Privacy policy

Last updated 24 September 2026. This is the whole of it. The longer version, with the reasons, is on the safety page.

Who we are

DuoDesk is made and run by Torcip SRL, a company registered in Romania. Torcip SRL is the controller of everything described on this page. Registered office: Str. Weiner Palada nr. 12, Roșu, Chiajna, Ilfov, Romania. Trade register number J2024002471231, CUI 49862521.

We have not appointed a data protection officer. A company this size, doing what DuoDesk does, is not required to have one.

To reach us about your data — to ask what we hold, to have it corrected or deleted, or about anything else on this page — write to us. Our supervisory authority is Romania's ANSPDCP — Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal, dataprotection.ro. Anybody can complain to it, and the authority in the country you live in counts too.

What DuoDesk never has

Nothing of what crosses a session. A session runs between two computers, encrypted end to end. Our servers introduce the two machines: they pass along what the two need to find each other — their network addresses and, when a password is used, the one-time proof of it, which our servers can read like any message they carry — and, where two machines cannot reach each other directly, forward the session's encrypted packets, which they cannot. No screen, no keystroke, no clipboard, no file, no file name, no chat message, no command, and no recording ever reaches us — not stored, not in transit, not in a log.

No advertising identifier. No tracking across apps or sites. No third-party analytics service, no SDK that reports to anybody but us, and nothing sold or shared with anybody for any purpose. There is no advertising in DuoDesk and there is no plan for any.

What it holds, and for how long

• Your computer's DuoDesk-ID and its public key — the sixteen digits somebody types to reach it, and the key that proves the machine is the same one. Kept while the machine exists; removed when it is.
• What the machine is: the name you gave it, its platform, the version of DuoDesk, and the version of its operating system. From 0.7.56, and only if you leave that switch on, also its processor, memory, disk, model and serial number. Switching it off deletes what was stored.
• A two-letter country, worked out from the address a connection arrives on. The address itself is used to answer the connection and is never written down.
• That two machines were introduced — the two IDs, when it started, when it ended, and what a machine reported the session did in counts (files moved, commands run, ports forwarded). Never what was in any of it. Ninety days.
• Who is connecting, shown to the computer being reached. When you connect to a computer while signed in, that computer is shown the email address of the account you are signed in with, so the person sitting at it knows who is on their machine. It is passed to that one host as the session opens, and the server keeps nothing new for it beyond the session log above.
• An account, if you make one: your email address, a nickname, and a hash of a password. The address is how you sign in: we send a six-digit code to it when you make the account and when you sign in, and we use it for nothing else — no newsletter, no product mail, and it is never sold, shared or passed to an advertiser. The code itself is kept only as a hash, for ten minutes. Delivery is by our email provider, which sees the address and the message in order to post it. If you sign in with Google or Microsoft, the identifier that provider gives us and the address it reports, used to open your account and nothing else.
• Which of your machines may skip the code. If you tick "skip the code on this computer", we store that machine's DuoDesk-ID and a date thirty days out. Nothing else; you can take it back from the device list, and changing your password takes back all of them.
• Abuse reports — a host saying somebody was guessing passwords: two IDs and a count. Ninety days from the last one.
• What you say on the way out, if you fill in the uninstall box. After ninety days the ID and anything you typed are erased; the anonymous part stays.
• Which of our own messages you saw. If we show a card in the app — a release note, something about a plan — the app reports back that it was shown, dismissed or acted on, against the machine's DuoDesk-ID. That is the whole of what could be called analytics here: it goes to us and to nobody else, there is no third-party service behind it, and it is about our own messages rather than about what you do with the app.
• Payment is handled by the payment provider. We never see a card, a name or an address.

Backups. The server's database is copied once a night, and each copy is kept for fourteen days, on the same server, readable only by its administrator. So anything deleted from the database — by you, by the ninety-day sweep, or with your account — can remain in those copies for up to fourteen days more, and is then gone everywhere.

Payments

Card details are handled entirely by Stripe, our payment processor. The checkout page is Stripe's, hosted on Stripe's servers, and your card number never reaches a DuoDesk server, a DuoDesk log or a DuoDesk backup — there is nothing here to leak, because there is nothing here. Stripe holds the card, the billing address you give it and any tax id, under its own privacy policy.

What we keep is the minimum needed to know what you are entitled to and to answer a question about a payment: Stripe's customer id for your account, Stripe's subscription id, which plan and period you bought, the status of the subscription, and the start and end of each period an invoice paid for — dates and identifiers, in other words. We also store the amount and currency a payment was made in, which is what lets us refuse a payment that does not match the plan's price. No card number, no expiry, no CVC, no name and no address.

A subscription record — the customer and subscription ids, the plan, the period dates and the amounts — is kept while the plan exists and for five years after you delete your account, counted from 1 July of the year after the deletion, and then it is deleted too. That period is not our choice: Romanian accounting law (Legea contabilității 82/1991, art. 25) requires the record behind an invoice to be kept that long. The invoices themselves stay at Stripe, under Stripe's own retention — Stripe does not delete an invoice it has issued. Ask us and we will tell you exactly what is against your account.

The address you give Stripe at checkout is Stripe's and stays with Stripe; it does not have to be the one on your DuoDesk account, and we do not copy one into the other. Cancelling, changing a card and downloading an invoice all happen on Stripe's own billing pages, reached from the app.

Who else sees it

A few companies do one specific job for us and see only what that job needs. We do not sell or share your data with anyone else, and there is no advertising network and no analytics service in the picture — see What DuoDesk never has above.

