Privacy Policy

Section 01Your Mac is the server

When you run Dusty Desk, your Mac runs the whole product: the web server your phone talks to, the screen-capture helper, the input helper, the licence records, the AI text cleanup. Your phone connects to your Mac. It does not connect to us.

We have no backend that your screen, keystrokes, clipboard, voice, photos, files or usage could ever reach. That is not a promise about how carefully we guard a database — it is a statement about architecture. There is no database. This policy will never have a section called "how we protect data on our servers," because there are none.

The flip side is worth saying in the same breath: because we cannot see your install, we also cannot fix it from here, cannot recover a lost key for you, and cannot delete anything on your behalf. Your data is genuinely yours, including the parts that are inconvenient.

Section 02What the software stores — all of it on your Mac

Everything below lives in the app's own data folders on your Mac, in plain JSON or text files you can open and read yourself. Nothing here is uploaded anywhere.

On your phone

The native app saves your last-used link so you can reconnect — and that link contains your key, so treat the phone like a key ring. In plain Safari, nothing keyed is stored by the app.

On a computer that runs the agent — a Fleet member, or someone you helped

Joining a computer to your Fleet permanently writes a small credential file in that computer's home folder (owner-read-only) holding its agent id and its access token in plain text. A one-off support session does not write that file — it keeps the token in memory only and clears out any credential left over from an earlier run, so no access survives the session.

Both kinds of run do leave a folder behind, and it is only fair to the person on the other end to say so: the agent creates its own directory in that computer's home folder for the screen helper it downloads and builds, plus a marker file recording that macOS was asked for permission. Those files are inert — no key, no token, no access — but they stay until somebody deletes them.

What is never written down

• Screen frames. The live frame is a single memory buffer, overwritten on every capture tick and pushed straight to whoever is watching. The capture helper encodes the image in memory and its only output is a byte stream — it contains no file-writing and no networking code at all. Not one image byte is written to disk anywhere in the product.
• Lens photos. Read into memory, handed to the companion service on the same Mac, and dropped. No write path touches them.
• Clipboard text, in either direction.
• Guest presence — names, cursors, laser pointers, reactions, doodles.
• Relayed desktop notifications — held in a memory ring of the last 40, gone when the server restarts.
• IP addresses. A coarse source is derived for one purpose only — as a bucket key for rate-limiting the unauthenticated front door — and it lives in memory. No IP address reaches any file.

Section 03What travels over the network

Between your phone and your Mac, in normal use:

• Phone → Mac: touch and mouse input, typed text, voice-dictation transcripts, clipboard text you push, and — if you use Lens — photos from your phone's rear camera.
• Mac → phone: screen images, clipboard text you pull, and relayed desktop notifications. A relayed notification carries the title, the body text, and the name of the app that sent it — not just the title. Notification bodies routinely contain message previews, so think of enabling them as forwarding your notification centre to your phone, because that is what it is.
• On the owner's admin pages only: licence details, including the names, emails and keys of anyone you have issued a licence to.

Screen content travels in the base tier too. Ghost View — the translucent live view of your Mac behind the trackpad — sends real screenshots of your desktop to your phone, and it is part of the base tier, not the Desktop View upgrade. If you use the trackpad on a remote link, your screen is on that link.

Two behaviours worth knowing because they work in your favour: screen capture switches off the moment nobody is watching, and when a phone's connection drops the Mac is told to release every key and button, so a stuck input cannot survive a dropped connection.

Section 04Connections and encryption — the honest part

Three kinds of link exist today, and they are not equally private. This is the section most products would blur. We would rather you could pick.

1. Same-Wi-Fi standard links are plain HTTP — not encrypted on your local network. Fine on a network you trust; use one of the other two if you do not.
2. Same-Wi-Fi TLS links use a certificate your Mac generates for itself. You approve it once on your phone; after that, traffic across your local network is encrypted.
3. Remote links ride a Cloudflare "quick tunnel" that your own Mac starts. Your phone's connection to Cloudflare is encrypted — but that encryption terminates at Cloudflare's edge, and the last leg from the tunnel client to your Mac's own server is plain HTTP on the Mac's loopback interface.

In plain terms: on a remote session, Cloudflare's infrastructure is positioned to read the session — screen images, your input, typed text, dictation transcripts, clipboard text in both directions, notification titles and bodies, Lens photos, and the key sitting in the URL. We do not know that Cloudflare does read any of it, and their own policies govern their network. What we will not do is claim end-to-end encryption for remote links, because it would not be true.

These tunnel addresses are also temporary: they change whenever the tunnel process restarts.

