Legal

Privacy Policy

Effective 1 November 2026. This version replaces any earlier one.

1. The short version

Thumbdesk gives you remote access to your own machines. We use account and device information to connect them, keep your account secure and provide the features you use. We do not sell or rent your personal data or use it for advertising.

Your sessions. WebRTC connections are encrypted end to end, including through a TURN relay. Terminal and file operations can also use a server relay; section 4 explains how each connection protects your content. We do not store terminal input or output.
Your account. We keep the information needed for sign-in, device pairing, subscriptions, host status, alerts and stats, along with security and usage records described below.
Your choices. You can manage paired devices, turn off notifications and delete your account in the app. For a copy of your data or help with a privacy request, contact support@thumbdesk.com.

2. Who is responsible for your data

The data controller is A.G. Software Technologies, based in Lucknow, India, which operates Thumbdesk and thumbdesk.com. We do not currently have a representative in the EU or the UK. For any privacy question, to exercise the rights below, or to ask for a postal address, write to support@thumbdesk.com.

3. What we collect, and why

Account

Email address, your sign-in identifier and where one-time sign-in codes are sent.
Display name, which you choose and can change.
An internal user id to identify your account across our services.
Sign in with Apple or Google. The provider returns a signed token, which we verify and discard. We keep only the stable account identifier from it (the sub), to link your sign-ins.

Hosts, presence and stats

Host metadata for each machine you pair: hostname, platform, agent version and whether it is online.
Lightweight background snapshots: CPU, memory, disk, swap, load, network, temperature and OS details, used for presence, alerts and history. The backend caches the latest snapshot and keeps selected numeric series for charts.
Live process details, including process lists, command lines and logged-in users, stay out of background snapshots. The live view uses the encrypted WebRTC channel and we do not store it.
Alert rules you create, and which ones have fired.
Agent diagnostics (agent 2.0 and later): when the host agent crashes or stops without a clean shutdown, it sends us a report with the agent version, platform and OS version, the place in our code where it failed, the error message and a stack trace. It also sends hourly counts of errors by code location, and a note when it starts a self-update. Before sending, the agent removes your home directory path and user name and caps the size. Terminal data, file contents, command text and log lines are never included. Turn this off on the host with thumbdesk diagnostics off.

Devices and keys

A device id generated when the app first runs, which binds sign-in sessions to your phone.
A host id for each paired machine, used to route connection setup.
Ed25519 public keys for each paired host and each phone. We hold the public halves only; private keys never leave the device that made them.
A push token so we can deliver alerts and security notifications. You can turn notifications off in your phone’s settings at any time.

Connection metadata

IP addresses seen on authenticated requests, used for security (unusual sign-ins), rate limiting and abuse investigation.
App and OS versions and device model, for debugging and to turn features on only for versions that support them.
Timestamps such as last seen, last sign-in and last pairing.
Relay usage counts: the volume of data sent through a relay, without recording its contents.

Audit log

Security logs record sign-ins, token refreshes, device changes, pairing, session and file-transfer starts, and account deletion. Entries include the account or host id, time, IP address and event type, without terminal content or file names. Each host agent also keeps a local audit log on your machine, available to you in the app; we do not collect that log.

Subscriptions

A RevenueCat subscriber id linked to your internal user id.
Purchase state: product, purchase and expiry dates, renewal, cancellation, refund and grace period status. We receive it from RevenueCat, which receives it from Apple or Google. We never see your card or billing address.

SSH hosts

If you add a machine as a plain SSH host, its address, username, password or private key and pinned host key are stored only on your phone, in the platform’s secure storage, under the account signed in on that phone. They are not sent to our servers.

4. How your session content is protected

WebRTC connects your phone and machine with end-to-end encryption: only those devices can read the content. When a direct connection is unavailable, a TURN relay forwards the same encrypted traffic without being able to read it. Some features also support a separate server relay, as described below.

Terminal sessions use WebRTC when available. While it connects, or if it is unavailable, sessions can use our server relay over TLS. This connection is encrypted in transit, but not end to end: our servers can read the traffic while forwarding it. We do not store terminal input or output. The app indicates this connection with a SIGNALING badge.
Screen sharing (video, sound, pointer and keyboard input) uses WebRTC only, directly or through TURN, and is end-to-end encrypted. It never falls back to our servers.
Files use WebRTC when available. File operations over the server relay normally have an additional layer of end-to-end encryption. If the devices cannot establish that encryption, file paths, folder listings and small file operations may pass through the relay protected by TLS and be readable by our servers. Large transfers require WebRTC.
Agent chat (Claude Code, Codex and Grok in the app) is encrypted end to end with current host agents, including over the server relay. Older agents may use TLS only, allowing our servers to read messages in transit. The app labels these connections “Not end-to-end encrypted”; update the host agent to enable end-to-end encryption.
Full live host details (process lists, command lines, logged-in users) use WebRTC and are never part of the background snapshots in section 3.
Device privacy: we do not collect environment variables, installed-software inventories, SSH known-hosts files, GPS location, contacts, calendar data or advertising identifiers (IDFA, AAID).
Camera and photos: the camera scans pairing QR codes and, if you choose, takes a photo to attach or upload. A photo or file you pick goes only to the host you send it to. Host sound during screen sharing plays back without the app ever opening your microphone.

For protocols, encryption algorithms and connection details, see our security architecture.

5. Purposes and legal bases (GDPR art. 6)

Account, sign-in, pairing and connection setup: performance of a contract (art. 6(1)(b)).
Presence, alerts and stats history: performance of a contract, because they are features you turn on.
Audit log, rate limiting and abuse prevention: legitimate interests (art. 6(1)(f)) in keeping accounts and the service secure.
Push notifications: performance of a contract for alerts and security messages; consent (art. 6(1)(a)) for any optional product news.
Subscriptions: performance of a contract, to grant what you bought through Apple or Google.
Crash and performance reports from the app and from the host agent: legitimate interests in fixing them. Never used for advertising, and the agent’s reports can be turned off on the host.

