Questions and answers

Everything in your workspaces syncs: connections, tags, snippets, known hosts and credentials, including the passwords, private keys and passphrases you've saved in TerminalLynx. Secrets are encrypted with your workspace key (ChaCha20-Poly1305) before they're stored or synced, so only your own devices can read them. There's no cloud copy.

Pairing hands your identity to the new device, once. The new device connects straight to the device showing the 12-character pairing code, over an encrypted QUIC connection, and each proves it knows the code. The device showing the code then sends your identity's private key and workspace keys, encrypted with a key derived from the code and that connection. The new device keeps the identity key in its OS keychain, or sealed with your master password if you've set one. The pairing guide walks through it.

What stays on each device:

• Its peer-networking key. Each device derives its own, and it never leaves the device.
• Its app settings and the list of peers it has found.
• Its snippet run history, output included, and each connection's choice of sudo password.
• SSH keys TerminalLynx doesn't hold: files in ~/.ssh, keys in your SSH agent, and hardware keys. TerminalLynx uses them where they are and doesn't copy them.

One exception: when you import from ~/.ssh/config or MobaXterm, Import referenced private keys into the encrypted vault is on by default. Keys imported that way become TerminalLynx credentials and sync like any other.

Not remotely, today. Your paired devices share one identity, and with no server in between there's nothing that could shut one out or wipe it from afar.

Forget (under Manage → License & plan) only takes a device off your device list to free its slot. It doesn't sign the device out or stop it syncing: if the lost device can still reach one of your others, it can keep receiving changes. Relays are off unless you turn one on, so it can only reach them on the same network or over a VPN.

What protects the data on a lost device is how its key is kept:

• In the OS keychain (the default), behind your account sign-in on that computer.
• Sealed with a master password (Argon2id and ChaCha20-Poly1305). Someone holding the disk can't open your saved credentials without it. Set one if a device might be lost, or if it has no keychain: a portable copy, for example.

Full-disk encryption on the device helps either way.

If a device is lost, change the passwords and keys for the servers whose credentials you saved in TerminalLynx.

In a team, an admin can remove a member. That rotates the team's workspace key, so the removed person's devices can't read anything changed afterwards. Removal is per person, not per device, and what they've already seen stays seen: TerminalLynx lists the credentials to change. See Set up a team.

Both devices keep working. Every change is saved as a signed operation, and when the devices reconnect they exchange what they missed and merge the changes field by field:

• Different fields (say, the port on your laptop and the tags on your desktop): both changes survive.
• The same field (say, the hostname on both): the later change wins, on both devices. "Later" is decided by a hybrid logical clock, with a tie-break, so every device picks the same winner whatever order changes arrive in. The other value is replaced.

You won't see a conflict prompt or a duplicate connection: every device ends up with the same result on its own.