Privacy Policy
Last updated: October 18, 2026
On this page
- The short version
- What we collect and why
- Cookies
- Sessions and the relay
- The people at the PCs you access
- AI assistants (Claude Code)
- How we use your data
- Who we share it with
- International transfers
- Security
- Your choices and rights
- Your rights under the GDPR (EU, EEA, UK and Switzerland)
- Data on your own PCs
- Children
- Changes to this policy
- Contact
RemoteAccessApp is made by Rust Games Australia Pty Ltd (ABN 64 683 623 065, "we," "us," "our"), an Australian company. We built it to collect as little about you as we can. We don't sell personal data, we don't show ads, and we don't track you around the web. This policy explains what we keep, why, who can see it, and for how long. It applies to the RemoteAccessApp apps, the RemoteAccessApp.com website and our servers (together, "the Service").
If you're in the EU, the EEA, the UK or Switzerland, the section Your rights under the GDPR has the extra details your law requires: who's responsible, the legal basis for each use, international transfers, how long we keep things and how to use your rights. The plain-English version is Your data rights, and every cookie is listed in our Cookie Policy.
The short version
- The only personal detail we need is your email address. Your name is optional.
- We record IP addresses, when you create an account, sign in and connect PCs, and we determine an approximate location from them (country, region and city). We use this to manage accounts, keep them secure and prevent fraud.
- We can't see your sessions in the app. Screens, keyboard and mouse input, chat, clipboard, sound, commands and files are end-to-end encrypted between your Console and your PCs. Our relay only forwards encrypted data it can't read, and never stores it.
- Browser sessions work differently: when you use RemoteAccessApp in a web browser, our website acts as your Console, so it passes your session on in memory. It doesn't record or store it.
- Passwords to your servers aren't readable by us. They stay on your PC, or, if you turn on password sync, they're end-to-end encrypted before they reach us.
- We keep security logs and session records for 90 days and then delete them automatically. A session record is a short summary of each session through our relay (who connected to which PC, when, for how long, how much data passed and the networks at each end, never full IP addresses), never what happened in it.
- Optional extras are your choice. Product news by email and product analytics are off unless you turn them on. On our website, the live chat and Meta's ad-measurement pixel are optional; in the EU, the EEA, the UK and Switzerland they don't load until you accept them ("Cookie settings" at the bottom of every page).
- Your data, your call. You can get a copy of your data, correct it or delete your account. Accounts in the EU, EEA, UK and Switzerland can do it themselves in the dashboard under "Privacy & your data"; anyone can email us.
What we collect and why
| What | Why we need it | How long we keep it |
|---|---|---|
| Email address | Your sign-in name, and how we contact you about your account | Until you delete your account |
| Password | To sign you in. We only store a one-way hash (PBKDF2); we never know your password | Until you delete your account |
| Email confirmation and security emails | To confirm the email address is yours, send password reset links and warn you about security changes (see "Emails we send you" below): whether your address is confirmed and when, one-time link codes (stored only as one-way hashes; a confirmation link works for 24 hours and a reset link for 30 minutes, each once), your "new sign-in" email setting, and one-way codes of the kinds of app and networks you've signed in from (made from the app or browser type and the first part of the IP address), so we can tell when a sign-in is new | Link codes: until used or expired, then deleted within days. The rest: until you delete your account |
| Sign-in codes and remembered devices | If your account doesn't use two-step verification, signing in on a new device or browser needs a 6-digit code we email you. We keep the code only as a one-way hash, for 10 minutes and at most 5 tries, with the time and network it was asked from. After you enter it, that device or browser is remembered for 30 days: we keep a one-way hash of a random token the app or browser holds (in the website's case a secure cookie), with the app's name | Codes: until used or expired, then deleted within a day. Remembered devices: 30 days, or until you reset your password or your account is disabled |
| Two-factor authentication (optional) | To protect sign-in with a code from your authenticator app: whether you use two-factor authentication, your encrypted authenticator secret and hashed backup codes (we can't read the codes; each works once) | Until you turn it off or delete your account |
| Google or GitHub sign-in (optional) | If you choose "Continue with Google" or "Continue with GitHub", that service tells us your name, your email address (and whether it has confirmed it) and your account ID there. We use them to find or create your RemoteAccessApp account and sign you in: a new account gets that email address and name, and no password until you set one. We get no access to anything else in your Google or GitHub account (no email, files, contacts or code), we never see your password there, and we don't keep the access it gives us after signing you in | The account ID and email address it gave us, and when you linked it and last used it: until you delete your account |
| Invites (optional) | Your personal invite code and link ("Invite friends" in the dashboard). If someone signs up with your link, we record that you invited them, whether and when they added their first PC and confirmed their email, and the months of Pro each of you earned; you see them in your invite list with their email address shortened (like "a•••@gmail.com"), and they see yours the same way. To make sure each person, email address and PC earns a reward only once, we keep one-way keyed codes (never the values) of rewarded PCs' hardware identifiers and email addresses, and we compare the address someone signed up from with the addresses the inviter used recently | Invites: until either account is deleted (an inviter's account being deleted removes the link to it). The one-way codes: kept after deletion, because they can't be turned back into anything about you |
| First and last name (optional) | So we know what to call you when you contact support | Until you remove it or delete your account |
| IP addresses | Recorded when you create your account, sign in, and when your PCs and Consoles connect, to run the Service, secure accounts and prevent fraud and abuse | Sign-up IP: until you delete your account. Sign-in sessions: until the session ends or expires (30 days after last use). PCs and Console activations: the most recent IP only, until removed. Security log: 90 days. Session records keep only the network (see below), 90 days |
| Approximate location | Country, region and city determined from those IP addresses with an IP-location (GeoIP) database. Shown to us in our admin dashboard for account management, security and fraud prevention. It isn't precise and never comes from GPS or your device | No longer than the IP address it comes from |
| Sign-in sessions | To keep you signed in: when the session started and was last used, its IP address, and the name of the app (and computer) it's from | Until you sign out or it expires (30 days after last use) |
| Account-sharing checks | So each paid plan is used by the people it covers: for each Console or website sign-in we keep the time, the kind of app, the IP address and its country, and we compare where your account is used at the same time (Consoles in use and remote sessions open from different countries or networks, sign-ins from places too far apart for the time between them, an unusual number of Console PCs). Unusual patterns are listed for us to look at, with the times and places involved (never your PCs' names). Nothing happens to your account automatically. If we turn on a limit on how many PCs can be signed in to the Console at once, the PC you used least recently is signed out with a message saying why, and you can sign in there again | Sign-in places: 30 days. What the checks found: 90 days |
