Your phone becomes the mouse for your Mac.
Dusty Desk runs a small server on your own Mac. Open a key-gated link on your phone and the phone is the trackpad, the keyboard and the dictation mic for that Mac — from the couch, the car, or another country. There is no Dusty Desk account, because there is no Dusty Desk server. Your Mac is the server.
There is no download button on this page, and that is deliberate.
The app is real. It runs every day on the machine it was built on. What does not exist yet is a signed copy of it that is safe to hand to a stranger — and a download button that hands you an unverifiable app is worse than no button at all. Two specific things stand between this page and a real file:
- No Apple Developer ID certificate exists yet. Today the app can only be ad-hoc signed — an identity that means something on the Mac that built it and nothing anywhere else. An ad-hoc signature also cannot be notarized by Apple, so every other Mac that downloaded it would treat it as unverified software. That certificate can only be created in the owner's own keychain; nobody else can do it for him.
- Nothing has been published or hosted. An installer can be built on the owner's own machine — but every copy of it today is ad-hoc signed, which macOS's own Gatekeeper check rejects outright, so none of them is a file we would hand to a stranger. There is no download URL here, not a broken one and not a placeholder one. When there is a file worth publishing it will appear on this page with its version, its size and its SHA-256 printed beside it.
support@dustydesk.io,
hello@dustydesk.io, or the existing marcos@marcossmercado.com.
Nothing is published here until one of them actually exists and is read by a human.
In the meantime, everything below is true of the software as it stands today, so that when the file does land you already know exactly what your Mac is agreeing to.
One install. Your phone drives; your Mac stays yours.
Plain description, no adjectives borrowed from the future. This is the feature set that exists in the code today.
The phone is the trackpad
One finger moves the pointer, tap is a left click, press-and-hold grips so you can drag, two fingers scroll or right-click, pinch zooms, three fingers hit Mission Control. A drag-lock button latches a drag when your thumb needs a rest.
And the keyboard
A keys bar rides above the iOS keyboard: type and send to the Mac, arrow keys, ⌘ combos. Dictation is there too — your phone browser's own speech engine hands over the finished text.
Ghost view
A secret knock on the trackpad fades in a translucent still of your Mac's screen so you can see what you're clicking. These are throttled stills — a couple of frames a second, not a smooth video stream. The same knock hides it again.
You hold the key
Your Mac generates its own pairing key and puts it in the link. You can rotate that key whenever you like, which instantly kills every link you ever sent. There is no master key and no account to lock you out of.
The screen-view upgrade
Above the base tier there is a paid upgrade — Dusty Desktop View — which replaces the ghost stills with a live screen you can actually work in: full view and control, gesture ring, two-way clipboard, desktop notifications pushed to your phone, and a text-cleanup helper that runs against a local model on your own Mac. It also carries Quick Share, where a guest you invite can look through your screen from a throwaway link and — only if you say so — take the wheel with you.
The ruling that had been blocking pricing landed on 26 August 2026: the upgrade is a one-time purchase with optional annual updates, never a subscription. Prices, the trial and the licence model are on the pricing page. No payment is accepted anywhere today — there is no store and no build to sell.
Things people assume are here, that are not
- ✕There is no AI that reads your notifications and summarises them into tasks. That is designed and described elsewhere; it is not built. Nothing on this page depends on it.
- ✕Windows and Linux are not supported for screen sharing or control. The helper agent will run there, connect, and say so plainly rather than send a fake picture.
- ✕There is no auto-update channel. Nothing checks for a new version, which also means nothing pings anybody when you launch it.
- ✕There is no remote kill switch. Once a copy is on your Mac, it is on your Mac.
What your Mac needs — including the one people won't expect.
Read the amber row first. It is the single biggest difference between Dusty Desk and a normal Mac app, and hiding it until after the download would be a cheap trick.
Dusty Desk is a plain Node server. That is the whole architecture, and it is why
there are no npm packages to audit and no framework in the middle — but it means
Node has to already be installed on your Mac. The app's launcher looks for
node on your PATH and does not carry a copy of its own. Without it
the app will open, write a line into ~/Library/Logs/Raton/, and the
link on your phone will simply never answer.
Check before you start. In Terminal:
node --versionA version number back means you're set. command not found means install it from nodejs.org first. Node.js 20 or newer is the floor the product's own helper states.
OwnerBundling a Node runtime inside the .app would remove this prerequisite completely and is the largest remaining install-friction decision. Nothing in the source does it today, so this page states the requirement rather than assuming a fix.lipo -archs on the prebuilt binaries reports both
arm64 and x86_64. The part still unproven in a shipped bundle is the
Node runtime embedded next to them: the release script only warns when that one
is thin, and a thin Node un-universals the whole app. It reports both slices in the build
sitting on the owner's machine today, but that is not a published release — re-run
lipo -archs on the bundled node in whatever actually ships before
this row loses its caveat.xcrun swiftc — which needs the Xcode Command Line Tools that
most people do not have.
