 kept one identifier until reporting was switched off.
• Fleet's version, your macOS version (major and minor only, such as 15.6) and your processor architecture.
• A list of events. Each is a name from a fixed list, at most one tag from a fixed list, and a few numbers.

An example batch, in exactly the shape Fleet sends:

{
  "v": 1,
  "install": "5C1D2B7E-8F43-4A0B-9E61-2D7C3F8A1B94",
  "app": "1.0.1",
  "os": "15.6",
  "arch": "arm64",
  "events": [
    { "n": "session_spawned", "t": "fourToSix", "d": { "open": 3 } },
    { "n": "feature_used", "t": "quickSwitcher" },
    { "n": "setting_changed", "t": "restoreOnLaunch", "d": { "on": 0 } }
  ]
}

Counts and durations are sent as coarse bands rather than exact values. Sessions fall into none, 1, 2–3, 4–6, 7–12 or 13 and up; durations into under a minute, under ten minutes, under an hour, under a day, or longer. A band is sent as its position in that list, so "open": 3 above means four to six sessions.

These are all the events Fleet can send:

Settings that hold something you typed, such as your default shell, your default directory and your launch profiles, are not on the list of settings Fleet can report. Even for the settings that are, the event says only whether the setting ended up on or off.

What it cannot send

In Fleet's code, a value in a report can be one of four things: a count, an on-or-off flag, a size band or a time band. There is no type for text. Apart from the version numbers and identifier above, the only words in a batch are event and tag names taken from fixed lists in the code. Reporting something new that is textual means writing out every value it could take in that list first, which is not a change that can slip in unnoticed.

The server checks each batch again when it arrives. Every event's data values must be numbers; the identifier must be 36 characters of hex digits and hyphens; the version, macOS version and architecture must match their expected formats; and event names, tags and field names must be short words of letters, digits and underscores. A batch that breaks any of those rules is rejected whole and nothing from it is stored, and anything else in a batch is ignored rather than stored. The server does not compare event names or tags against Fleet's lists, so that part of the guarantee rests on the app's code.

That means a usage event has no way to carry:

• terminal output or scrollback
• commands, or anything else you type
• session names, group names or window titles
• working directories or file paths
• git branch names
• agent prompts, conversations or the activity lines shown in the sidebar
• your macOS username or your Mac's name

Crash reports

When Fleet crashes, macOS records a diagnostic report and hands it to Fleet through Apple's MetricKit, usually within a day. If reporting is on, Fleet forwards it. A crash report is the one place free text is allowed. The text in it is macOS's description of the crash, which Fleet forwards without reading or filtering it, and Fleet adds nothing of its own: no terminal output, titles, directories, branches or activity lines. It contains:

• Fleet's version, the macOS version and build, the processor architecture and the Mac model identifier
• the time window macOS reported the crash in
• the exception type, exception code, signal and termination reason, as written by macOS
• for an Objective-C exception, its name, its class and its message template, such as "index %ld beyond bounds", but not the values that were filled into it
• macOS's description of the memory region involved, which the server discards
• the call stack: the names of the program files involved and positions within them. The server keeps the top twelve entries.

A crash report does not include the install identifier. Your usage events do record that a crash happened, with its signal number (the crash_reported event above), but the report itself carries no identifier. Each report is stored, and a summary of it (version, macOS version, architecture, Mac model, country, termination reason, exception and call stack) is filed as an issue in Fleet's private GitHub repository.

Rolled-back updates

Fleet can install an update without quitting, by handing your sessions to the new version. If the new version fails, the old one takes them back and, if reporting is on, sends an update_rolled_back event straight away, in the same format and under the same identifier as other usage events. Beyond being stored with them:

• It is recorded in a database used to pause a release that keeps failing, under a one-way hash of the install identifier combined with the version, never the identifier itself. It is deleted 90 days after that version was released.
• It adds a line to an issue in Fleet's private GitHub repository: the versions, macOS version, architecture, country, and the bands and flags above.
• It updates a message in a private Discord channel that shows counts only: how many installs rolled back, grouped by version, band and macOS version.

After a rollback, Fleet also offers a Report… button. It opens a prefilled issue form on Fleet's public GitHub repository with the two versions, the reason, how long the new version ran, and your macOS version and processor type. Nothing is sent unless you submit that form yourself, and a submitted issue is public and covered by GitHub's privacy statement.

Country, and IP addresses

Usage events and crash reports are stored with the country they were sent from. Cloudflare works that out from your IP address at its network edge and passes the server a two-letter country code. I do not keep your IP address anywhere: not the telemetry server, not this site's download link, not the nightly job that turns all of these sources into the numbers I look at, and not in request logs, which are switched off for the telemetry server and this site. Cloudflare still sees your IP address in order to deliver each request, as any host does, and handles it under its own privacy policy.