| License key | To link a paid license to your account. Stored as a one-way hash, plus an encrypted copy so a new Console can activate when you sign in | For the life of the license |
| Console activations | To tie Pro to the PCs where you sign in to the Console, and to let you or support sign a PC out: a one-way hash of the PC's hardware identifiers, the app version, when it was activated and last checked, and the last IP address it checked in from | For the life of the license |
| Your PCs | So your Consoles can show and reach them: a random device ID, the PC's Windows computer name and signed-in Windows user name, when it was added and last seen, its last IP address, and whether it's online | Until you remove the PC or delete your account |
| Your PCs' network cards | So you can wake an offline PC up from another of your PCs on the same network (Wake-on-LAN): the hardware (MAC) addresses of the PC's physical network cards (Ethernet and Wi-Fi only) and the local networks they're on, as RemoteAccessApp on that PC reports them. Stored encrypted, shown only to your account, and sent only to your own PC that sends the wake-up signal | Until you remove the PC or delete your account |
| Hardware identifiers, for abuse prevention | When you sign up, sign in, activate the Console or set up a PC, the apps send a one-way hash of the PC's machine ID and its network cards' hardware addresses. We keep only scrambled (keyed one-way hash) versions of them with your account, so that if we ever have to ban an account for abuse, the ban can cover the PCs it used. We can't turn them back into the addresses. We never ban whole IP addresses | Hashes: up to a year after we last see them, or until you delete your account. If your account is banned: until the ban is lifted |
| Trusted networks | IP address ranges and labels you add, to limit where your account and PCs can be reached from | Until you remove them or delete your account |
| Synced settings | So your Consoles match: the names you give your PCs, and your saved hosts (names, addresses, ports, user names and display options, never passwords or keys). Encrypted on our server | Until you delete them or your account |
| Synced passwords and SSH keys (Pro, optional) | So saved passwords, and the SSH keys you add on our website or share from the app, follow you. End-to-end encrypted in your browser or on your PC with a key from your account password (with a key's passphrase too, if you choose "Remember passphrase"); we store only data we can't read | Until you delete them from your account (you can when you turn sync off), turn on "Never save passwords," or delete your account |
| Account preferences | Your "Never save passwords" setting (off unless you turn it on, in Security on the website or Settings → Account in the app). While it's on we don't store any synced passwords: turning it on deletes your synced passwords from our server immediately, and RemoteAccessApp on your PCs deletes the passwords it remembered the next time each PC signs in. Turning it off again doesn't bring anything back | Until you delete your account |
| PC health for monitoring alerts (Pro, optional) | So we can alert you about your PCs: while monitoring alerts are on, each PC of a Pro account sends our server, about once a minute, its processor (CPU) and memory use, the free and total space of each fixed drive (by drive letter only, never its label or what's on it), how long it has been running and when it last started, whether Windows is waiting for a restart, and whether a RemoteAccessApp update failed (with the version numbers). Nothing else: no file names, programs, windows or anything from your sessions | Only the latest report per PC, in memory: it's never written to disk and is gone within minutes when the PC stops reporting or our server restarts |
| Alert settings and history (Pro) | Your alert rules (for example "a PC is offline for 10 minutes" or "a drive is under 10% free"), per-PC changes, which notifications you want, your quiet hours and the time zone they use, and the alerts that fired (the PC's name, what happened, when, and whether you've read it) | Alert history: 90 days. Settings: until you delete your account |
| Push notification subscriptions (Pro, optional) | When you turn on "Notify me on this device", your browser gives us an address at its push service (Google, Mozilla, Apple or Microsoft) and keys to encrypt notifications for it. We store them encrypted, with a label like "Chrome on Android" and when they were added and last used | Until you turn notifications off on that device, remove it from the list, the push service says it has ended, or you delete your account |
| PC management (Pro, optional) | So you can manage several PCs at once: the tags you give your PCs; your scheduled tasks (name, the action - for a script, its text, stored encrypted -, which PCs or tags, when and in which time zone, what to do about a missed run); and for each action you start or schedule, a short result per PC: who started it, when, what it was, its state, exit code and the last few kilobytes of its output (stored encrypted). When you check a PC for Windows updates or apps, the list it returns (update titles and KB numbers, app names, IDs and versions) is kept as that check's result. We also note which version of the Agent each PC runs, its time zone, whether it runs as administrator and has the Windows package manager, so we can show what's possible there | Results, lists and run history: 30 days (only the latest results are shown). Tags and schedules: until you delete them, the PC or your account |
| Teams | The team's name, the email addresses of the people you add, and which PCs and saved hosts you share with each | Until you remove them or delete your account |
| Team roles and permissions (Pro) | So a team's owner can decide what each person may do: each member's role (Admin, Member or Viewer) and, for each shared PC, what they may do there (view the screen, control it, transfer files, use Windows tools and commands, manage access). When a team member connects, our server signs these permissions into the connection, and the PC enforces them | Until the owner or an admin changes them, the person leaves the team, or the team or the owner's account is deleted |
| PC history notes (Pro, optional) | So you and your team can keep track of the help a PC got: notes written about a PC, with who wrote each one and when. A note written during a session includes an automatic summary of it: when it started and ended and, from the Windows app, counts of what was done (for example "Sent 3 files to the PC" or "Used the mouse and keyboard"); in the app you can leave the summary out. A summary never includes file names, what was typed or run, or anything on screen. Notes are encrypted on our server (not end to end, so that everyone the PC is shared with can read them on any device or the website). They can be read by the PC's owner and the team members the PC is shared with, while it's shared with them (Viewers can read but not add). If an author deletes their account, their notes stay with the PC and show "Former team member" instead of their email address. The note's text is never written to the security log | Until deleted (by its author, the PC's owner or someone who manages access to the PC), the PC is removed, or the PC owner's account is deleted. Each PC keeps up to 1,000 notes |
| Security log | To protect accounts and investigate abuse: sign-ins, sign-ups, password resets, two-factor changes and failed codes, PCs added and removed, team and account changes (including roles and permissions), PC history notes added or deleted (never their text), PC management actions (the kind of action, how many PCs and each PC's result, never a script's text or output), and a PC pausing connection-password attempts after 5 wrong tries (which PC and account, without an IP address or anything typed), with the time, IP address and app version | 90 days |