OwnerConfirm the released
bundle actually contains the prebuilt universal helpers before publishing a download. The
fallback path must never fire on a customer's Mac.localhost:11434. Skip it and
everything else works; that one button just has nothing to call. No commercial AI provider
appears anywhere in the source.Three scary-looking dialogs, explained before you meet them.
Remote-control software asks for serious permissions, and it should. Here is every prompt you will see, in order, in the words macOS uses — plus what actually happens if you refuse.
Gatekeeper refuses to open it
This warning is correct, and you should take it seriously. While the app is unsigned it means precisely what it says: nobody has verified this software, and macOS has no way to tell whether the file you downloaded is the file that was published. Do not click past it out of habit — click past it because you decided to.
What to do. Depending on your version of macOS you'll take one of two paths: open System Settings ▸ Privacy & Security, scroll to the Security section, and use the Open Anyway button that appears there after the first blocked attempt — or, on older versions, Control-click the app in Finder and choose Open. Verify the checksum first; that is what the next section is for.
Ratón.app, so that is the
name macOS would put in these dialogs — but the brand ruling puts Dusty Desk on every
surface, apps included. The dialog wording on this page assumes the branded name. Pick one and
make the bundle agree.
Screen Recording
Why a remote-control app needs it. To send you a picture of your Mac, something has to be allowed to take that picture. macOS treats screen capture as a top-tier privacy permission — the same one a screen-recording or video-call app needs — so it is granted by you, to this app, by name, and it is revocable in the same place at any time.
What it covers: the ghost-view stills in the base tier, and the live screen in the Dusty Desktop View upgrade. Capture is switched off whenever nobody is actually watching, and no frame is ever written to disk — the picture lives in memory only long enough to be sent.
Accessibility
Why a remote-control app needs it. This is the permission that lets software move your pointer and press your keys. It is the same door every automation and assistive tool on macOS uses, and it is genuinely powerful — which is exactly why macOS makes you hand it over deliberately, per app, in System Settings rather than from inside the app.
Without it there is no clicking, no typing, no dragging, no scrolling: the phone is a viewer and nothing more.
Two details that will save you a confused half hour
- ·macOS grants these to whatever launched the app — the Dusty Desk app itself if you double-click it, or Terminal if you started it from a command line. If you granted it to the wrong thing, that is why nothing works. Quit and relaunch from the app.
- ·Neither permission can be granted remotely. Not by your phone, not by a person helping you, not by this page. macOS asks the human sitting at the keyboard, on purpose.
And one thing about the link itself
Worth knowing before you decide, because remote-control software deserves a straight answer: the link that reaches your Mac is not all one thing. On your own Wi-Fi the standard link is plain HTTP on your local network. From outside the house the connection currently rides a Cloudflare quick tunnel, which means TLS terminates at Cloudflare's edge — Cloudflare is technically positioned in the middle of that session. Your pairing key travels in the URL.
OwnerThe permanent connection architecture is an open ruling (quick tunnels vs. a named tunnel on a real domain vs. Tailscale). This paragraph must be rewritten the moment it is decided, and the privacy policy says the same about its own transport section. Also owed: sign-off on the exact public wording of the "never phones home" pledge now that phone-browser dictation ships.Verify the file before you open it.
Every release will publish the SHA-256 fingerprint of the exact bytes it hands you, right here on this page, next to the download. Ten seconds, and worth it.
Once you have the file, run this in Terminal in the folder you downloaded it to:
shasum -a 256 DustyDesk.dmgIt prints a long string and then the filename. That string should match the published one character for character. If it doesn't — or if the command prints nothing — delete the file and don't open it.
OwnerPublished SHA-256 goes here, verbatim, one per released file, alongside the exact filename this command should be run against. Until a build exists this stays a placeholder — a checksum box with nothing to compare against is theatre, and this page would rather show a gap.Straight talk about what this proves. A checksum proves the file arrived unchanged from where it was published. It does not prove the software is harmless, and — while the app is unsigned — it is a weaker check than it looks, because the checksum and the download come from the same website. Anyone who could tamper with one could tamper with the other. The check that actually closes that gap is Apple notarization, which is exactly what the status section above says is still missing.
You're not installing this. Here's what you'd actually be agreeing to.
If a friend, a relative or your IT person sent you a Dusty Desk help link, this part is for you. Si alguien te mandó un enlace de ayuda, esta parte es para ti.
What happens, start to finish
You open the link they sent. It shows you who is asking, what the link allows, and a countdown — these links are short-lived and single-use on purpose. You copy two lines into Terminal: the first downloads one plain file, the second runs it. Nothing starts until you type yes. When you're done you press Control-C or just close the window, and it stops that same second — nothing keeps running in the background and no access survives: a help session never writes a credential to your disk, and the one it was given is revoked when the session ends.
