Privacy policy
What the relay stores, what it can never see, and where the rest lives.
Last updated: September 2026
The relay is designed so that the sensitive parts of remote control never reach it in readable form. Commands, screen frames, keystrokes and device details are sealed on your phone and opened only on your PC (end-to-end encryption). The relay forwards those sealed bytes; it holds no key.
- A hashed workspace id (derived from your token; the token itself is never stored) and its short code
PCR-XXXXXXXX - Plan status: trial start and end, Pro source and expiry
- Purchase references from the payment provider (order id, plan, amount, currency) and the UPI reference you type when you press "I have paid"
- An admin audit trail for that workspace (activations, refunds, notes)
- Connection metadata used for rate limits and brute-force lockout (source address, counts) — kept in memory only
- Your screen
- Keystrokes and mouse movement
- Command arguments and results (app names, volume levels, URLs, typed text)
- Clipboard text in either direction
- PC names, installed apps, MAC addresses, battery, what is playing, timers
- The secret half of your token
On your phone
The app keeps its state in your browser's local storage: the token, your PIN (as a hash), theme and language, device aliases, quick actions and a cached list of your PCs. Nothing of that is sent to us. There are no analytics, no tracking pixels and no cookies. A service worker caches the app shell so it opens offline.
Location (optional "When I leave home")
Your location stays on your phone. On Android, if you turn on "When I leave home", your home point is saved only on the phone and the phone itself notices when you leave; we never receive your location, and it is never sent to the relay or anyone else. On iPhone, the automation runs in Apple's Shortcuts app and Longarm does not use location at all. Voice commands (Siri) run on your phone and only send the same encrypted command a tap would.
On your PC
The agent lives in a single folder in your user profile and connects outbound to the relay only. It runs a fixed list of actions and never an arbitrary shell command. It checks the relay for updates about once every six hours.
Payments
Card payments are handled entirely by the payment provider (for example Razorpay or Stripe) under their own privacy policies. We receive a reference and the amount, never your card details. UPI payments are matched manually by the operator using the reference you provide.
Support messages
If you write to us over WhatsApp or email, that conversation is handled by those services under their terms. Include only what is needed — usually your workspace code, never your token.