| Session records | A short record of every session through our relay, including sessions without an account (an 8-digit code or a Recent PC) and one-time help codes: when it started and ended and how long it lasted, which account connected (or that it was a guest), which PC (its name and operating system) and the PC's owner, which of our relays carried it, how it connected (our app, a web browser or an AI assistant through our MCP server), the app and its version, how much data passed each way, how many files were transferred if the PC reports it (a number only, never names or contents), and the networks of both ends shortened to the first three parts of an IPv4 address (/24) or the first three of eight of an IPv6 address (/48), never the full address. For browser sessions, also technical stats: frames per second and the round-trip time to the browser. Never anything that happened in the session. We use these records to run and improve the Service, plan capacity, investigate abuse and help with support | 90 days |
| Connection records | A short record of each connection you open yourself, without our relay: SSH, SFTP, FTP, RDP, VNC, serial cables, web admin panels and server-to-server copies in the Console, the browser terminal on our website, and SSH commands from an AI assistant through our MCP server. We keep the kind of connection, whether it came from the app, our website or the MCP server, how it was routed (directly, through your PC, through our server, or a tunnel), what protects it (for example SSH, TLS or none), when it started and ended, how much data passed each way, and how it ended (closed, timed out, failed). Never the server's name or address, your user name, passwords or keys, commands, what was shown, or file names. We use these records to run and improve the Service, plan capacity, investigate abuse and help with support | 90 days |
| Activity log export (Pro) | So you can review and keep your own records: a download (CSV or JSON) of your activity from the security log: sign-ins, settings changes, PCs added and removed, sessions, team changes and PC history notes added or deleted. A team owner's export also includes what happened on the team: members' sessions on the team's PCs and admins' changes to the team. It shows an IP address only for your own successful sign-ins, and never passwords, keys, codes, the text of notes or anything from your sessions | Not kept: the file is made when you ask for it, and covers at most the last 90 days |
| Your privacy choices | Whether you've said yes to product news by email and to product analytics, when you changed that, and where (the website or the app), so we do only what you agreed to and can show it. Also whether we've seen your account in the EU, the EEA, the UK or Switzerland (only that, never the country), so you get the privacy tools for those places wherever you travel | Until you delete your account |
| SSH servers you trusted in the browser | When you connect to an SSH server from our website's terminal, the server's host name, port and public key fingerprint, so a changed key can be caught next time. Never a password | 90 days after you last use the browser terminal (so also after you delete your account) |
| Product analytics ("Help improve RemoteAccessApp") | Whether our service metrics (below) may count your account when we count how many accounts use the Service and its features: as a code made fresh every day, so it can't be traced back to you or linked from one day to the next. With it off, what you do still adds to the totals, but never as you. In the EU, the EEA, the UK and Switzerland it's off unless you turn it on; elsewhere it's on unless you turn it off. Never anything from your sessions (screens, typing, files, commands) | Your choice: until you delete your account. The daily codes: 90 days |
| Copies of your data | When you use "Download my data", we prepare a ZIP file of your account's data for you to download, after checking your password | Deleted 7 days after it's ready |
| Deletion requests | When you ask to delete your account: when you asked and the date it will happen, so you can cancel until then | Until the deletion is done (14 days) or you cancel |
| Payment records | To manage your subscription: the IDs Stripe gives your customer record and subscription, the subscription's status (for example active, past due or canceled) and when its current period ends, and for each payment its amount, currency, date and reference. You pay in Stripe's own payment form: card details go straight to Stripe, and we never see or store card numbers | 5 years, as Australian tax law requires |
| Technical logs | Our servers log requests (IP address, time, the address requested without its query string, browser) and errors, to keep the Service working and secure | Website request and error logs: 14 days. Our apps' server logs: overwritten as they fill (usually days to a few weeks) |
| Support emails and chats | To answer you, if you email us or use the live chat on our website | As long as needed to help you, and to keep a record of what was agreed |
Emails we send you
We send the emails needed to run your account, listed below. We only send marketing email (occasional news about RemoteAccessApp) if you've said yes to it, and you can say no again at any time.
A welcome email when you sign up, which asks you to confirm your email address (you can ask for it again).
A password reset link, when you ask for one on the "Forgot password" page.
A sign-in code, when you sign in on a device or browser we don't remember and your account doesn't use two-step verification. It says which app or browser asked and roughly when, never the IP address. If you didn't try to sign in, change your password.
Security emails: your password was changed; a new sign-in to your account from an app or network we haven't seen before (at most 3 a day; you can turn these off in your account's security settings); two-factor authentication was turned on or off; your trusted networks changed. You can't turn the other security emails off, because they protect your account. Security emails only go to a confirmed email address.
Monitoring alerts (Pro, only for the alerts you choose to get by email; none are emailed until you tick "Email me too" on an alert): for example a PC went offline, a drive is almost full or an update failed, or one summary email when several happen. Every alert is shown on the Alerts page and, if you turn them on, as notifications. They only go to a confirmed email address, at most 5 a day, never during your quiet hours, and you can turn them off or change the rules on the Alerts page.
Account deletion: when you ask to delete your account, an email saying when it will happen and how to cancel, and a last one once it's done. They only go to a confirmed email address.
The download link, when you ask for it on our website ("Email me the download link", for example on your phone): one email with only the link to our download page. You don't need an account for it, and we don't keep your address: to stop it being misused, our server counts requests for each address and network for up to a day, in memory only, under a one-way code it forgets when it restarts.
We send them through our email provider, Resend (see "Who we share it with").
Notifications on your phone or computer (Pro, optional)
If you turn on "Notify me on this device" on the website, we can send that browser short notifications: monitoring alerts, "someone wants to connect to your PC" (when a connection request is waiting on one of your own PCs), a new sign-in to your account, and, if you choose, when a browser you remembered connects to one of your PCs. Each can be turned off. A notification says only the PC's name and what happened, with a link to your dashboard: never an IP address or anything from your sessions. It's encrypted for your browser before it leaves our server (so the push service can't read it) and delivered by your browser's push service.
