Acceptable Use Policy

Effective date: [EFFECTIVE DATE] · Applies to everyone using DeskLink, hosted or self-hosted. Incorporated into the Terms of Service.

1. The golden rule: consent

Remote-control software is a tool of trust. You may use DeskLink to control a computer only if you are authorized to do so:

• the person in front of the device consents (they accept the session request), or
• you hold a valid unattended-access PIN for a device you own, manage, or are contracted to support and the device's users have been told unattended access may occur, or
• you are acting under a written agreement (employer, MSP contract, IT department) that covers the devices you administer.

Never use DeskLink to access, control, record, or monitor a device you do not have a right to access — including devices you previously administered, devices of ex-employees or ex-partners, or devices whose users have not agreed to be remotely assisted.

2. Prohibited uses

You may not use DeskLink (or any DeskLink service) to:

1. Commit any crime or violation of law, or aid or abet another in doing so — including computer-misuse, unauthorized surveillance, stalking, harassment, or fraud.
2. Record, screenshot, or capture the content of a session without the knowledge and consent of the other party, or in violation of applicable recording/wiretap or workplace-monitoring laws. (Session recording is a built-in feature; use it where it is lawful and disclosed.)
3. Circumvent security controls, license restrictions, or plan limits (e.g. sharing one paid account to evade per-seat or per-minute limits where the plan states they are individual).
4. Attack DeskLink infrastructure or other DeskLink users — including the signaling servers, the API, the update endpoint, or other customers' devices. Security testing is only permitted under a separate written agreement.
5. Distribute malware, or use sessions to install software or change settings on a device you are not authorized to modify.
6. Use unattended-access PINs on shared or public devices, or reuse a PIN across many devices.
7. Process other people's personal data in a way that violates the Privacy Policy or applicable data-protection law.

3. Your responsibilities as an operator

If you run DeskLink infrastructure (self-hosted signaling/API), you are its operator and operator-responsible:

• Protect the infrastructure. Unauthenticated, TLS-less signaling on a public network is unsafe by design; follow the hardening checklist in the project's docs/SECURITY.md (accounts or tokens, TLS, TLS-terminated updater endpoint, strong JWT_SECRET / INTERNAL_API_SECRET / ADMIN_TOKEN).
• Protect PINs. Assist PINs are a secret: choose them long and unique per device, rotate them when staff leave, and remember the signaling server sees them in transit on connect (hashed at rest).
• Apply updates. Security fixes ship through the signed update channel; keep clients and server components current.
• Monitor and act. If you operate a shared service, review the session audit log and suspend abusive accounts under the Terms.

4. Enforcement

We (and, for self-hosted operators, you) may suspend or terminate access for violations, review session metadata (not content) to investigate, and report illegal activity to authorities where required. Repeated or severe violations may result in a permanent ban and, where applicable, legal action.

Questions or a gray area? Ask first: [SUPPORT EMAIL].