Turning it off

• Settings ▸ Privacy ▸ Share anonymous usage & crash reports, or the same switch on the What Fleet reports page of the welcome guide. Switching it off stops recording at once, throws away any events not yet sent, and deletes the install identifier from your Mac. A batch already on its way is not recalled. Switching it back on creates a new identifier that is not derived from the old one, and nothing recorded before you switched off is sent under it.
• DO_NOT_TRACK=1 or FLEET_NO_TELEMETRY=1 in Fleet's environment turns reporting off for that launch without touching the setting, and no identifier is created while it is set. An app started from the Dock does not read your shell profile, so set it with launchctl setenv DO_NOT_TRACK 1 and relaunch Fleet (it lasts until you restart your Mac), or start Fleet with open --env.
• Or, with Fleet closed, set "telemetryEnabled": false in ~/.config/fleet-terminal/config.json, or ~/.config/fleet-terminal-prerelease/config.json for a beta. Add "telemetryDefaultApplied": true to the same file if it is not already there: without it, the next launch switches reporting back on. The environment variable above works either way.

The same switch covers crash reports. See Configuration for the rest of the settings.

Update checks

Fleet checks for a new version about twenty seconds after it launches, then every six hours while it is running, and whenever you choose Check for Updates. The check fetches https://dl.fleet-terminal.app/appcast.json: a plain request with no identifier, no cookie and no account. It carries only the headers macOS adds to any request: your preferred languages, and a user agent like Fleet/39 CFNetwork/3860.500.112 Darwin/25.4.0, which names Fleet's build number and the versions of macOS's networking library and kernel, from which your macOS version can be worked out.

When a newer version is available, Fleet also fetches rollout.json from the same host in the same way, carrying nothing. A new version reaches installs in stages, and to decide when it reaches yours, Fleet picks a random number between 0 and 9999 once and keeps it in config.json. That number is only ever compared with the file on your Mac; it is never sent anywhere.

If an update is available and automatic installs are on, Fleet downloads it from the same host. Update checks are separate from reporting, so DO_NOT_TRACK does not stop them: they are how bug and security fixes reach you. To stop them, turn off Settings ▸ Updates ▸ Check for updates automatically.

Cloudflare's analytics for the download host record the country, path, response and user agent of each request. Each night I copy daily counts out of them, by Fleet build, macOS version and country, to estimate how many copies of Fleet are running. The response deliberately sets no cookie. One would make that count exact, but it would also be a tracking identifier set without asking, so the count is a lower bound instead.

What stays on your Mac

• Settings and sessions. Fleet keeps its settings in ~/.config/fleet-terminal/config.json and your open sessions in state.json beside it: each session's working directory, name, colour, group and the agent conversation to resume. A beta keeps its own copies in ~/.config/fleet-terminal-prerelease. Both files can only be read by your macOS user. Scrollback is not saved to disk.
• Agent transcripts. To show what each session is doing, Fleet reads the transcripts that Claude Code, Codex and Antigravity already write to your Mac, and installs its plugin into those tools' own configuration folders when you set it up. All of that reading happens on your Mac. The activity lines in the sidebar come from reading those files, not from sending them to a model.
• Session status. Fleet's agent plugins record each session's state, working directory, name, git branch and transcript location in ~/.fleet/session-status, which only your macOS user can open. That is how the sidebar knows what each session is doing.
• Agent control. The plugin lets an agent drive Fleet through control.sock, a file in the same folder that only your macOS user can open. Fleet does not listen on a network port. Through that file an agent can read your sessions: their names, directories, branches, activity lines and recent terminal output. Whatever an agent reads can end up in what it sends to its provider, so this is one way session content can leave your Mac, through the agent rather than through Fleet.
• Updates without quitting. When Fleet hands your running sessions to a new version, their terminals and what is on screen pass between the two copies of Fleet through a local socket on your Mac. Nothing in that handover goes over the network, and it is not written to disk. Fleet also keeps a short list of versions it has rolled back, so they are not offered again.
• The agents themselves. The tools you run in Fleet talk to their own providers, under your own account and their providers' privacy policies. Fleet does not sit between them and the network, and it cannot see or change what they send.

I have no access to any of this. To remove what Fleet stores, quit Fleet and any agent sessions that still have its plugin loaded, so their hooks cannot write again, delete the app, and then delete:

• ~/.config/fleet-terminal, and ~/.config/fleet-terminal-prerelease if you ran a beta
• ~/.fleet, which holds the session status files and Fleet's plugin for Codex
• ~/Library/Application Support/com.fleet.terminal, where updates are staged (com.fleet.terminal.prerelease for a beta)
• its plugin for each agent: skills/fleet in each Claude Code configuration folder such as ~/.claude; the fleet plugin and its hook entries in Codex's own configuration, in $CODEX_HOME or ~/.codex; and ~/.gemini/config/plugins/fleet for Antigravity
• the settings.json.*.bak copies Fleet makes in a Claude Code configuration folder before it edits that folder's settings.json
• if you used Fleet before 0.7.0, session-status in ~/.claude

This website

fleet-terminal.app is hosted on Cloudflare. Its fonts, images and scripts are served from this domain. The one exception is Cloudflare Web Analytics, which Cloudflare adds to each page. Cloudflare says it "does not use any client-side state, such as cookies or localStorage, to collect usage metrics", and that it does not fingerprint visitors to produce its analytics. It records the page, the referring site, country, browser, operating system, device type and how fast the page loaded. Each night I copy daily totals out of it: views and visits by page, country, operating system and device type, and views by referring site. Content blockers usually block it, which is fine.