The sign-up check
To stop automated sign-ups, the "Create your account" form uses Cloudflare Turnstile, an "I'm not a robot" check from Cloudflare, which already delivers our website (see "Who we share it with"). While that form is open, your browser loads the check from Cloudflare, and Cloudflare looks at signals from your browser and device (such as your IP address, your browser and how it behaves) to tell people from bots, usually without asking you to do anything. It gives your browser a one-time token, which our server checks with Cloudflare, together with your IP address, before your account is created. We use the answer only to decide whether the sign-up can go ahead, and we don't keep it.
The other forms with an "I'm not a robot" check (such as "Email me the download link" and resetting your password) ask your browser to solve a small computing puzzle instead. We run that one ourselves: it doesn't use a third-party CAPTCHA provider, and it doesn't use tracking cookies.
Free tools on our website
- What's my IP shows the IP address your request came from. We don't store it.
- The port checker makes one connection from our server to the IP address your request came from (never any other address), on the port you pick from a short list, and tells you whether it answered. Nothing is sent over it, and the result isn't stored.
- The speed test downloads a small test file from our server to measure the time it takes. Nothing is stored.
To stop misuse, each tool limits how often one IP address can use it: the address is held in our website server's memory for at most a few minutes for that, and never written down.
Sending files from your phone
If you add our website to your phone's home screen, you can share photos, files or links to "RemoteAccessApp" and send them to one of your PCs. Until you send them, they stay in your phone's browser only. When you send them, they go through our website server to your PC, like a remote session in the browser: in memory only, never stored. On the PC they're saved in the Downloads\RemoteDesk folder, and the PC's usual rules apply (the person there allows the session unless unattended access is on, and the session banner shows).
Service metrics
To keep the Service running well and secure, we keep statistics about how it's used, in aggregate. They stay on our own server and aren't shared with anyone.
- Usage counts: for example, how many accounts and PCs there are, how many sessions and server connections are open, how long sessions last and how much data they carry, sign-ups, sign-ins and failed sign-ins (with a reason code only, such as "wrong password"), emails sent (the kind of email and whether it went, never the address or what it said), and requests our limits refused. For a connection through our server we record the port it goes to, never the host.
- Requests to our website and servers: the time, the page or address requested without any query string (IDs and email addresses in it are removed), the result, size and response time, the kind of browser (for example "desktop" or "bot"), the version of our apps, the visitor's country as reported by our content delivery network (Cloudflare), and, when the browser sends it, the name of the website that linked to the page (for example a search engine), never the address of the page on that site.
- Website visits: for pages viewed on our website, installer downloads and sign-ups made there, we also keep whether the device is a desktop, phone or tablet, the browser family (for example "Chrome"), and, from the address of the page you arrived on, a link's campaign tags (utm_source, utm_medium and utm_campaign, for example "newsletter") and which ad network's click marker it had (Google, Meta or Microsoft; never the marker itself). Visits by bots, link previews and our own team aren't counted.
- Unique counts: to count distinct website visitors, we use a one-way code made from the visitor's IP address and browser family and a random value that changes every day (an IPv6 address counts by its first half). Accounts are counted the same way, with the account ID, unless product analytics is off for the account (see the table above). Weekly and monthly website totals use their own random values, which change every week and month. The random values never leave our servers and are deleted within a few hours after their day, week or month is over, so the codes can't be traced back to you or linked from one day (or week or month) to the next. Only the daily code is kept with the statistics.
- Where they come from: our website's server writes each request to a file with its IP address and browser identification (user agent), as its standard access log does. Our metrics service reads it, keeps only what's described above, and the file is deleted after 4 days at most. For our app servers, only the first part of the IP address is recorded (the network: the first three of four parts of an IPv4 address, the first three of eight of an IPv6 address).
- The statistics never contain your email address, name, IP address, browser identification, the names of your PCs, or anything from your sessions.
- How long we keep them: detailed events and website visits 90 days, website and server request statistics 30 days, and daily totals 2 years.
One-time help codes
When someone gets a one-time code to let a person they asked help them on their PC ("Get help"), we keep, for that code: a one-way keyed hash of the code (never the code itself), a one-way hash of the random key the PC uses for that one help session, the PC's Windows computer name (so the helper can see which PC they're connecting to), the IP address the code was asked for from (to limit how many codes one network can ask for), and when the code was made and runs out. The person who asked doesn't need an account, and we don't link the code to one.
When a helper uses the code, we add their account, when they used it, their app's certificate fingerprint and a one-way hash of a one-time connect ticket, and when the help session ended and why. The security log records that a code was made, used, refused (with the helper's account and their network, never the code) and ended. The help session itself is end-to-end encrypted like any other: we can't see it. The PC asks the person there to allow the helper every time; nothing is remembered for the helper afterwards, and the PC is never added to their account.
A code's record is deleted a day after the code or the help session ended. If a helper deletes their account, their account is removed from the record.
Connecting without an account
A PC can also be reached without an account, with its 8-digit code or as a Recent PC. For that, we keep:
- For the PC: its computer name, its operating system, the IP address it registered from and the one it was last seen from, and when it was first and last seen. We keep these while the PC uses no-account mode. Codes and Recent PC links are kept only as one-way keyed hashes, never in a form we can read.
- For a Console without an account: the name it gives itself, when it was created and last seen, and the IP address it was created from.
- For each connection: which PC, which Console, how it connected (code or Recent PC), the IP address and network it came from and when. These are kept 7 days.
- Wrong codes: the time, the network and address the attempt came from and which Console, never the code, so we can stop guessing. Kept 30 days.
Each session is also in the session records above (90 days), with the networks shortened, not full addresses. As with any session, it's end-to-end encrypted and we can't see it.
What we don't collect
- Anything shown on your screen, typed, clicked, copied, said, chatted, run or transferred during a session in the apps. It's end-to-end encrypted, and we can't read it. (PC management actions and scheduled tasks are the exception: they go through our server, so we keep the short results described above.)
