Support & security

Section 01How to get help

Email is the only support channel, and that is deliberate rather than lazy: Dusty Desk has no account system, no dashboard of yours that we can look at, and no telemetry telling us that something broke. Everything we know about your problem is what you tell us.

We answer in English or Spanish, whichever you write in.

Section 02Before you email — three things fix most problems

1. Your remote link probably rotated. Remote links ride a tunnel whose address changes whenever the tunnel process restarts. An old link stops working and looks exactly like a broken product. Restart the link and use the fresh address.
2. macOS permissions. Control and screen viewing need Accessibility and Screen Recording granted to the app that launches the helpers, in System Settings. The dashboard reports these honestly — a permission you granted in the app but macOS has not allowed shows as "blocked by macOS" rather than a green light that means nothing.
3. Which link are you on? Plain local, encrypted local, or remote — they behave differently and fail differently. Knowing which one you were using turns most reports into a one-line answer.

Section 03What to put in a bug report

The more of this you can answer, the faster this goes. None of it is mandatory — a one-sentence report is better than no report.

• What you expected, and what happened instead. In that order, in plain words.
• Which tier — the base trackpad, or the Dusty Desktop View upgrade.
• Which kind of link — same Wi-Fi on the plain address, same Wi-Fi over TLS, or a remote tunnel link.
• Phone and browser — the device, its OS version, and whether you were in Safari, another browser, or the installed app.
• The Mac — macOS version and whether it is Apple silicon or Intel.
• Whether the helpers had permission — Accessibility and Screen Recording, as in Section 2.
• Whether it repeats, and the smallest sequence of taps that makes it happen.
• Any error text shown on the phone or printed by the server.

Section 04Reporting a security vulnerability

Dusty Desk watches screens and drives input. That is about as sensitive as consumer software gets, and we would much rather hear about a flaw from you than from someone using it. If you have found something, please tell us privately first and give us a chance to fix it.

What to include

• What an attacker gains — viewing a screen, driving input, reading a key, impersonating an owner, getting past a permission gate, denial of service.
• The preconditions — do they need to be on the same Wi-Fi, hold a share link, be an admitted guest, hold an enrolled agent token, or nothing at all? "No preconditions" and "already an admitted guest" are very different findings.
• Reproduction steps — the shortest sequence that shows it. A short script, a curl command, or a video all work.
• Version and setup — which build, which link type, macOS version.
• Your assessment of severity and any fix you would suggest. You do not have to write one, but if you have a view we want it.
• Redacted evidence. Please strip real keys, share secrets, agent tokens, and any third party's personal information from anything you attach — describe the shape of the secret rather than pasting it.

What we ask of you

• Report privately first, and give us a reasonable window to fix it before publishing.
• Test only against your own install. Do not access, view, or drive anyone else's machine to prove a point — that is the exact thing this software's terms forbid, and it is also usually a crime.
• Do not run denial-of-service testing against someone else's machine, and do not exfiltrate or keep other people's data. If you stumble across it, stop and tell us.

What we commit to in return

• We will acknowledge that we received your report, tell you whether we can reproduce it, and keep you informed until it is resolved or we explain why we are not fixing it.
• We will not take legal action against anyone who reports a flaw in good faith, following the rules above. Good-faith research is a favour to us and to every user.
• We will credit you when we publish the fix, unless you would rather stay anonymous.

What is in scope

• The Mac-side servers and their helpers, the phone-facing pages, the licensing and claim flow, Quick Share, Fleet enrolment and grants, the remote-support lane, the session and approvals ledgers, and this website.

What is out of scope

• Things the documentation already tells you. Local plain-HTTP links being unencrypted, remote links not being end-to-end encrypted through the tunnel, and keys riding in URLs are all disclosed in the privacy policy as known, deliberate trade-offs. A report showing they are true is not a vulnerability. A report showing they are worse than documented very much is, and we want it.
• Vulnerabilities in third-party software we do not ship — the tunnel provider, macOS, your browser, the local model server, or the companion service that handles Lens photos. Report those to their own maintainers.
• Findings that require physical access to an unlocked Mac that is already signed in.
• Reports produced only by an automated scanner, with no demonstrated impact.

Section 05What to expect back

Dusty Desk is built and supported by one person. Being honest about that up front is fairer than a promise nobody could keep.

• Support email — best effort, usually within a few business days. There is no guaranteed response time, and the terms do not promise one.
• Security reports — these jump the queue. We aim to acknowledge them well inside a few days.
• Outages — there is nothing of ours to go down. Your Mac is the server and the tunnel belongs to a third party, so there is no status page to check and no incident for us to declare. If your link is dead, start with Section 2.

Section 06What we cannot do for you

These are consequences of the design, not of unwillingness, and it is better to know them now:

• We cannot look at your install. There is no cloud, no account, no remote session we can open. Whatever you can tell us is what we have to work with.
• We cannot recover a lost key. There is no master key and no copy of yours. You rotate or regenerate it locally.
• We cannot recover your data, because we never had any of it.
• We cannot switch off a copy already installed — see the terms for what that means for licences and refunds.
• We cannot see whether you used the product, which is why refunds are never conditioned on usage.

Section 07Billing, refunds and legal

• Refunds — 14 days, no questions asked. See the refund policy for what to send. One thing worth knowing before you check your statement: the charge will read as Lemon Squeezy, the merchant of record who runs the checkout, not as Dusty Desk.
• Billing and receipts — held by Lemon Squeezy, since they are the seller of record. The licence itself is granted by Marcos Mercado under the terms.
• Privacy questions, including where a particular file lives on your own Mac and how to delete it — the privacy policy lists every one of them, and Section 15 has the contact route.
• Legal notices — terms, Section 18: the same email address, or the business address in Section 5 above.