What we intend to do about it. Riding a stranger's free quick tunnel is a starting position, not a destination, and we are not going to describe it as a design. The accepted fix is a permanent address of our own — either a named tunnel on dustydesk.io or a private Tailscale network between your devices — and it has been on the record as the fix since 2026-07-19. Which of the two wins was ruled once, re-opened, and is still open, so it is marked below as a decision rather than dressed up as a roadmap with a date on it. Two things we will commit to now. A private-network answer would take the third party out of the path entirely, rather than renaming it, and that is the reason it is on the table at all. And whichever way it lands, this section gets rewritten to describe the new path as bluntly as it describes this one — including any leg that still is not end-to-end encrypted. Until then: if a session would be damaging for a third party to observe, use one of the two same-Wi-Fi links instead of a remote one.

Wake-on-LAN, if you use it, broadcasts a wake packet containing the target machine's hardware address on your local network only. It never leaves your subnet.

Tailscale, if you happen to run it, is detected — the product notices a private network address and tells you about it. Dusty Desk never installs it and does not require it.

Section 05The third parties involved

1. Cloudflare — remote-link transit, exactly as described in Section 4. This is the only third party that is genuinely in the path of your session data.
2. Apple iMessage — owner alerts. If (and only if) you type your own phone number into Settings, your Mac's own Messages app texts you when something happens worth knowing about — for example when someone claims a licence. The number is empty by default, so a fresh install texts nobody, and there is an on/off switch next to it. Two honest details: these alerts can contain a licensee's name and email address, and every alert appends your own keyed settings link. They travel Apple's iMessage service and stay in your Messages history afterwards.
3. Your phone's speech engine — voice dictation uses the speech recognition built into your phone's browser and operating system. Depending on your browser, device and settings, that audio may be processed on the device or sent to the browser or OS vendor's servers. We cannot see which, and we cannot control it. Dusty Desk itself never captures or transmits audio — only the finished text transcript reaches your Mac.
4. DuckDuckGo, indirectly and only if you ask for it. A voice command like "go to" followed by words that are not a web address is turned into a DuckDuckGo search link and handed to your Mac's own default browser, which is what makes the request. Dusty Desk's own server never contacts DuckDuckGo.

That is the whole list. No analytics providers, no advertising networks, no content delivery networks, no cloud AI, no crash reporter, no update service, no fonts loaded from anyone else's server. This site has no third-party scripts on it either.

Not third parties, despite looking like them: the QR codes are drawn locally by macOS itself. The local AI and the companion service that handles Lens photos are separate software running on the same Mac, reachable only over your machine's own loopback interface — they are not network services and nothing about them leaves your computer.

Section 06AI features stay on your machine

Grammar cleanup and text polish — tidying up a dictated sentence before it lands on your Mac — are done by AI software running on your own machine, by default a local model server at a loopback address. It is a hard product rule that we do not intend to break: no paid or metered cloud AI API, ever.

Two pieces of honesty about that:

• Local by default, not by construction. The AI endpoint is configurable through an environment variable. If you deliberately point it at another machine, your text goes to that machine. Nothing in the code prevents that, so we describe it as "the configured local endpoint" rather than an absolute.
• The Fleet task summariser does not exist yet. Earlier drafts of this policy and some copy on our own landing page describe Dusty Desk reading a notification and handing you a plain-language summary of it. That feature has not been built. When it ships it will run under the same local-only rule, and this paragraph will change.

Lens photos. Photos you take with the Lens feature are sent from your phone to your Mac over whichever link you are using — which, on a remote session, means through the Cloudflare tunnel like everything else — and then handed to a companion service running on the same Mac. That handoff never leaves your machine, and Dusty Desk never writes the photos down.

Section 07Quick Share guests

Quick Share lets someone look at — and, if you allow it, help drive — your screen through a throwaway link.

• Nobody sees your screen until you tap Admit. A guest who opens the link is knocking. They receive no frames at all until you let them in.
• Links last between 5 minutes and 12 hours, can require a passphrase (stored only as a hash), can be single-use, and can be revoked with one tap. Revoking kicks the guest instantly; an expiring link ejects them mid-session.
• A guest can control your Mac only when every gate passes: they were admitted, the link allows control, shared control is switched on, and — unless you chose free-for-all — they are holding the baton. You can take the wheel back at any moment.
• The presence layer — names, cursors, laser pointers, reactions, doodles — is ephemeral: never written to disk, never entered in the session ledger, gone when the session ends.

If you are the guest: the name you choose and your cursor are visible to the host and to the other people in the session. Nothing about you is stored on the host's Mac afterwards.

If you are the host: admitting someone is a consent decision, and so is what is on your screen when you do it. Other people's information visible on your desktop becomes visible to your guest.