- Passwords, private keys or passphrases for your servers and remote desktops in a form we can read. If you sync them (Pro), they're end-to-end encrypted and we can't read them. When you sign in to a server in the browser's SSH terminal, the password or key you use passes through our website server for that sign-in only: it's held in memory, then discarded, and never stored or logged.
- Your precise location, contacts, browsing history, or the files on your PCs.
- Analytics that follow you around inside RemoteAccessApp, unless you turn on product analytics. Our service metrics (above) are aggregate statistics about the Service, not about you. Our website's own cookies only keep you signed in, protect forms and remember your cookie choices. Two third parties can set their own cookies on the public pages of our website, if you allow them: the live-chat window (tawk.to) and Meta's ad-measurement pixel (see "Cookies" and "Who we share it with" below). Neither runs on the dashboard, remote sessions, the SSH terminal or checkout, and neither ever sees what happens in your sessions.
Cookies
Our Cookie Policy lists every cookie and tracker on our website, with what it does and how long it lasts. In short:
- Strictly necessary cookies keep you signed in, protect forms and remember your cookie choices. They're always on, because the website can't work without them.
- Optional: the live chat (tawk.to) and Meta's pixel. If you're in the EU, the EEA, the UK or Switzerland, neither loads until you say yes in the cookie banner: we tell where you are from the country our network provider (Cloudflare) reports for your connection, or, if it doesn't say, from your browser's time zone. Elsewhere they load unless you turn them off. Either way, you can change your mind any time with "Cookie settings" at the bottom of every page, and if your browser sends a Global Privacy Control signal, the pixel never loads.
Sessions and the relay
- In the apps, the connection between your Console and your PC is end-to-end encrypted (TLS). When it goes through our relay, the relay forwards the encrypted data without being able to read it, and doesn't store it. While a connection is open, our servers know which PC it's for, the IP addresses involved and how much data passes. When a session ends, we keep a short session record of it for 90 days (see "Session records" above): which account connected to which PC, when, for how long, how much data passed, how many files were transferred if the PC reports it, and the networks at each end shortened to /24 (IPv6: /48). Nothing about what happened in the session, and never a full IP address. You (and, for sessions on a team's PCs, the team's owner) can see these records in the activity log (Pro).
- In a web browser (including iPhone), our website acts as your Console. The encrypted connection runs from your PC to our website server, and from there to your browser over HTTPS. The website server handles the screen images and your mouse and keyboard input in memory, only to pass them along. It doesn't record, store or look at them. It may log that a browser session with a named PC started or ended. It also measures how many frames per second it sends to your browser and the round-trip time to it (with a small "ping" message every few seconds), and passes those two numbers to our relay for the session record. Your browser's HTTPS connection to our main website goes through our network provider, Cloudflare, which also handles it in transit. When a nearer server of ours (a regional relay) runs the session, it does the website's part instead, without Cloudflare.
- The SSH terminal in the browser works the same way: our website (or a regional relay) runs the SSH connection to your server and passes the terminal to your browser over HTTPS. The SSH connection to your server is encrypted; what you type and what the server shows pass through our server in memory only, and are never stored or logged. We keep a connection record of it (see "Connection records" above).
- Connections the Console makes itself (SSH, SFTP, FTP, RDP, VNC, web panels) go straight from your PC to the server, or through our server if you choose that. How well they're protected depends on the protocol: SSH and SFTP are encrypted, plain FTP and VNC without an SSH tunnel are not, and RDP and web panels use TLS when the server offers it.
- Voice typing in the browser: if you use voice typing on the remote desktop keyboard, your browser's speech service (for example Google or Apple) turns your speech into text; RemoteAccessApp never receives or stores the audio, only the text you choose to type on your PC.
The people at the PCs you access
When you connect to a PC, the person there sees who is asking (for example your Windows user name and computer name, or your email address if you connect from a browser). The details about that PC (its computer name, Windows user name, last IP address and approximate location) are stored in your account.
PC management actions and scheduled tasks (Pro) follow the same rules as sessions: the PC asks the person there before anything runs unless unattended access lets the owner's own account in, nothing that changes the PC runs while remote control is switched off there, and the PC shows who did what and when. A restart always shows a notice first that the person there can postpone.
If you use RemoteAccessApp on PCs used by other people, you're responsible for telling them about RemoteAccessApp and this policy, and for having any consent the law requires. For personal information about those people that you see or handle during your sessions, you decide how and why RemoteAccessApp is used; we only provide the tool. See our Terms of Service.
If you use RemoteAccessApp for a business or other organization, for example to support your staff's PCs or to work as a team, you're the controller of your team members' and users' personal data that you put into RemoteAccessApp, and we process it for you as your processor under our Data Processing Agreement.
AI assistants (Claude Code)
If you use the Claude Code integration (RemoteAccessApp Pro), the RemoteAccessApp MCP server runs on your own PC and connects to your PCs just as the Console does. Using it doesn't send us anything extra.
- On your PC only: the server keeps a short list of its recent actions (such as "Taking a screenshot" or the first line of a command) so the Console's Claude Code page can show them. It doesn't keep what the assistant types or the output of commands, and it doesn't send this list to us.
- To the AI provider: what the assistant sees and does (screenshots, command output, file and window names, and anything else on screen) goes from your PC to the provider of the assistant you use (for Claude Code, Anthropic), under their terms and privacy policy, not ours. We don't receive it and don't control how they use it.
- The people at the PCs are told an AI assistant is connecting: the prompt and banner name "Claude Code via RemoteAccessApp MCP". If other people use the PCs you let an assistant work on, you're responsible for telling them it may see their screen.
How we use your data
We use personal data only to:
- provide the Service: sign you in, show and connect your PCs, run Teams, sync your settings and manage your license and billing;
- keep the Service and accounts secure, and detect, prevent and investigate fraud, abuse and breaches of our Terms of Service;
- answer your questions and send you messages about your account and the Service (not marketing);
- meet our legal obligations, and establish, exercise or defend legal claims.
And, only if you agree, to:
- send you occasional news about RemoteAccessApp, and learn how its features are used (product analytics);
- on our website, run the live chat and measure our ads with Meta's pixel.
We don't sell your data, and we don't use what's in your account to show you ads. We don't make automated decisions about you that have legal or similarly significant effects. We do automatically block sign-ups that fail the sign-up check and slow down unusually frequent requests, to protect the Service.