• Stripe handles payments and is its own controller for your card and billing data, under its own privacy policy. The Stripe entity is Stripe Payments Europe Ltd, in Ireland, and some of that data is processed in the United States under Stripe's own transfer safeguards. What DuoDesk itself keeps is under Payments above — no card number ever reaches us.
• Resend is our email provider: it delivers the six-digit sign-in codes and forwards a copy of any feedback you send to our own mailbox. It sees the recipient address and the message, in order to deliver them, and nothing else. Resend (Plus Five Five, Inc.) is based in the United States, so this is a transfer outside the EU/EEA. It runs under the EU Standard Contractual Clauses (Module Two, controller to processor) that Resend's data processing addendum incorporates, and Resend is also certified under the EU-U.S. Data Privacy Framework.
• DigitalOcean hosts the rendezvous server — the machine that introduces two of your computers and forwards their sealed packets. The server runs in DigitalOcean's Frankfurt region (FRA1), inside the EU, so your data is not moved out of the EU/EEA to be hosted. DigitalOcean, LLC is a company based in the United States, and to the extent it reaches that data from there — support and operations — the transfer runs under its certification under the EU-U.S. Data Privacy Framework, with the EU Standard Contractual Clauses as the fallback its data processing agreement provides.

Nobody else. There is no advertiser, no data broker and no third-party analytics service behind DuoDesk — that is the promise in What DuoDesk never has.

Legal basis

Under the GDPR, each thing above rests on one of these:

• Your account, your plan, and introducing your machines to each other — performance of our contract with you (art. 6(1)(b)).
• The two-letter country and what each machine reports about itself — the same: it is how the service does what you installed it to do (art. 6(1)(b)).
• The subscription record kept after you delete your account — a legal obligation (art. 6(1)(c)): Romanian accounting law (Legea contabilității 82/1991, art. 25) requires it, for the period stated under Payments above.
• Abuse reports, the ninety-day session and audit log, the sign-in lockouts and the rendezvous server's own protections — our legitimate interest in keeping the service safe and working (art. 6(1)(f)).
• The uninstall box and the feedback form — your consent, given by filling it in (art. 6(1)(a)); you can withdraw it, see Your rights.

On a phone

The iPhone and Android apps hold their own DuoDesk-ID and keypair in the system keystore, the computers you have connected to, and your settings. They ask for no camera, no microphone, no contacts, no location and no photo library — camera and microphone are blocked outright, not merely left unused.

An Android phone can share its own screen, so a computer or another phone you have given your ID to can watch it. Nothing is shared until you tap Accept on Android's own screen-capture dialog — the system's, not ours — and Android asks again every single time; DuoDesk cannot start the capture on its own. Once you accept, what leaves the phone is the whole screen, notifications and all, so put away anything you would not show. It goes only to the one machine that dialled, encrypted end to end, through the same relay that introduces the two and cannot read a byte of it. The connection is view-only: nobody watching can tap, type or control your phone. Sharing stops the moment you end it, the screen turns off, or the viewer disconnects, and nothing from your screen ever reaches a DuoDesk server — not stored, not in transit, not in a log.

Screen recording, where the phone offers it, records only what DuoDesk itself draws, into a file on the phone. It is not uploaded anywhere.

Feedback you send us

The feedback form in the app — a bug, an idea, a question, or a way to reach you back — is the one place you type a message meant for us on purpose, so it is the one place we keep what you wrote. When you send one we store only what you typed: the kind, the subject and the message itself, and an address to reach you on only if you enter one — leaving that field blank means no email travels with the message, even when you are signed in; we never fill in your account's address for you. We store where it came from too: your nickname, your machine's DuoDesk-ID, your account if you have one, and the build it was sent from — the version of DuoDesk, the platform, the operating system and the processor type. Nothing from your screen and no file is ever attached; a message is words you chose to write, never a session. We keep it for one year, long enough that a report made in January is still on hand when the same thing is reported in November, then it is erased. So that we see it promptly, our email provider forwards a copy to our own mailbox — the same provider that posts a sign-in code, seeing the message only in order to deliver it. Ask us and we will delete what you sent.

Your rights

These are yours over the data we hold, and you can use any of them by signing in or by writing to us. Start at duodesk.io/me, which shows every computer on your account, what each one reports about itself, and who connected to it.

• Access, and a copy. Download everything we hold against your account as one JSON file from duodesk.io/me/account.
• Rectification. Change your nickname or email in the app or at /me/account, and ask us to correct anything else that is wrong.
• Erasure. Delete your account yourself, at once and for good, from the app, your phone, or the delete-account page.
• Restriction and objection. Ask us to stop or limit a use you disagree with — write to us.
• Portability. That same JSON export is your data in a form you can take elsewhere.
• Withdrawing consent. Where we relied on your consent — the uninstall box and the feedback form — you can take it back: ask us to delete what you typed.
• Complaint. Complain to the ANSPDCP (dataprotection.ro) or to the authority where you live, and going to court is open to you too.

We answer within one month (art. 12(3)). Because an account is little more than an email address and a nickname, we may first ask you to prove it is yours — usually a code sent to the account's email.

Deleting your account

Deleting your account is immediate and irreversible, and it takes almost everything with it in one step: your email, nickname and password, your sign-in codes and trusted machines, two-factor, any Google or Microsoft link, your API tokens, webhooks and unattended-access enrolments, your alerts and team memberships, and every feedback message you sent. Three things do not go with it, and each for a reason: the subscription record is kept the five years the accounting law above requires; the invoices stay at Stripe, which does not delete them; and your computers keep working — a machine's DuoDesk-ID, name, country and ninety-day session and audit rows belong to the machine, not the account, and stay until you forget the machine or uninstall. The delete-account page has the whole of it, including the pro-rata refund of a part-used paid period.

Getting in touch

Write to us about anything on this page, including asking for what we hold about you or asking for it to be deleted.