Section 08Fleet — many Macs, one owner

Each enrolled computer gets its own token, never your owner key. Tokens are stored only as hashes and travel in request headers, never in a URL. Enrolment uses a one-time code that expires in 15 minutes and is burned on use.

Access grants are default-deny: a computer can do nothing until you grant it something. The grants are also honest rather than flattering — a grant on a Mac where macOS has not given the app permission shows as "allowed by you, blocked by macOS," instead of a green light that means nothing.

The session ledger records metadata only, as described in Section 2. It identifies people by a hashed handle derived from their key — never the key, never a name or email — so the ledger stays free of personal information even though it is a permanent record. Names are matched to handles only in memory, only for display, and only for you.

Two limits worth stating: the ledger is tamper-evident, not tamper-proof — it will show you that it was altered, it cannot stop someone from altering it — and it is retained indefinitely, because no code path deletes it. It is yours, on your disk, and removing it is your call.

If other people use the Macs in your fleet — family, staff, a collaborator — any notice or consent the law requires before monitoring or remotely accessing their work is your obligation. The product will not ask on your behalf.

Section 09Remote support sessions — someone else's computer

There is one lane where the data flows the other way, and it deserves its own section because it is the opposite of everything above.

In a support session, another person's computer runs a small agent that dials out to your Mac and streams its screen to you, and optionally accepts your input, for a bounded session. Their computer needs no open port and no server of ours; your Mac is the meeting point. Screen sharing and control work only when their computer is a Mac today — a Windows or Linux machine can connect and enrol, but it reports that the feature is not available on its platform yet and never sends a frame.

What actually crosses the wire

This is the part that deserves naming item by item, because it is somebody else's computer.

• Their computer → your Mac: compressed images of their screen, capped at roughly half a megabyte each; a status line saying whether capture is working and why not if it is not; and heartbeats. Nothing else. The agent has no code that reads their files, their clipboard, their microphone or their camera, and the session grants it none of those.
• Your Mac → their computer: pointer movement, button presses and releases, clicks, scrolling, zoom, keyboard shortcuts, text you type, and a display-selection command — that is the complete list of verbs this lane will carry. Plus the position of your pointer, so it can be drawn on their screen while you move it.
• Deliberately not carried: a whole set of things the product does happily on your own Mac is refused outright the moment you are driving someone else's — clipboard sync in either direction, wake-on-LAN, AI text cleanup, and one input verb that the local engine still answers. They are refused loudly rather than quietly executed against the wrong machine, which is the failure mode that matters here.

What is kept

• Of their screen: nothing. Their frames are handled exactly like yours — a memory buffer, overwritten by the next frame, pushed to the viewer and gone. No image byte is written to a file at either end. There is no recording feature, and there is no hidden one.
• On your Mac, a session row: a label you typed, whether control was allowed, the scopes, the join code stored only as a scrypt hash, and the created / claimed / expired / ended timestamps with the reason it ended. That row is deleted 7 days after the session dies.
• In the session ledger, three metadata lines and no more: the session was created, an agent joined it, and it ended (with a short reason such as "revoked" or "expired"). Each carries a session id, the scopes, and the agent's id. The label is deliberately left out — a session named "Mum's laptop" would turn a metadata-only ledger into a record about a person who never agreed to be in it. No name, no code, no hostname, no IP address, no keystrokes, no screen content. Those lines are append-only and are never deleted, like the rest of that ledger.
• On their computer, a one-off support session writes no credential file — the token lives in memory only, and the agent actively clears out any credential left over from an earlier run, so no access survives the session. It does leave an inert folder behind: the screen helper it downloaded and built, and a marker recording that macOS was asked for permission. No key, no token, no access — but the folder stays until someone deletes it, and they should be told that. A permanent Fleet join is the opposite: it does write a credential file, and it stays.

What the person being helped controls

They are not a passenger in this, and the design tries hard not to make them one.

• They see the terms before anything starts. The agent prints a consent block before it connects: whose computer is on the other end, what that person will be able to do — see this screen, or see it and drive it — the things they will explicitly not be able to do, and the exact clock time the session ends. Then it asks.
• They can make it view-only, regardless of what the link allowed, by starting the agent with a view-only flag. A link that was made view-only by the sender cannot be widened from your side either.
• A live banner stays on their screen for the whole session. It is not a notification that can be missed once — it is refreshed for as long as the session is running, and it says whether you are merely watching or actually driving.
• Ctrl-C ends it, instantly and unilaterally. So does closing the terminal, and so does the hard session deadline. When it ends, the agent's access is revoked at your end too — there is no lingering grant to forget about.
• You can end it from your side at any moment, and revoking the session or the grant cuts the picture, not just the input.