The legal basis for each use (for people in the EU, the EEA, the UK and Switzerland) is in Your rights under the GDPR.
Who we share it with
We don't sell or rent personal data. We only share it with:
- Our hosting provider (in Australia), which runs our servers and stores our data and backups.
- Cloudflare (Cloudflare, Inc., in the United States, with a worldwide network), which delivers our website and protects it from attacks: every visit to RemoteAccessApp.com passes through it, so it handles your IP address and the pages you request. It also forwards emails sent to our addresses (such as [email protected]) to us. It doesn't carry the apps' connections to our servers.
- Resend (Resend, Inc., in the United States), our email provider. It sends the emails described in "Emails we send you": it receives your email address and the content of each email (for example a confirmation or reset link, a sign-in code, or the app type and approximate time of a new sign-in), and keeps delivery records under its own privacy policy.
- Your browser's push service (Google Firebase Cloud Messaging, Mozilla, Apple or Microsoft, depending on your browser), only if you turn on notifications. It delivers the notifications described in "Notifications on your phone or computer": it receives each notification encrypted (it can't read it), when it's sent and how large it is, and the push address your browser created, under its own privacy policy.
- Meta Platforms (Facebook and Instagram), to measure our ads, only if you allow it. The public pages of our website (not the dashboard, remote sessions, the SSH terminal or checkout) can load Meta's pixel, which sends Meta that you viewed a page, clicked Download or Get Pro, or created an account, together with your IP address, browser details and Meta's cookies. Meta uses it to tell us which ads bring visitors and to show our ads to similar people, under its own privacy policy. We don't send Meta form contents, emails, passwords or anything from your PCs. It never loads if your browser sends a Global Privacy Control signal. In the EU, the EEA, the UK and Switzerland it loads only after you accept it in the cookie banner; elsewhere, you can turn it off with "Cookie settings" at the bottom of every page. You can also block it with your browser's tracker protection or in your Facebook ad settings. For people in the EU, EEA, UK and Switzerland, we and Meta Platforms Ireland Limited are joint controllers for collecting this data on our website and sending it to Meta; Meta alone decides what it does with it afterwards (see Your rights under the GDPR).
- tawk.to (tawk.to inc.), our live-chat provider, only if you allow it. The chat window on our website is run by tawk.to. When it loads, your browser fetches it from tawk.to, which receives your IP address and browser details and sets its own cookies to keep a chat going. If you start a chat, tawk.to receives what you type and any name or email you give, and keeps it for us. The chat window also loads its fonts from Google Fonts, so Google receives your IP address too. In the EU, the EEA, the UK and Switzerland it loads only after you accept it, in the cookie banner or with the "Chat with us" button; elsewhere, you can turn it off with "Cookie settings".
- Google or GitHub, only if you choose to sign in with them. Your browser goes to their sign-in page and back, so they know you signed in to RemoteAccessApp (their own privacy policies cover that). We only ask them who you are (see "What we collect and why"); we don't send them anything about your account or your PCs.
- Stripe (Stripe, Inc. and its affiliates), our payment provider, when you buy Pro. You pay in Stripe's secure payment form, which Stripe shows inside our checkout page (only that page loads Stripe), and manage your subscription on Stripe's billing page: Stripe receives your email address, card and billing details, processes your payments and keeps its own records under its own privacy policy. To prevent fraud, Stripe's form also collects information about your device and browser (including your IP address) and may set its own cookies on the checkout page. We receive from Stripe only what's listed under "Payment records" above, never your card number.
- Other RemoteAccessApp users, where you choose it. If you share PCs or saved hosts through Teams, the people you add see your email address and what you share with them. If someone adds you to their team, they see your email address. In a team, the owner and admins see each member's role and permissions; everyone a PC is shared with sees its history notes and who wrote them (by email address); and the team's owner can see, in the activity log, when members connected to the team's PCs, for how long and how much data passed, and the changes admins made to the team.
- Authorities and others where the law requires or allows it, for example to respond to a valid legal request, or to protect people, our users or ourselves from fraud, abuse or harm. Where the law allows, we'll tell you.
- A buyer or successor, if our business or the Service is sold or restructured, under this policy.
The companies that process personal data for us, what each one does and where, are listed on our Subprocessors page.
International transfers
Your account data is stored in Australia, on our servers and in our backups there, and we work on it from Australia. If you live somewhere else, your data goes to Australia when you use RemoteAccessApp. Some of it is also handled by our providers in other countries: Resend (emails) and tawk.to (live chat, if you use it) in the United States, Stripe (payments, if you buy Pro) and Cloudflare (our website's network) in the United States and the other countries where they operate, Meta (the pixel, if you allow it) in Ireland and the United States, and, if you turn on notifications, your browser's push service (usually in the United States).
For people in the EU, the EEA, the UK and Switzerland: Australia doesn't have an "adequacy decision", so EU law doesn't treat it as protecting personal data to the same standard by default. Where the GDPR's transfer rules apply, we rely on the European Commission's Standard Contractual Clauses (with the UK Addendum and the Swiss amendments) as the safeguard, and we apply this policy and the GDPR to your data wherever we handle it. Our providers in the United States use the Standard Contractual Clauses, or the EU-US Data Privacy Framework where they're certified under it. You can ask us for a copy of these safeguards.
Security
- Traffic to our servers uses TLS, and the apps only trust our own server certificate.
- Sessions in the apps are end-to-end encrypted, so the relay can't read them.
- Passwords and two-factor backup codes are hashed; authenticator secrets, tokens and license keys are stored only as hashes or encrypted; synced settings and PC history notes are encrypted on our server; synced passwords and SSH keys are end-to-end encrypted.
- Team permissions are enforced by the PC itself: our server signs a team member's permissions into each connection, and the PC refuses what they don't cover (for example control or files for a Viewer). A limited connection to a PC whose RemoteAccessApp is too old to enforce it is refused.
- Updates are digitally signed and checked before they install.
- Access to our servers and admin dashboard is restricted to the owner.
- Backups are kept on our server for up to 14 days, so deleted data can remain in a backup until it rotates out.
No system is perfectly secure, and we can't guarantee the security of your data. You're responsible for keeping your password, setup codes and devices secure. If a data breach is likely to cause you serious harm, we'll tell you and the relevant authorities as the law requires.
