Cookie Policy
Last updated: October 12, 2026
On this page
This page lists every cookie and similar technology on RemoteAccessApp.com: what each one does, who sets it, how long it lasts, and how to say no. It's part of our Privacy Policy.
Cookies are small files a website keeps in your browser. Some are needed for the site to work at all. Others are optional, and you decide.
The short version
- Our own cookies only do necessary things: keep you signed in, protect forms from forgery, and remember your cookie choices. They're always on.
- Two optional extras set their own cookies: the live chat (tawk.to) and Meta's ad-measurement pixel. They only ever run on the public pages of our website, never on the dashboard, remote sessions, the SSH terminal or checkout.
- In the EU, the EEA, the UK and Switzerland, nothing optional loads until you say yes. The banner has "Accept all" and "Reject all", side by side and equally easy, and "Settings" to choose one by one. Nothing is ticked in advance.
- You can change your mind any time with "Cookie settings" at the bottom of every page.
- No analytics cookies. Our own visit statistics are made on our server without cookies.
Who's asked first
We ask before anything optional loads if you're in the European Union, the European Economic Area, the United Kingdom or Switzerland. We tell from the country our network provider (Cloudflare) reports for your connection. If it doesn't say, we go by your browser's time zone, and anywhere in Europe counts.
Everywhere else, the live chat and the pixel load unless you turn them off in "Cookie settings".
If your browser sends a Global Privacy Control signal, Meta's pixel never loads, wherever you are.
Strictly necessary
Always on: the website can't work without them, so the law doesn't require consent. None of them track you on other websites.
| Name | Set by | What it does | How long | Category |
|---|---|---|---|---|
__Host-rd_session | RemoteAccessApp | Keeps you signed in. Encrypted, and page scripts can't read it | Until you sign out, or up to 30 days | Strictly necessary |
__Host-rd_af | RemoteAccessApp | Protects forms from being sent by other websites (anti-forgery) | Until you close your browser | Strictly necessary |
__Host-rd_remember | RemoteAccessApp | Remembers this browser after you sign in with a code we emailed you, so you aren't asked again (only if you choose "Remember this browser") | 30 days | Strictly necessary |
rd_consent | RemoteAccessApp | Remembers your cookie choices (for example "chat yes, ads no"), so we don't ask on every page and so our server only allows what you agreed to | 180 days, then we ask again | Strictly necessary |
raa_ref | RemoteAccessApp | Only if you opened someone's invite link: remembers its invite code, so the account you create gets the free month of Pro (and so does the friend who invited you). It holds nothing but the code | 30 days, or until you create your account | Strictly necessary |
Optional: live chat
The chat window in the corner of our public pages, run by tawk.to (tawk.to inc.), so you can ask us something. In the EU, the EEA, the UK and Switzerland it loads only after you accept it, in the banner or with the "Chat with us" button.
| Name | Set by | What it does | How long | Category |
|---|---|---|---|---|
twk_uuid_…, TawkConnectionTime, twk_idm_key | tawk.to, on our website | Recognise your browser so a chat keeps going between pages and visits | From the end of your visit up to 6 months | Functional (optional) |
tawkUUID, __tawkuuid | tawk.to, on its own domain | The same, on tawk.to's side | Up to 6 months | Functional (optional) |
When the chat loads, tawk.to receives your IP address and browser details, and the chat window fetches its fonts from Google Fonts, so Google receives your IP address too. If you start a chat, it receives what you type and any name or email you give. tawk.to sets the exact cookie names, which can change; see tawk.to's privacy policy.
Optional: ad measurement
Meta's pixel (Meta Platforms, for Facebook and Instagram ads) tells Meta that you viewed a page, clicked Download or Get Pro, or created an account, so we can see which of our ads bring people here. It never receives what you type in forms, your email or password, or anything from your PCs. In the EU, the EEA, the UK and Switzerland it loads only after you accept it, and never with Global Privacy Control.
| Name | Set by | What it does | How long | Category |
|---|---|---|---|---|
_fbp | Meta, on our website | Recognises your browser across visits, for measuring ads | 90 days | Advertising (optional) |
_fbc | Meta, on our website | Remembers that you arrived from one of our ads on Facebook or Instagram (only then) | 90 days | Advertising (optional) |
fr and other Meta cookies | Meta, on its own domains | If you use Facebook or Instagram, Meta can link the visit to you there | Up to 90 days (Meta decides) | Advertising (optional) |
For people in the EU, the EEA, the UK and Switzerland, we and Meta Platforms Ireland Limited are joint controllers for collecting this data on our website and sending it to Meta; what Meta does with it then is up to Meta, under Meta's privacy policy. You can also manage it in your Facebook or Instagram ad settings.
