Privacy Policy
This policy describes what [LEGAL ENTITY] ("DeskLink", "we") processes when you use the services we operate (hosted accounts, device linking, billing, release downloads). If you run DeskLink fully self-hosted, we operate no service for you and process no personal data about your sessions — the data stays in infrastructure you control.
1. The short version
- DeskLink is a remote-desktop tool. What you see and share through a session is yours and is end-to-end encrypted — in a normal deployment we cannot read your screen, camera, chat, files, or clipboard.
- We do process account and operational data (your email, device names/IDs, session start/end records, billing status) to run the account and billing service.
- We do not sell personal data, do not run ads, and do not use third-party trackers on the website or in the app.
2. What we process, and why
| Data | Where | Why |
|---|---|---|
| Email, name, password (stored as a one-way scrypt hash) | accounts database | sign-in |
| Device ID, device name, platform | accounts + session records | your device list, session attribution |
| Session records: device pair, mode, start/end time, duration | audit log | billing usage (plan minutes), security audit |
| Billing: plan, Stripe customer/subscription IDs, payment status | accounts database | plan limits, renewals |
| IP address, timestamp | server logs / rate limiting | abuse prevention |
| Crash reports (only if you opt in; off by default) | Sentry | bug fixing |
We do not process: session content (screens, audio, video, chat, files, whiteboard, clipboard), your assist PINs in usable form on our servers (stored only as one-way hashes), or your AI-provider API keys (those never leave your device — the AI feature talks directly to the provider you configure).
3. End-to-end encryption — what it means and its limits
Every session performs an ephemeral ECDH (P-256) key exchange between the two devices; all data-channel payloads are AES-256-GCM encrypted. A faithfully-operated signaling server only sees metadata: who connected to whom, when, in which mode, and relayed handshake material it cannot decrypt.
Honest limits:
- The WebRTC media (screen/camera) travels protected by DTLS-SRTP, but the media keys are not authenticated end-to-end — an operator of a malicious signaling server could in principle intercept or inject media. Run your own signaling server if your threat model includes a hostile relay.
- Unattended-access PINs are sent to the signaling server during connect (hashed at rest). The session itself is still authenticated end-to-end, but treat your signaling server as semi-trusted for PIN sessions.
- The 6-digit session code and "trust this device" are human checks against a man-in-the-middle at first contact; like SSH host keys, they rely on you comparing/verifying at least once.
4. Cookies and local storage
The website and the app use browser/local storage only (no cross-site cookies): the app stores your settings, device identity key, and trust list on your device so the app works; the website may remember status-page probe URLs in your browser. There are no advertising or analytics trackers.
5. How long we keep data
- Account and device data: while your account exists.
- Session audit records: while your account exists. There is currently no automatic expiry; they are deleted (in anonymized form) when your account is deleted, and we can truncate them on request.
- Server logs: for as long as they remain in your/host's log storage (container log rotation is an operator setting).
- On account deletion: account, device, subscription, and usage data are deleted (cascading); session-audit rows are kept in anonymized form (email shown as "—") because an audit log should outlive the account.
6. Who else sees your data
- Stripe processes card payments for us; we do not store card numbers.
- Sentry receives crash reports only if you opt in.
- No other third parties, no data brokers, no advertising networks.
- We will disclose data to authorities only where required by law, and we will notify you where legally permitted.
7. Your rights
Depending on your jurisdiction (e.g. GDPR/CCPA), you may have rights to access, correct, export, or delete your personal data, and to object to or restrict processing. To exercise any right, or to ask any privacy question, contact [SUPPORT EMAIL]. We aim to respond within 30 days. To delete your account: in-app (Settings → Account) or by request.
8. Children
DeskLink is not directed to children under 16; we do not knowingly process their data. If you believe a child has created an account, contact us and we will delete it.
9. Changes
We may update this policy; material changes will be announced on the website or in-app before they take effect. The effective date above reflects the latest revision.