Your choices and rights
You can:
- See and correct your details: sign in to the Console or the website, or contact us.
- Turn product news by email and product analytics on or off, and change your cookie choices on our website with "Cookie settings" at the bottom of every page.
- Remove PCs, trusted networks, synced settings and team members at any time, and delete PC history notes (your own, or any note on a PC you own or manage access to).
- Download your activity log (Pro) as a CSV or JSON file, from the Activity log page on the website.
- Turn off "new sign-in" emails in your account's security settings. The other security emails always go, because they protect your account.
- Turn monitoring alerts, their emails or notifications off, mute a PC, set quiet hours, or turn off notifications on a device, on the Alerts page (or in the Console). Removing a device from the list deletes its push address.
- Delete your account. If your account is in the EU, the EEA, the UK or Switzerland, use "Delete my account" in the dashboard under "Privacy & your data": it's deleted 14 days later (you can cancel until then), your Pro subscription is cancelled, a team you own is deleted (its members lose access to what you shared), and your PCs are unenrolled. Anyone can also ask us. We'll delete your account, your PCs, sign-in sessions, trusted networks, synced settings and synced passwords, your alert settings, alert history and notification subscriptions, your PCs' history notes, your PC tags, scheduled tasks and their results, and your team with its roles and permissions. Your payment details at Stripe are cleared too. Some records stay for a limited time: security log entries until they expire (90 days), backups until they rotate out (14 days), the SSH servers you trusted in the browser terminal until 90 days after you last used it, and license and payment records (without your name or email) for the 5 years tax law requires. If someone else added your email address to their team, it stays on their list until they remove it; ask us and we'll remove it. Notes you wrote on someone else's PC belong to that PC's history: they stay there, shown as written by "Former team member" instead of your email address, until that PC's owner or the people who manage it delete them.
- Get a copy of the data we hold about you: "Download my data" in the dashboard under "Privacy & your data" (accounts in the EU, EEA, UK and Switzerland), or ask us.
- Object to our use of your data for our legitimate interests, or ask us to restrict it.
Depending on where you live, you may have more rights under laws such as the GDPR, the UK GDPR, the Swiss data protection act or the Australian Privacy Act. Contact us at [email protected]. We'll respond within one month (30 days), and may need to confirm your identity first. If you're not happy with our answer, you can complain to your local privacy regulator, such as the Office of the Australian Information Commissioner or, in Europe, your data protection authority.
Your rights under the GDPR (EU, EEA, UK and Switzerland)
This section applies if you're in the European Union, the European Economic Area, the United Kingdom or Switzerland. It adds what the GDPR (and the UK GDPR and the Swiss Federal Act on Data Protection) requires us to tell you. Your data rights explains the same in plain English.
Who's responsible for your data
The controller of your personal data is Rust Games Australia Pty Ltd (ABN 64 683 623 065), Australia. For anything about your data, email [email protected] (write "Privacy" in the subject). We haven't appointed a data protection officer: the law doesn't require one for a business of our size and kind, and the company's owner handles privacy questions.
When you use RemoteAccessApp for an organization and add other people's data (your team, the people at your PCs), the organization is the controller of that data and we're its processor: see our Data Processing Agreement.
What we use your data for, and why we're allowed to
| What we do | What data | Legal basis |
|---|---|---|
| Create and run your account, sign you in and keep you signed in | Email address, optional name, password hash, your Google or GitHub account ID if you sign in with them, sign-in sessions and codes, two-factor settings, remembered devices | Contract: you asked for an account (Art. 6(1)(b)) |
| Provide the Service: your PCs, connections through our relay and in the browser, synced settings and passwords, Teams, roles and permissions, history notes, alerts and notifications, PC management | The data in "What we collect and why" for each feature | Contract (Art. 6(1)(b)) |
| Bill Pro and handle refunds | Stripe's customer and subscription IDs, subscription status, payment records | Contract; and legal obligation to keep tax and accounting records (Art. 6(1)(c)) |
| Send the emails your account needs (confirmation, password resets, sign-in codes, security emails, alerts you turned on) | Your email address and what each email says | Contract; for security emails, also our legitimate interest in protecting your account (Art. 6(1)(f)) |
| Keep accounts and the Service secure, and prevent fraud and abuse | IP addresses, approximate location, the security log, session records, the no-account connection records and wrong-code attempts, the sign-up check, request limits, the account-sharing checks, keyed hashes of hardware identifiers and hardware bans | Legitimate interests: keeping accounts, your PCs and the Service safe (Art. 6(1)(f)) |
| Keep the Service running well | Server logs, aggregate service metrics, and session records (for capacity planning, support and the technical stats of browser sessions) | Legitimate interests: running and improving a reliable service, with the data kept aggregate and short-lived (Art. 6(1)(f)) |
| Answer you when you contact us | What you send us | Legitimate interests in helping you (Art. 6(1)(f)), or contract when it's about your account |
| Product news by email | Your email address and your choice | Consent (Art. 6(1)(a)), off unless you turn it on |
| Product analytics | A daily code for your account in our usage statistics (never anything from your sessions) | Consent (Art. 6(1)(a)), off unless you turn it on |
| Live chat on our website | What tawk.to receives (see "Who we share it with") | Consent, for its cookies and the chat itself (Art. 6(1)(a) and the ePrivacy rules) |
| Measure our ads with Meta's pixel | Page views and a few actions, IP address, browser details, Meta's cookies | Consent (Art. 6(1)(a) and the ePrivacy rules) |
| Strictly necessary cookies | Sign-in, form protection and your cookie choices | Necessary to provide the website you asked for (exempt from consent under the ePrivacy rules); contract and legitimate interests |
| Answer your privacy requests, keep records of them and of your consents, and comply with the law | Your request, when it was made and what we did; what lawful requests require | Legal obligation (Art. 6(1)(c)); legitimate interests in establishing, exercising or defending legal claims (Art. 6(1)(f)) |
Where we rely on legitimate interests, we've weighed them against your rights, kept the data to what's needed, and you can object (see below). Giving us your email address and a password (or signing in with Google or GitHub) is needed to have an account; everything else optional is marked as such.