6. How long we keep it

Account data: until you delete your account.
Audit log: 90 days, then purged automatically.
Daily host uptime aggregates (online and offline counts): 30 days.
Agent diagnostics: 90 days, and at most 500 reports per host; removed with the host.
Refresh tokens: rotated on every use, revoked at once when you sign out, and expired after 30 days unused.
Idle free accounts: if the app has not been opened for 30 days, a free account’s hosts are put to sleep, and after 45 days their pairings are removed. The account itself stays.
Deletion record: a hashed user id and deletion date may be retained for up to 7 years for fraud prevention and chargeback handling. This record contains no email, name, IP address or device id.
Backups: encrypted database backups roll over within 30 days, so a deletion reaches every backup within that window.
Website logs: see section 13.

8. International transfers

Thumbdesk is operated from India, our backend runs in the United States, and several processors (Apple, Google, RevenueCat, Expo) are also outside the EEA. If you are in the EEA, the UK or Switzerland, using Thumbdesk therefore means a transfer of personal data outside that area. For those transfers we rely on the European Commission’s Standard Contractual Clauses and, where a processor is certified, the EU–US Data Privacy Framework. End-to-end encrypted content (section 4) is not readable by us or by any processor wherever it travels.

9. Your rights

In the EEA, the UK or Switzerland (GDPR, UK GDPR)

You have the right to access the personal data we hold about you, correct it, have it erased, restrict or object to its processing, receive it in a portable format, withdraw consent where consent is the basis, and complain to your data protection authority.

In California (CCPA, CPRA)

You have the right to know what personal information we collect, to delete it, to correct it, and to opt out of its sale or sharing (we do neither, but the right stands), and not to be treated differently for using any of these rights.

How to use them

You can delete your account yourself in the app (section 14). For a copy of your data, a correction or anything else, email support@thumbdesk.com from the address on your account. We answer within 30 days. Using these rights is free, and we make no automated decisions with legal effects on you.

10. Children

Thumbdesk is not directed at children, and you must be at least 16 to use it. App store age ratings are separate distribution labels and do not change that. If you believe a child has created an account, write to support@thumbdesk.com and we will delete it.

11. Security

In transit: TLS 1.2 or later to our backend; DTLS on WebRTC, with each side’s certificate fingerprint bound into a handshake signed with the Ed25519 keys pinned when you paired.
At rest: database backups are encrypted. On each host, the agent’s private key and long-lived token live in the OS keychain (macOS Keychain, Windows Credential Manager, Linux Secret Service), with a file readable only by its owner on headless Linux machines without a keyring.
On your phone: keys and tokens are kept in the platform’s secure storage, and the app can lock behind Face ID, Touch ID or your fingerprint.
Sessions: access tokens last 15 minutes and are bound to your device id; refresh tokens rotate on every use.

If a breach affects your personal data, we will notify the supervisory authority and, where the law requires it, you, without undue delay. Report security issues to support@thumbdesk.com.

12. Subscriptions and payments

Thumbdesk Pro and Lifetime are sold only as in-app purchases through the Apple App Store and Google Play. Apple or Google handles your payment details, billing address and tax; we never see them. Through RevenueCat we receive only the subscriber id, the product and entitlement, the expiry or renewal date, and the cancellation, refund and grace period state. Refunds follow Apple’s and Google’s policies: we can confirm that one happened, but we cannot issue one ourselves.

13. Website and app analytics

Website analytics

We use self-hosted Minilytics and a first-party page counter to understand how people use thumbdesk.com. They record page views, referring sites and campaign tags, browser and device details, approximate location, language and time. Minilytics also measures time on page and outbound link clicks. The counters run in cookieless mode and use visitor codes derived with rotating daily keys rather than storing IP addresses in analytics records. We do not use advertising pixels or session recordings, and fonts are served from our own site.

Logs

The web server keeps short-lived request logs (IP address, URL, status, user agent) for security and debugging, which rotate out.

Cookies and local storage

Website analytics do not use persistent visitor-identification cookies. Your theme choice and any analytics opt-out preference are kept in your browser’s local storage.

In the app

The app sends feature-usage events to our backend to help us improve onboarding, pairing and other features. These include screen views, setup steps and purchase events, with timestamps, app version, platform and an app-generated identifier. Events may be linked to your account and device when you sign in. They describe actions such as opening a file or sending a command, without including file contents or command text.

We also use Expo services for app launch, error and performance diagnostics; usage events are mirrored to Expo Observe. The app does not include advertising SDKs or Google Analytics.

14. Deleting your account

Delete your account in the app at any time from Settings → Account → Delete Account. You confirm it with a code we email you. Deletion unpairs every host, revokes every device, removes your push tokens, scrubs personal data from your audit-log entries and removes your account record, leaving only the deletion record described in section 6. To remove the agent from a machine as well, run thumbdesk uninstall on it, which also deletes its local state and keys. If you cannot use the app, email support@thumbdesk.com from the address on the account and we will delete it within 30 days.

To end a paid subscription, also cancel it in your Apple ID or Google Play settings. Account deletion does not cancel store billing.

15. Changes to this policy

The effective date at the top changes whenever this policy does; the first version took effect on 7 May 2026. Before a material change takes effect we will tell account holders by email and in the app. The Terms of Service are versioned the same way.

16. Contact

Privacy questions, data requests, deletion and security reports: support@thumbdesk.com.