Privacy Policy

Last updated: September 26, 2026

1. Overview

RudyDesk is a remote access app that works directly between devices (P2P). Your privacy matters most to us. We collect the minimum of data, never sell it, and share it only with the services listed in section 7 — exactly what the service cannot work without.

2. Data We Collect

  • Device ID — A randomly generated 9-digit identifier stored locally on your device. It is not linked to your personal identity.
  • Connection metadata — the signaling server processes device IDs and IP addresses to establish the direct connection. To protect against password guessing, investigate incidents and answer lawful requests, device IDs, IP addresses and connection times are written to a security log kept for 12 months. We treat device IDs and IP addresses as personal data.
  • Push notification tokens — If you enable push notifications, your FCM/APNs token is stored on the server to deliver notifications. You can unsubscribe at any time.
  • Download statistics — when an installer is downloaded, we store the IP address, the city and country derived from it, the page language, the device OS and the referrer. Kept for 90 days so we understand where people come from.
  • Device details — for each device ID we keep the first and last connection dates, how many there were, the device type (desktop app, browser, phone, bridge board) and its operating system, the interface language, and the country and city resolved from the IP address on the first connection. The IP address itself is not kept in this record. We use it to tell new people from regulars and to give newcomers a trial. The record is deleted 12 months after the last connection.
  • Telegram notifications — only if you linked the bot yourself: we keep the chat ID and the linked device IDs to report sessions (who, from where, for how long) and when a computer goes offline.

3. Data We Do NOT Collect

  • We do not record, store, or transmit screen content, keystrokes, mouse movements, or any data from your remote sessions.
  • We do not collect names, phone numbers or anything that identifies you. An email address is needed only if you buy a plan: the receipt and the license key are sent to it.
  • We do not use advertising SDKs and we never sell your data. The app itself carries no counters at all; visits to the website pages are counted — see section 7.

4. Peer-to-Peer Architecture

All remote desktop sessions use WebRTC for direct peer-to-peer connections. Video, audio, input, and file transfers flow directly between your devices, encrypted with DTLS-SRTP. The signaling server only facilitates the initial connection handshake — it never sees your session data.

5. Encryption

  • Transport — All WebSocket connections to the signaling server use TLS (WSS).
  • Sessions — All WebRTC sessions are encrypted end-to-end with DTLS-SRTP.
  • Remote Shell — Shell commands use ECDH key exchange + AES-256-GCM encryption over DataChannel.
  • Passwords — new app versions never send the device password to the server: knowledge of the password is proven by answering a one-time challenge. Passwords from older versions are stored on the server only as a bcrypt hash.

6. Local Storage

Settings, address book, connection history, and 2FA secrets are stored locally on your device using browser localStorage (PWA) or AsyncStorage (mobile app). This data never leaves your device unless you explicitly share it.

7. Third-Party Services

  • Google STUN servers — Used for NAT traversal during WebRTC connection establishment. Only your IP address is visible to these servers.
  • Firebase Cloud Messaging — Used for push notifications on Android. Subject to Google's privacy policy.
  • Apple Push Notification Service — Used for push notifications on iOS. Subject to Apple's privacy policy.
  • Yandex.Metrica and Google Tag Manager — count visits to the website pages, not to the app: page address, referrer and anonymised on-page actions, including Webvisor session replay. They set their own cookies. A blocker extension or disabled cookies switches them off, and nothing in the app stops working.
  • ip-api.com — determines city and country from an IP address for download statistics and for telling the owner where a connection came from. Only the IP address is sent.
  • Telegram — delivers notifications if you linked the bot. Subject to Telegram's privacy policy.

8. Children's Privacy

RudyDesk is not intended for use by children under 13. We do not knowingly collect information from children.

9. Data Retention

The server keeps the list of connected devices in memory; it disappears when a device disconnects or the server restarts. The security log is kept for 12 months, month by month, and then deleted automatically; acceptance of these terms is recorded there too. Download statistics are kept for 90 days. Encrypted backups of server data are stored separately for no longer than 8 weeks.

10. Your Rights

You can delete all locally stored data by clearing your browser/app data. To remove your push notification subscription, disable notifications in the app settings. You have the right to learn what data about your device the server holds, have it corrected or deleted, or object to its processing — write to privacy@rudydesk.com with your device ID. Security log records may be kept until the end of the retention period if they are needed to investigate a violation or answer a lawful request.

11. Contact

For privacy-related questions, contact us at privacy@rudydesk.com.

12. Changes

We may update this policy from time to time. Changes will be posted on this page with an updated revision date.