Privacy Policy

What RemoScreen collects, why, how long we keep it, and what we never see.

Effective 3 November 2026

In short

The picture of a screen, keyboard and mouse input, chat, clipboard text, files and audio go directly between the two devices in a session, encrypted. Our servers do not receive or store them.
We keep what we need to run the service: your email address, your desks, the desks you save, and a history of sessions (which desks connected, when and for how long).
The Free plan shows ads that we sell directly. We use no ad networks, we do not track you across other apps or websites, and we never sell your data.
You can delete your account and its data at any time.

Who we are

RemoScreen is a remote support service: the web console at app.remoscreen.com, our website, and the RemoScreen desktop and mobile apps. It is run by HONCO PRIVATE LIMITED, 3/31, Chitrakoot, Gandhi Path, Vaishali Nagar, Jaipur, Rajasthan 302021, India (“we”, “us”).

For the personal data described here, we are the Data Fiduciary under India’s Digital Personal Data Protection Act, 2023. Questions about privacy: [email protected].

What we collect and why

Email address

What: The address you sign in with.
Why: To sign you in with a one-time code, to send account emails (sign-in and deletion codes), and as the contact for your billing.
Kept: Until you delete your account.

Account details

What: A random account ID, when the account was created and last signed in, your plan, its status and seats, and when you accepted the Free plan’s ad terms.
Why: To run your account and give it the features of its plan.
Kept: Until you delete your account.

Desks (your devices)

What: For each app or browser you use: a random device ID, its nine-digit desk ID, its name (by default the computer’s name, or a browser name such as “Chrome on Windows”), its platform, the features it supports, whether unattended access is on, and when it was created and last seen. The apps also report their version, the operating system and its version, the processor architecture, and whether the app came from our download page, Google Play or the App Store.
Why: So people can reach your desk by its ID, to list your devices in your account, and to tell an app when it needs an update.
Kept: Until you delete your account, or automatically once unused: a browser after 7 days, an app used in a session after 365 days, others after 24 hours to 7 days.

Wake-on-LAN (if you turn it on)

What: For a desktop desk with “Allow Wake-on-LAN for this desk” on: the hardware (MAC) addresses of the network adapters it uses, its local network (such as 192.168.1.0/24), and a one-way keyed fingerprint of the public IP address it last connected from, never the address itself.
Why: To send the wake signal through another of your desks on the same network.
Kept: Until you turn it off, or the desk is signed out or removed, or you delete your account.

Session history

What: For each session: the two desks’ IDs and names, when it was requested, accepted, connected and ended, whether it was attended or unattended, the permissions asked for and given (such as view, control or files), and who ended it and why.
Why: To show both sides their History, to apply plan and abuse limits, and to look into reports of misuse.
Kept: 30 days after the session ends, or 365 days if either side has a paid plan; at most 200 sessions per desk, oldest first.

Requests to an offline desk

What: When someone asks to connect to one of your desks while it is offline: when, their desk’s name and nine-digit desk ID, and whether they asked for unattended access. We email you about it (at most once per desk every 30 minutes) unless you turn that off in your Profile; the email names their desk ID, not their desk’s name.
Why: So you know someone tried to reach your desk; a desk with an up-to-date RemoScreen app, or the web console, also shows it when it is back online. When the other desk is deleted, its name and ID are taken out of these records.
Kept: Until you dismiss them on the desk, and at most 7 days; at most the last 20 per desk.

Two-step sign-in

What: If you turn it on: the secret your authenticator app shares with us, stored encrypted, the time it was turned on, the last code used, and your unused recovery codes, stored only as keyed hashes.
Why: To check the code from your authenticator app, or a recovery code, when you sign in.
Kept: Until you turn two-step sign-in off or delete your account.

Saved desks

What: The desk IDs and names you save in your list of devices.
Why: So you can connect again quickly.
Kept: Until you remove them, or their desk or your account is deleted.