No cookies. This site sets none. The only thing it stores in your browser is a single sessionStorage entry, fleet:hero-typed, which stops the homepage headline typing itself out again every time you return to that page in the same tab. Your browser deletes it when the tab closes, and it is never sent anywhere. Nothing here needs a cookie banner, so there isn't one.

The download link. Following /download records the version downloaded, the site that linked you (reduced to its domain name, or to the page if it was a page on this site), any utm_source, utm_medium or utm_campaign in the link, your country, and your operating system reduced to one of six values. Not your IP address and not your full user agent. It then sends you on to the file without passing on where you came from.

Discord. /discord forwards you to Fleet's Discord invite without telling Discord which page sent you. Once you are there, Discord's privacy policy applies.

The merch shop. merch.fleet-terminal.app is run by Fourthwall, which handles orders, payments and delivery. This policy does not cover it: Fourthwall's own privacy policy and terms do, and they are linked from the shop.

If you email me

Mail to help@fleet-terminal.app is received by Cloudflare and delivered to a mailbox hosted by Google. I use what you send only to reply to you and to fix or consider what you wrote about. I keep it for 12 months after our conversation ends, then delete it.

Who handles it

These services store or handle the data described above for me.

All four are US companies, so data they handle may be stored or accessed outside the UK. Each has certified to the US Department of Commerce that it follows the EU–US Data Privacy Framework and its UK Extension, which is what allows UK personal data to be sent to it under the UK–US data bridge. You can check each one on the Data Privacy Framework list.

How long it is kept

• Usage events, including the install identifier: three months, after which Cloudflare deletes them. Daily totals are kept indefinitely: for each event, tag and Fleet version, how many events there were and how many distinct installs sent them, and for the whole day, how many events, installs and sessions started.
• Crash reports: three months in the same way. I delete the GitHub issues 12 months after closing them. Daily counts by Fleet version and macOS's termination reason are kept indefinitely.
• Rolled-back updates: the hashed record is deleted 90 days after the version was released. The event itself is kept three months like any other, and I delete the GitHub issues 12 months after closing them.
• Download clicks: three months. Daily counts are kept indefinitely, by version, referring site (a domain name, or a page on this site), campaign tags, country and operating system.
• Download host analytics, including update checks: available at Cloudflare for about a week. Daily counts are kept indefinitely: downloads by version, country and kind of client (a browser, Fleet updating itself, my own tooling, or a bot), and update checks by Fleet build, macOS version and country.
• Web Analytics: six months at Cloudflare. Daily counts are kept indefinitely: views and visits by page, country, operating system and device type, and views by referring site's domain name.
• Email: 12 months after our conversation ends.

The daily counts contain no identifier. I keep them so I can see how Fleet is doing over time, which the three-month and one-week windows above would otherwise erase.

Legal basis

Everything on this page is processed on the basis of legitimate interests. For usage events, crash reports and analytics, that interest is finding out which features are used, which versions crash and whether anyone downloads Fleet, so I can fix and improve it. For update checks it is getting fixes to you, and for email it is answering you. I have kept each to what is described above: an identifier that is not tied to you and lasts a single day, nothing from your terminal, and coarse numbers. You can object to reporting at any time by switching it off, and to anything else by emailing me.

Your rights

Under the UK GDPR you can ask to see the personal data I hold about you, and to have it corrected, deleted or restricted. You can object to how it is used, and ask for a copy of it. Email help@fleet-terminal.app and I will answer within a month.

Usage events are filed under a random identifier that I cannot connect to you and that changes every day. Earlier identifiers are not kept anywhere, including on your Mac, so events filed under them cannot be picked out. For today's, send me the full identifier, which is telemetryInstallID in ~/.config/fleet-terminal/config.json (or the fleet-terminal-prerelease folder for a beta); Settings shows only its first eight characters. I will exclude it from all further use. The events themselves cannot be deleted one by one from where they are stored, so they are deleted when they reach three months old. Switching reporting off stops any more.

If you are unhappy with how I have handled your data, you can complain to the Information Commissioner's Office. I would rather hear about it first.

Children

Fleet and this site are not aimed at children, and I do not knowingly collect personal data about anyone under 13.

Changes to this policy

When what Fleet or this site collects changes, this page changes with it, and the date at the top says when. The changelog records what changed in each version of Fleet.

Questions about any of this: help@fleet-terminal.app. See also the terms of use.