ShiftDesk for Android — Privacy Policy

Last updated 30 October 2026

This policy explains what the ShiftDesk app for Android phones and tablets (the "app") uses, why, and the choices and rights you have. FLOWTC LTD, registered in England and Wales (company number 16938969), is the controller of the personal data described here. Our general Privacy Policy covers the ShiftDesk website, accounts and paid plans; this page adds what is particular to the app. Contact details are at the end.

1. What the app does

The app lets you see and control your own computers, or computers whose owners allow you to, from an Android phone or tablet. It only connects out to computers: nobody can connect to your phone or tablet through ShiftDesk, see its screen or control it.

2. What we cannot see

The content of a session — the computer's picture and sound, what you type and tap, the clipboard, files and chat — travels directly between the app and the computer, encrypted end to end with keys only those two devices hold. When a direct connection is impossible, our relay forwards the encrypted traffic without being able to read it. We never receive any of this content.

3. What we use and why

Device registration. When the app runs, it registers with our server so it can reach your computers: its ShiftDesk address, a public key that proves its identity, its name (by default the phone's model name; you can change it in Settings) and its operating system, and when it was first and last online. We need this to provide the service.

Connection data. To set up a connection, our server sees the IP address of the app and of the computer, which device connects to which, and when. For a direct connection, the two devices exchange their network addresses, so the computer you connect to learns the app's IP address. To discover its public address, the app may contact a STUN server run by us or by Cloudflare or Google; those operators see the IP address in that request. We keep a record of each connection the server sets up — the two device addresses and names, the accounts they belong to, their IP addresses, and when the connection started and ended — for 90 days, to keep the service secure, investigate abuse reports and enforce plan limits. It never contains what was on the screen or typed.

Your account (optional). You can use the app without an account. If you sign in, the app opens our website's sign-in page in your browser; your password never passes through the app. Signed in, the app receives your email address, your plan's name, the computers saved to your account and the devices linked to it, so it can list them. What we keep for an account is described in our general Privacy Policy.

Saved passwords. If you save a computer's password in your account, our server sends it to the devices linked to your account, including this app, so they can connect for you.

Advertising. If you use the app without a paid plan, it may show ads on its home screen, never during a connection: announcements about our own apps and services, and, where we switch them on, banners from Google AdMob. Before AdMob shows anything where the law asks for consent (for example in the EEA, the UK and some US states), Google's consent form asks you, and you can change your choice later in Settings › Ad privacy choices. AdMob then receives, under Google's own privacy policy (policies.google.com/privacy), the device's advertising identifier, its approximate location from the IP address, and how ads are shown and used, to show and measure ads and to prevent fraud. Paid plans see no ads. We do not sell your data or use third-party analytics, and we never pass the contents of a connection, your files or your account details to advertisers.

4. What stays on your phone or tablet

The app keeps its settings, your recent connections and the computers it has found on your network on the device. Its identity key and any computer passwords you choose to remember are encrypted with a key held in the Android Keystore. Files you receive from a computer are saved to Downloads › ShiftDesk on your device. The app writes diagnostic messages to the device's own system log; they are not sent to us. Everything except the files in Downloads is removed when you uninstall the app.

5. Permissions the app uses

Internet and network state: to connect to our server and your computers, and to notice when the phone moves between Wi-Fi and mobile data so a session can continue.

Wi-Fi multicast: to find your computers on the same network and connect to them directly, without the internet. You can turn this off in Settings › Find computers on this network.

Notifications and a foreground service: while a session runs, Android shows a notification saying so, which keeps the session from being stopped while you switch apps. You can end the session from it.

The app does not use your camera, microphone, location, contacts or photos. Files and the clipboard are only sent when you choose to: a file you pick yourself, or the clipboard when you tap Send clipboard. Text copied on the computer is copied to your phone when the clipboard setting is on (Settings › Sound and clipboard › Copied on the computer comes here).

6. Who receives information

7. How long we keep it

Device registrations: while the device uses ShiftDesk, or until you ask us to remove one. Connection records: 90 days. Accounts: as our general Privacy Policy says. Other server logs: only as long as needed for security and troubleshooting.

8. Your rights

Depending on where you live, you can ask for access to your data, correction, deletion, restriction or a portable copy, and you can object to processing based on legitimate interests. Email [email protected], from your account's address if the request concerns an account; we may ask for proof that the request concerns you, and we will answer within one month. You can also complain to the UK Information Commissioner's Office (ico.org.uk) or the data protection authority where you live. If you live in Türkiye, you also have the rights in Article 11 of Law No. 6698 on the Protection of Personal Data.

9. Children

The app is not directed to children. Accounts and paid plans are for people aged 18 and over. If you believe a child has given us personal data, contact us and we will delete it.

10. Security

Sessions are encrypted end to end, the app's keys and remembered passwords are encrypted with the Android Keystore, and our servers are reached over encrypted connections only. No system is perfectly secure; protect your passwords and codes, and tell us at once if you suspect misuse.

11. Changes

We will update this policy when the app or our practices change, and change the date above. We will tell you about important changes in the app or by email.

Controller

FLOWTC LTD, registered in England and Wales, company number 16938969. Registered office: 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom. Privacy requests: [email protected] — or by post to the registered office, marked "ShiftDesk — Privacy".