On the checkout page only: payment security
Only /checkout, when you buy Pro: our payment provider Stripe shows its payment form there, and its cookies help it spot fraud and keep the payment secure. They're needed for the payment you asked for, so they're strictly necessary.
| Name | Set by | What it does | How long | Category |
|---|---|---|---|---|
__stripe_mid | Stripe, on our website | Fraud prevention: recognises the browser making payments | 1 year | Strictly necessary |
__stripe_sid | Stripe, on our website | Fraud prevention for this checkout | 30 minutes | Strictly necessary |
| Stripe and Link cookies | Stripe, on its own domains | Fraud prevention, and Link if you choose to use it | Set by Stripe | Strictly necessary |
See Stripe's cookie policy for details.
Network security: Cloudflare
Our website is delivered through Cloudflare, which protects it from attacks and automated abuse. When it needs to, Cloudflare can set these on any page.
| Name | Set by | What it does | How long | Category |
|---|---|---|---|---|
__cf_bm | Cloudflare | Tells people from bots | 30 minutes | Strictly necessary |
cf_clearance | Cloudflare | Remembers that you passed a Cloudflare security check | Up to a few hours | Strictly necessary |
_cfuvid | Cloudflare | Applies fair limits to requests | Until you close your browser | Strictly necessary |
The "Create your account" form's "I'm not a robot" check is Cloudflare Turnstile. It runs in a frame from Cloudflare (challenges.cloudflare.com), only while that form is open, and anything it keeps in your browser there is Cloudflare's, used only to tell people from bots. It's needed to stop automated sign-ups, so it's strictly necessary.
Things kept in your browser that aren't cookies
The website also keeps a few things in your browser's own storage (local storage, session storage and IndexedDB). They stay in your browser, they aren't sent to anyone, and they're there because you used the feature they belong to:
- Settings you chose: remote desktop picture quality, keyboard and input options, voice typing, the terminal's font and the routes you picked for your SSH servers.
- Your terminal command history: the commands you typed in the browser's SSH terminal (never what you type at a password prompt). You can turn it off in the terminal, and it's cleared when you sign out.
- An invite code, if you opened someone's invite link: the same code as the
raa_refcookie above, for 30 days or until you create your account. - The dashboard page you were on, so coming back lands there, and whether some dashboard sections exist on our server, so the menu doesn't jump.
- "Remembered browsers": if you let a PC remember this browser, a private key the browser can't export, so the PC can recognise it.
- A one-way code of your email address that marks your account as using our newer, safer sign-in, so your password is never sent in the older way again.
- Notifications (Pro): if you turn on "Notify me on this device", a small background script (a service worker) that shows them.
These count as strictly necessary: each is part of something you asked the website to do.
What we don't use
- No analytics cookies or analytics services on our website. We don't use Google Analytics or Cloudflare's Web Analytics. Our own visit statistics are counted on our server from the requests themselves, without cookies (see "Service metrics" in the Privacy Policy).
- No advertising networks apart from Meta's pixel, and no third-party cookies at all on the dashboard, remote sessions, the SSH terminal, or the password reset and email confirmation pages.
Changing your mind
- "Cookie settings" at the bottom of every page opens the banner again: turn each extra on or off, or accept or reject them all. If you turn something off that was already running, the page reloads without it, and the cookies it left on our website are deleted.
- Your browser can block or delete cookies, including third-party ones, and most browsers can send a Global Privacy Control signal. Blocking our strictly necessary cookies stops sign-in from working.
- Meta: you can also control ads in your Facebook or Instagram ad settings.
Contact
Questions about cookies or your privacy: [email protected] (write "Privacy" in the subject). Rust Games Australia Pty Ltd (ABN 64 683 623 065), Australia.