For Meta's pixel, we and Meta Platforms Ireland Limited are joint controllers for collecting the data on our website and sending it to Meta, under Meta's Controller Addendum. We're responsible for asking your consent and for this notice; Meta is responsible for what it does with the data after it receives it, under Meta's privacy policy. You can use your rights with us or with Meta.
Who receives your data
Our hosting provider (Australia), Cloudflare (website delivery and our email forwarding), Resend (email), Stripe (payments), tawk.to (live chat, with your consent), Meta (ad measurement, with your consent), your browser's push service (if you turn on notifications), the people you share with in Teams, and authorities where the law requires it. Details are in "Who we share it with" above and on our Subprocessors page.
Transfers outside the EU, EEA, UK and Switzerland
Your data is stored in Australia, which doesn't have an adequacy decision, so where the GDPR's transfer rules apply we rely on the Standard Contractual Clauses. Some providers handle it in the United States and other countries, under the Standard Contractual Clauses or the EU-US Data Privacy Framework. See "International transfers" above. Email us for a copy of the safeguards.
How long we keep it
| Data | How long |
|---|---|
| Your account and what's in it (email, name, settings, PCs, saved hosts, synced data, teams, preferences, privacy choices) | Until you delete your account. Deletion happens 14 days after you ask (you can cancel until then) |
| Sign-in sessions and remembered devices | 30 days after last use (sessions) and 30 days (remembered devices) |
| One-time codes and links | Until used or expired (10 minutes to 24 hours), then deleted within days |
| One-time help codes (the code's hash, the PC's name, the IP address it was asked from, the helper's account and times) | Deleted a day after the code or help session ended |
| Security log, session records, connection records, alert history | 90 days |
| No-account connections (which PC, which Console, when, from where) | 7 days |
| Wrong no-account codes (time, network and address, never the code) | 30 days |
| A PC or Console used without an account (name, operating system, IP addresses, first and last seen) | While the PC or Console uses no-account mode |
| PC management results | 30 days |
| PC health for monitoring alerts | Minutes, in memory only |
| Service metrics | Details 30 to 90 days, daily totals 2 years; the request file they're made from, 4 days at most |
| Server logs | Website request and error logs 14 days; our apps' server logs are overwritten as they fill (usually days to a few weeks) |
| SSH servers you trusted in the browser terminal | 90 days after you last use the terminal |
| Product analytics (if you turn it on): your account's daily codes in our usage statistics | 90 days |
| Copies of your data ("Download my data") | 7 days after they're ready |
| Backups | 14 days (deleted data can stay in a backup until it rotates out) |
| Payment records | 5 years, as Australian tax law requires (without your name or email once your account is deleted) |
| Support emails and chats | As long as needed to help you and keep a record of what was agreed |
| Cookies | See the Cookie Policy |
Your rights, and how to use them
You have the right to:
- Access your data and get a copy of it (Art. 15).
- Correct it if it's wrong or incomplete (Art. 16).
- Erase it ("right to be forgotten") (Art. 17).
- Restrict how we use it, for example while we check a complaint (Art. 18).
- Take it with you in a structured, machine-readable format (portability, Art. 20).
- Object to our use of it for our legitimate interests (Art. 21). If you object to marketing, we stop, always.
- Withdraw your consent at any time, as easily as you gave it (Art. 7(3)). It doesn't affect what we did before.
- Complain to a supervisory authority (Art. 77): in the country where you live or work, or where you think the problem happened. In the EU and EEA, the list of data protection authorities; in the UK, the Information Commissioner's Office; in Switzerland, the Federal Data Protection and Information Commissioner. We'd appreciate the chance to sort it out with you first.
How:
- In the dashboard, under "Privacy & your data" (accounts we've seen in the EU, EEA, UK or Switzerland, from the country of your connection when you sign up or sign in): turn product news and product analytics on or off, "Download my data" (a ZIP of JSON files: your copy, ready to take elsewhere), and "Delete my account".
- In the RemoteAccessApp app's settings, where the same choices are offered.
- On our website, "Cookie settings" at the bottom of every page changes or withdraws your cookie choices.
- By email to [email protected], from the email address on your account if you have one, for anything else (correction, restriction, objection, or any request you'd rather we handle).
We answer within one month. If a request is complex, or you send many, we may take up to two more months, and we'll tell you why within the first month. It's free, unless a request is clearly unfounded or excessive. We may ask you to confirm it's you, so nobody else gets your data.
Automated decisions
We don't make decisions about you based solely on automated processing that have legal or similarly significant effects (Art. 22). The automatic protections (the sign-up check and limits on unusually frequent requests) only stop abuse; if one gets in your way, email us and a person will look at it. The account-sharing checks only list an account for a person to review; a limit on PCs signed in at once (if on) only signs out the PC used least recently, and you can sign in there again.
Children
RemoteAccessApp isn't for children. In the EU, the EEA, the UK and Switzerland you must be at least 16 to use it. We don't knowingly collect children's data; see "Children" below.
Data on your own PCs
The apps keep some data on your own PCs, such as settings, saved hosts and saved passwords (encrypted), and files received in sessions. That data is under your control, not ours. It stays on the PC until you delete it or uninstall RemoteAccessApp.
If the person at a PC sets a connection password (a password everyone must enter before connecting to that PC), it is kept only on that PC, as a salted, slow one-way hash (never the password itself), encrypted for that Windows user. It never reaches our servers: the apps and the website prove it to the PC without sending it. If someone ticks "Remember me on this device", that PC and that device each keep a random token (encrypted for that Windows user in the apps, and as a key the browser can't export in a web browser), which stops working when it expires, is removed at the PC, or the password changes. When someone enters a wrong connection password 5 times in a row and alerts are on for that PC, the security log records that it happened (which PC and which account was connecting, with no IP address and nothing typed), and the PC's owner may get an alert.
Children
RemoteAccessApp isn't intended for anyone under 16 (or the age of digital consent where they live, if that's higher), and we don't knowingly collect their data. If you think a child has given us personal data, contact us and we'll delete it.
Changes to this policy
If we change what we collect or how we use it, we'll update this page and the date above. If a change is significant, we'll tell you in the app, on the website or by email before it takes effect.
Contact
Rust Games Australia Pty Ltd (ABN 64 683 623 065), Australia · [email protected] (for privacy, write "Privacy" in the subject)