Privacy Policy

Last updated 25 October 2026

This policy explains what information ShiftDesk uses, why, and the choices and rights you have. FLOWTC LTD, registered in England and Wales (company number 16938969), is the controller of the personal data described here. Contact details are at the end.

1. What we cannot see

The content of a session — the screen picture, sound, keyboard and mouse input, clipboard, files and chat — travels directly between the two devices and is encrypted end to end with keys only those devices hold. When a direct connection is impossible, our relay forwards the encrypted traffic without being able to read it. Recordings and screenshots you make are saved only on your own device. We never receive any of this content.

2. What we use and why

Device registration. When ShiftDesk runs, it registers the device so others can reach it: its ShiftDesk address, a public key that proves its identity, the device name and operating system, and when it was first and last online. We need this to provide the service.

Connection data. To set up a connection, our server sees the IP address of each device that is online and which device connects to which, and when. For a direct connection, the two devices exchange their network addresses, so the device you connect with learns your IP address. To discover a device's public address, the app may contact a STUN server run by us or by Cloudflare or Google; those operators see the IP address in that request. We keep a record of each connection the server sets up — the two device addresses and names, the accounts they belong to, their IP addresses, and when the connection started and ended — for 90 days, to keep the service secure, investigate abuse reports and enforce plan limits. It never contains what was on the screen or typed.

Your account (optional). If you create an account: your email address, the name you give, your password (stored only as an Argon2id hash), the devices you link, your plan and its renewal date, and your sign-in sessions.

Saved computers (optional). If you save computers to your account, we store their ShiftDesk addresses, the names you give them and, only if you enter one, their password. Saved passwords are encrypted on our servers and are sent only to you: your signed-in browser and the devices linked to your account, so they can connect for you. Because our server can decrypt them, a session started with a saved password relies on our safeguards as well as on end-to-end encryption; leave the password empty if you prefer to type it each time.

Sign in with Google or Apple (optional). If you choose it, Google or Apple tells us an identifier for your account with them, your email address (with Apple this may be a private relay address) and, if you share it, your name. They do not give us your password or access to anything else in your Google or Apple account. Google and Apple process that sign-in under their own privacy policies.

Payments. Stripe processes payments for us. We do not see or store your full card details. We receive and keep your Stripe customer and subscription identifiers and the status of your subscription; Stripe also gives us the billing details needed for invoices and tax records. When you start checkout we record that you asked for your plan to start at once and accepted losing the 14-day right to cancel (with the time and your IP address), to show it if a payment is disputed.

Support. If you email us, we use your message and address to answer you.

On your own device. The app stores its settings, your recent connections, the device's identity key and a log file in your user profile (on Windows the key is encrypted by the operating system). This stays on your device unless you choose to send it to us, for example a log file for support.

We do not sell your data, show advertising or use third-party analytics or tracking.

3. Legal bases

• Contract: registering devices, connecting sessions, running your account and plan, and answering support requests.
• Legitimate interests: keeping the service secure, preventing abuse and fraud, enforcing plan limits and fixing faults. We balance these against your interests and keep the data involved to a minimum.
• Legal obligation: keeping billing and tax records and responding to lawful requests.

4. Who receives information

• The device you connect with: your device name, operating system, ShiftDesk address and network address.
• Service providers acting for us: our hosting provider, Cloudflare (network delivery and protection of our website and servers) Stripe (payments) and, only if you use them to sign in, Google and Apple. Stripe also acts as an independent controller for its own legal duties, such as fraud prevention.
• Authorities, courts or advisers, when the law requires it or to protect people from harm.

5. International transfers

We are based in the United Kingdom. Some providers, such as Cloudflare and Stripe, process data in other countries, including the United States. Where the law requires, we rely on UK adequacy regulations or approved contractual safeguards, such as the UK International Data Transfer Addendum.

6. How long we keep it

• Device registrations: while the device uses ShiftDesk, or until you ask us to remove one.
• Accounts: until you ask us to delete your account. Sign-in sessions expire after 30 days.
• Billing records: as long as UK tax and accounting law requires, normally six years.
• Connection records: 90 days. Other server logs: only as long as needed for security and troubleshooting.

7. Cookies and local storage

We use one cookie, sd_session, which keeps you signed in to your account. It is essential, lasts up to 30 days and is removed when you sign out. The browser client remembers your stream and keyboard preferences in your browser's local storage (keys starting with sd.). We use no advertising or analytics cookies, so we do not show a cookie banner. Stripe's checkout and billing pages are run by Stripe and follow Stripe's own cookie notice. You can clear this data in your browser settings at any time.

8. Your rights

Depending on where you live, you can ask for access to your data, correction, deletion, restriction, a portable copy, and you can object to processing based on legitimate interests. Email [email protected] from the address on your account; we may ask for proof that a request concerns you, and we will answer within one month. You can also complain to the UK Information Commissioner's Office (ico.org.uk) or the data protection authority where you live. If you live in Türkiye, you also have the rights in Article 11 of Law No. 6698 on the Protection of Personal Data.

9. Children

Accounts and paid plans are for people aged 18 or over. If you believe a child has given us personal data, contact us and we will delete it.

10. Security

Sessions are encrypted end to end, passwords are stored only as strong hashes, sign-in tokens are stored only as hashes, and our website is served over HTTPS. No system is perfectly secure; protect your passwords and codes, and tell us at once if you suspect misuse.

11. Changes

We will update this policy when our practices change and change the date above. We will tell you about important changes by email or in the app.