Termia stores configured SSH passwords in:

~/.config/termia/connections.json

The connection file can be kept as plain text, obfuscated, or encrypted from Security preferences. Obfuscation only reduces accidental readability of the file; encrypted storage uses a master password and asks for it each time Termia starts. If the master password is lost, Termia cannot recover the encrypted connection data. The file is written with permissions 0600, but you should still not publish, commit, or share it. Prefer SSH keys where possible.

Exported configuration files can also contain passwords. Treat them as sensitive files, even when the local connection file uses obfuscated storage.

The configured password shortcut, Ctrl+P by default, sends the saved SSH password directly to the active remote terminal process, with an optional trailing Enter. It does not use the clipboard. Enable it only on trusted desktops and use it only when the terminal is waiting for a password.

Termia stores aggregate connection, Enter-key command, keystroke, and session-duration counters in ~/.local/state/termia/statistics.json. It does not store typed text, command contents, or clipboard contents, and it does not transmit these counters. Statistics are flushed at most every 30 seconds while typing, when sessions end, and when Termia closes.

Do not include credentials, private keys, exported configurations, or server addresses in public issue reports. Contact the repository maintainer privately for vulnerabilities that could expose user data.