None of that replaces asking. Watching another person's screen is their decision to make, not yours: get their agreement first, tell them plainly whether you can drive or only look, tell them when it ends, and tell them about the folder left on their machine. A consent screen is a floor, not a substitute for the conversation.

Section 10What we receive about you

Today: nothing, automatically. We can be specific about why rather than just asserting it. The complete set of places the software's own server dials out to is four, and every one of them is your own machine by default: the local AI endpoint (from each half of the product), the companion service on your Mac's loopback address, and the other half of Dusty Desk running on the same Mac. There is no analytics vendor in the code, no crash reporter, no update ping, no version check, and no npm dependency that could carry one — the two engines have no dependency list at all. There is one more outbound leg in the product, and it is not to us either: the support agent described in Section 9 dials out from the computer being helped to your Mac, at the address in the link you sent.

Bug notes you write in the app stay in a file on your Mac. If you want us to see one, you send it to us yourself.

The only path in the product that sends anything to a person off your Mac is the iMessage alert described in Section 5, and it goes to the number you typed, which is blank until you do.

So the ordinary human routes are the only routes: you email us, or — once selling begins — you buy something.

Section 11Retention and deletion

What the product cleans up on its own

• Bug notes — newest 500 kept, oldest dropped.
• Quick Share links — removed on revoke, or about an hour after they expire. Guests are never written to disk at all.
• Fleet computers — revoked records removed after 7 days. Enrolment codes expire in 15 minutes.
• Support sessions — removed 7 days after the session ends.
• Screen frames, Lens photos, clipboard text, notifications and guest presence — memory only, gone when the server restarts.

What the product keeps until you delete the file yourself

• Licence records, including revoked ones, with the name and email you entered.
• Upgrade requests, including dismissed ones.
• The session ledger and its rollup.
• The agent-approvals ledger — including the commands you dictated or typed.

We are stating that plainly rather than quoting a retention period we do not have. There is no automatic deletion for those four, and no "delete this person" button in the app.

The full deletion story

Quit the servers and delete the app's two data folders, and every key, licence, share, token hash, ledger, certificate and QR image goes with them. For a complete scrub, also clear:

• The start-up log files the launch scripts write. The start-up banner prints your pairing key on its own line and several complete keyed links, and the product does not clean those logs up. Do not assume your operating system will either — delete them yourself if the key mattered.
• The saved link on your phone, in the native app.
• The macOS permission grants in System Settings — those belong to the app that launched the helpers and survive everything else.
• Any alert texts already sitting in Messages, which can contain a licensee's name and email.
• The agent folder in the home directory of any computer that ran the agent — a permanent Fleet member, or a one-off support session. Only the Fleet case leaves a credential in it, but both leave the folder.

Your key can be rotated from Settings at any time. Rotating it invalidates every link that carried the old one — which is the right first move if a link may have leaked.

Section 12Links are keys — treat them like passwords

Access to Dusty Desk is a keyed link. Anyone holding a link has whatever access that link grants, with no second factor in front of it. That is a deliberate trade for the first version, and you should know where a key can end up:

• in the link saved on your phone;
• inside the QR images the app generates, which sit on your disk as ordinary PNG files;
• in the start-up logs on your own Mac; and
• in the URL of a remote session, which passes through Cloudflare like the rest of the traffic.

Two deliberate exceptions: Quick Share links carry a separate, short-lived secret rather than your key, and Fleet tokens never ride in a URL at all.

Section 13Your rights

Because everything the software stores lives on your own hardware, you are the one in control of it. In the language of data-protection law, you are the controller of the data on your Mac — including anything you enter about other people, such as a licensee's name and email or a fleet colleague's machine — and we are not a processor of it, because it never reaches us.

In practice that means: access and export is opening the files, which are human-readable. Correction is editing them. Erasure is deleting them, as described in Section 11. If you hold other people's details, honouring their requests is in your hands — and until the purge path in Section 11 is decided, it means editing a file by hand.

Once purchases exist, the purchase record itself will sit with Lemon Squeezy, the merchant of record, and requests about that record — access, correction, erasure — go through their own process under their own privacy policy. Anything held by Marcos Mercado outside that (an email you sent, a licence issued to you) you can ask about at marcos@marcossmercado.com, and the honest limit is the one this whole page describes: we can act on what is in our own mailbox and records, and we cannot reach into your install because we have no way to see it.

Section 14Changes to this policy

We version and date every change and publish it here. Because the software never phones home, it cannot notify you when this page changes — so the honest instruction is to check the page, and the honest obligation on us is not to make quiet changes that matter.

A Spanish translation is planned once the English text is settled. Until then, the English version is the original.

Section 15Governing law and contact