Billing

What: Your plan, billing interval and seats, the Razorpay subscription ID and status, and the dates of the current period and next charge. Invoices are fetched from Razorpay when you open Billing.
Why: To turn a paid plan on and off and to show you your billing.
Kept: While your account exists (a replaced subscription’s ID up to 400 days). Payment and invoice records as Indian tax law requires.

Suspensions and blocks

What: If we suspend an account or block a desk to stop misuse or protect others: when it was done, which RemoScreen administrator did it, and the reason they gave.
Why: To enforce our Terms, stop abuse, and answer questions about it.
Kept: While the account stays suspended or the desk blocked, and until the account or desk is deleted. The action itself stays in the admin log.

Admin log

What: A record of each change a RemoScreen administrator makes in our operator panel: who acted, when, on which account, desk, session, ad or setting, and why. It can include your account ID, email address or desk ID.
Why: So every action taken on your account or data can be traced and explained.
Kept: The newest 10,000 entries; older entries are removed first.

Ad counts (Free plan)

What: How many times each ad was shown and clicked, per day, as totals per ad. They are not linked to you.
Why: To know how ads perform and to report it to advertisers.
Kept: 400 days.

Protection against abuse

What: Your IP address, and the email address a sign-in code is asked for, in counters that limit how often codes, new desks and connection requests can be asked for.
Why: To stop spam, guessing and floods of requests.
Kept: In memory only, never written to our database; dropped once the limit no longer applies (usually within an hour) or when the service restarts.

Messages to us

What: What you write to us by email, and our replies.
Why: To answer you and keep a record of what was asked and done.
Kept: As long as needed to help you and to keep that record.

Sign-in codes are kept only as a keyed hash, in memory, for at most 10 minutes. Device and sign-in tokens are stored only as hashes, never as themselves.

What we don’t collect

Session content. The picture of a screen, keyboard and mouse input, chat messages, clipboard text, files and audio travel directly between the two devices over an encrypted WebRTC connection (DTLS-SRTP for video and audio, DTLS for everything else). Our service only helps the two devices find each other and never receives this content. We do not record sessions.

No relay. RemoScreen does not run a relay (TURN) server today, so session content does not pass through our servers at all. If we add a relay later, it will forward the same encrypted traffic without being able to read it, and we will update this policy.

Unattended access secrets. An unattended password is stored only on the host computer, as a salted hash. Trusted-device keys stay on the devices. Neither is sent to our service.

Nothing else from your device. We do not collect your location, contacts, photos or advertising ID. The apps and the web console contain no third-party analytics, crash-reporting or advertising code.

What the other side of a session sees

When you ask to connect to a desk, its owner sees your desk name and desk ID, never your email address, and decides whether to accept and what to allow. Attended sessions always need that approval. Unattended access works only on a computer whose owner turned it on in the desktop app and set a password or trusted a device.

To connect directly, the two devices exchange their network (IP) addresses once a request is accepted, so the device at the other end can learn your IP address. To find its own public address, your device also asks a STUN server run by Cloudflare.

Both sides see the session in their History, with the other desk’s name and ID.

Ads on the Free plan

The Free plan is paid for by ads: a banner at the top of the console and apps, and a 10-second ad every 5 minutes while you control another computer. You accept these ad terms once, before your first session, and we record when.

We sell ads directly to sponsors. The ad images and videos come from our own server. We do not use ad networks, we do not track you across other apps or websites, and ads are not chosen by who you are: every free user can be shown the same ads. We count only how often each ad is shown and clicked, per day, as totals.

If you click an ad, the advertiser’s website opens in your browser, and that site’s own privacy policy applies there. Paid plans have no ads.

Payments

Paid plans are billed in Indian rupees through Razorpay. You enter your card, UPI or bank details in Razorpay’s checkout, which Razorpay serves itself; RemoScreen never receives or stores them. We give Razorpay your email address (for receipts and invoices), your account ID and the plan you chose, and Razorpay tells us when a payment succeeds or fails. Razorpay handles payment data under its own privacy policy and Indian law.

Where your data is stored

Our service and its database run on servers we operate ourselves. Cloudflare and our other providers run their own networks and may process data outside India, as the law allows.