Being precise about "nothing behind", because it is not quite nothing: the agent
creates a folder ~/.dustydesk/agent/ on your computer for the screen
helper it downloads and builds, plus a small marker file recording that macOS was asked for
permission. Those files stay after the session — they are inert, they hold no key and no access,
and you can delete that folder whenever you like.
While a session is live, a small banner sits at the top of your screen so you always know
someone is looking, and it disappears when the session ends. One honest caveat: that banner is
drawn by the pointer overlay, so if the overlay was switched off with
--no-ghost, or could not be built on your computer, the agent says so
in the Terminal window and there is no banner — the Terminal window itself is then the only
live indicator.
While it runs, they can
- ✓See your screen, live, for as long as it runs
- ✓Move your mouse and type on your keyboard — only if the link they sent allows it
- ✓Show a ghost arrow to point at things, which cannot click
They can never
- ✕Open, read, or copy your files
- ✕Turn on your microphone or camera
- ✕Read your clipboard or your passwords
- ✕Install software on your computer, or leave anything running afterwards (the agent does leave one inert folder behind — see above)
- ✕Come back after you stop it
Read it before you run it — and check it's the file you read
The thing you download is one plain file with no dependencies, meant to be opened and read before it is run. The link page gives you a fingerprint of the exact bytes it is about to hand you, so you can confirm the file that landed is the file you read:
shasum -a 256 dd-agent.mjsOn Windows the same check is Get-FileHash dd-agent.mjs -Algorithm
SHA256 in PowerShell. Same characters start to end? Then you're running what you read.
Different, or nothing printed? Don't run it — delete it and ask for a fresh link.
Your Mac will ask you, not them
Screen Recording — so the screen can be sent at all. Refuse it and they see nothing; the agent says so plainly rather than pretending.
Accessibility — so the mouse and keyboard can be driven. Refuse it and the session simply stays view-only; everything else keeps working. On a view-only link this is never even asked.
Both live in System Settings ▸ Privacy & Security. macOS grants them to the app that launched the agent — usually Terminal — so you may need to quit and reopen Terminal after ticking the box. Your helper cannot grant any of this from their side, and neither can this page.
Which computers this works on
Full screen sharing and control work on macOS today. On Windows and Linux the agent connects and reports honestly that screen sharing is not available on that platform yet. It will not pretend, and it will never send a fake picture.
It needs Node.js 20 or newer on the computer being helped, too. Run
node --version to check.
Dusty Desk will never ask you for a password, a code, or a payment on a help page. Nunca te pediremos una contraseña ni un pago.
Where the policies are — and honestly, where they aren't.
Software that watches a screen and moves a mouse sits in the most sensitive category there is. The documents below are written and evidence-checked against the source code — but they are drafts carrying no effective date, and none of them is in force yet. Read them anyway; they are unusually specific about what this software does.
security.txt yet.site/ and every link above resolves. The one
thing still missing is a monitored security address and a
/.well-known/security.txt — the support page's disclosure section names neither,
on purpose, because a machine-read file pointing at a mailbox that does not exist is worse than
an absent one. Create the mailbox, then fill both in.
OwnerEvery policy page here is a draft: none carries
an effective date, none has been reviewed by a lawyer,
and still hold open decisions the code cannot answer: legal entity and seller of record, governing
law and venue, contact addresses for legal notices, retention periods, refund window, and EU/UK
checkout wording. Nothing should accept a payment until that pack is attorney-reviewed.
What is verifiable today, stated narrowly
- ·No analytics, telemetry, crash reporting, update ping or third-party script appears anywhere in the product's source, or on this website. That is an absence you can check by reading it, not a promise.
- ·Screen frames are never written to disk. The capture helper encodes in memory and its only output is a byte stream; there is no file-writing code anywhere in the capture path.
- ·The AI is local. The only model endpoints in the whole product are on your own machine, and no commercial AI provider appears in the source. Being precise: that endpoint is configurable, so it is local by default rather than local by construction.
- ·Dictation is your phone's speech engine, not ours. The product never captures or transmits audio itself — only the finished text. Whether your phone processes that speech on-device or uploads it to Apple or Google depends on your browser and your phone's settings, and is not something Dusty Desk can see or control.
- ·Some things are kept, and the policy says which. Licence records, upgrade requests, bug notes you type, and an append-only session ledger all live in plain files on your own Mac. Several of them have no automatic clean-up. The privacy policy is the place that enumerates them.
Our focus is supercharging your remote productivity.
Dusty Desk keeps your own computer reachable and working while you're away from it. It's a local-first tool for you and the people you invite — not a place your data lives. You hold the key; you decide who gets in; you can pull the plug any time.