How long we keep data

Account and email: until you delete your account.
Desks: until you delete your account, or automatically after a period without use (24 hours to 365 days, as listed above).
Session history: 30 days after a session ends, or 365 days if either side has a paid plan; at most 200 sessions per desk.
Ad counts: 400 days, as totals per ad.
Suspensions and blocks: while they last, and until the account or desk is deleted.
Admin log: the newest 10,000 entries.
Billing: Razorpay keeps its payment records and invoices; we keep the billing records Indian tax law requires, for as long as it requires them.
Rate limits: in memory only, usually for under an hour.
Backups: we back up our database before updating the service and keep a limited number of recent backups (currently the 20 newest). Deleted data can remain in a backup until that backup is replaced. We do not use backups to bring back deleted accounts.

When you delete your account, Delete your account lists exactly what is removed and what is kept.

Security

The apps and the web console talk to our service only over HTTPS (TLS). Session content is encrypted between the two devices by WebRTC.
Device and sign-in tokens are stored only as SHA-256 hashes; sign-in codes only as a keyed hash in memory, for 10 minutes.
A desk shares its screen only after its owner accepts, and either side can end a session at any time. Unattended access stays off until the owner turns it on in the desktop app on that computer.
The web console’s sign-in cookie is HttpOnly and Secure, so page scripts cannot read it.
Only a few RemoScreen administrators can open our operator panel, and only to run the service, support users, handle billing, investigate abuse or answer a lawful request. The panel never shows session content, sign-in codes, tokens or IP addresses, and every change made in it is logged with the administrator’s name and reason.

No system is perfectly secure. If a breach affects your personal data, we will tell you and the Data Protection Board of India as the law requires.

Cookies and storage on your device

Sign-in cookie. When you sign in to the web console, our API sets one cookie, rs_account, that keeps you signed in. It lasts until 30 days after you last use it, and at most 180 days after you sign in. For an admin account it lasts until 30 minutes after you last use it, at most 12 hours, and ends when you close the browser.

Signed-in hint. While you are signed in to the web console, it also sets rs_signed_in=1 on remoscreen.com for 30 days, so our home page can take you straight to your console. It holds no account or secret, and is removed when you sign out.

Browser storage. The web console keeps its desk identity in the tab’s session storage, which is cleared when the tab closes, and remembers your connection setting in local storage. The apps keep their credentials in the device’s secure storage.

We use no analytics or advertising cookies. Cloudflare may set a cookie it needs to protect the site from automated attacks, and Razorpay’s checkout sets its own cookies on the billing page.

Your rights

Under India’s Digital Personal Data Protection Act, 2023 you can:

Access your data: your account settings show your email, desks and History, and we will send you a summary of the personal data we hold about you if you ask.
Correct it: rename your desks and edit your saved desks in the app. To change the email address of an account, write to us.
Erase it: delete your account in the app or console, or ask us by email.
Withdraw consent: delete your account. The Free plan’s ad terms come with that plan, so to withdraw them, move to a paid plan or delete your account. Withdrawing consent does not affect what was done before.
Nominate someone to use these rights for you if you die or cannot act yourself.
Raise a grievance with us, and then, if you are not satisfied, with the Data Protection Board of India.

Write to [email protected] from your account’s email address so we can confirm it is you.

Children

RemoScreen is not meant for children. You must be at least 18 years old to create an account or use RemoScreen. We do not knowingly collect personal data of anyone under 18; if we learn that an account belongs to a child, we delete it. A parent or guardian who believes their child has an account can write to us.

Changes to this policy

We will post any change on this page with a new effective date. If a change matters for how we use your data, we will tell you by email or in the app before it applies.

Contact and grievances

For privacy questions, requests and grievances, write to our Grievance Officer at [email protected]. We acknowledge a grievance within 24 hours and resolve it within 15 days.

HONCO PRIVATE LIMITED3/31, Chitrakoot, Gandhi PathVaishali Nagar, JaipurRajasthan 302021, India[email protected]