ErtiDesk Privacy Policy

ErtiDesk is published by Erti Cloud, an individual entrepreneur registered in Georgia (“we”, “us”). We are the controller of the personal data processed by our signaling service and by the website ertidesk.com. Privacy questions and requests: privacy@erticloud.com.

This policy applies to the ErtiDesk apps for macOS, Windows, Linux and iOS, to the signaling service at erticloud.online and to the website ertidesk.com. We process personal data in accordance with the Law of Georgia on Personal Data Protection and, where it applies to you, the EU General Data Protection Regulation (GDPR), the UK GDPR and other applicable data protection laws.

ErtiDesk keeps its data on your devices. We have no access to it:

• cryptographic device keys, stored in the system keychain or credential store (macOS and iOS Keychain, Windows Credential Manager, Linux Secret Service);
• the list of paired devices with their names, public keys, permissions and access modes;
• the security log and connection history — for example when a device connected and which permission was used;
• settings, such as the selected signaling server, file locations you approved and display preferences.

You can delete this data by revoking devices, clearing the history in the app or uninstalling ErtiDesk. Keys in the system keychain may remain until you remove them there.

The content of your sessions — screen images, keyboard and mouse input, terminal input and output, file names and file contents — is transmitted directly between your paired devices over WebRTC, encrypted end to end (DTLS-SRTP) and bound to the device identities created during pairing. If a direct connection is not possible, encrypted traffic may pass through a relay (TURN) server, which cannot decrypt it.

We do not receive, store or have the technical ability to read session content.

To connect devices over the internet, ErtiDesk uses a signaling server. Unless you configure your own server, this is our service at erticloud.online. It authenticates devices by their keys and forwards connection messages, which are encrypted end to end. In doing so, it processes:

• device identifiers (derived from each device’s public key) and the public keys used to authenticate them;
• the IP addresses your devices connect from;
• when devices come online and go offline, and which device a message is addressed to;
• the size and timing of encrypted messages.

The service cannot read pairing codes, connection details (SDP and ICE candidates), commands, files, screen images or terminal data.

The server keeps operational logs of devices coming online and going offline (with device identifier) and of failed authentication attempts (with IP address). Logs are rotated automatically and kept only as long as needed to run and secure the service; they are not retained as a permanent record. A specific entry may be kept longer only if it is needed to investigate abuse or a security incident.

If a connection is relayed through a TURN server that we operate, that server processes IP addresses, timing and traffic volume, but only carries encrypted packets.

Purposes and legal basis: providing the connection service you request (Article 6(1)(b) GDPR) and our legitimate interest in keeping the service secure and preventing abuse (Article 6(1)(f) GDPR).

If you use your own signaling or TURN server, we do not receive this data; the operator of that server is responsible for it.

• Network address discovery (STUN). To find a direct path between devices, ErtiDesk asks a STUN server for your public IP address. The STUN servers are provided by the signaling server; in the default configuration this includes a public STUN server operated by Google (stun.l.google.com), which receives your IP address and the time of the request under Google’s privacy policy.
• Dictation on iPhone. If you use dictation with the system engine, your speech is recognised by Apple’s Speech framework. Depending on the device and language, audio may be sent to Apple for processing under Apple’s privacy policy. You are asked for microphone and speech recognition permission first.
• Offline speech model. If you choose the Whisper engine, the app downloads a speech model once from Hugging Face (huggingface.co), which receives your IP address as part of the download. Recognition then runs entirely on your iPhone.
• Local network discovery. On the desktop, ErtiDesk can announce the computer on your local network (mDNS) so that your other devices can find it. Other devices on the same network can see the computer’s name. You can turn this off in the network settings.

ErtiDesk does not include analytics, advertising, crash-reporting or telemetry services.

ErtiDesk asks the operating system for the permissions its features need — for example Screen Recording and Accessibility on macOS, the camera for scanning a pairing QR code, the microphone and speech recognition for dictation, local network access and notifications. The data these permissions give access to is used only for the corresponding feature on your devices.

Face ID and Touch ID are handled entirely by iOS. ErtiDesk only learns whether the check succeeded; it never receives biometric data.

When you visit ertidesk.com, your browser sends technical information to our servers, and our hosting provider records it in server logs:

• your IP address;
• the date and time of the request;
• the page or file requested and the response status;
• the referring page, if your browser sends it;
• your browser type, version and operating system (the “user agent”).

We use this data only to deliver the website, to keep it secure and stable, and to investigate errors and abuse. We do not combine it with other data or use it to build profiles. Server logs are rotated automatically and deleted when they are no longer needed for these purposes.

Legal basis: our legitimate interest in operating secure websites (Article 6(1)(f) GDPR and the corresponding provisions of Georgian law).

The website does not set cookies and does not use analytics, advertising, social media plugins, tracking pixels or similar technologies. Fonts and all other files are served from our own servers, so loading a page does not send your data to third parties.

Your browser’s local storage holds two preferences: your colour theme and, if you choose one, your language. They stay on your device, are never sent to us and contain no personal identifiers; you can delete them at any time by clearing the site data in your browser. When you first open the English version, the page reads your browser’s preferred languages to suggest a matching language version; this happens only in your browser and stores nothing.

Because we only store what is strictly necessary for features you use, we do not ask for consent and do not show a cookie banner. If we ever introduce technologies that require consent, we will update this policy first and ask for your consent.

If you write to us, we process your email address, your name if you give it, the content of your message and any information you choose to include, such as the device or app version for a support request.

We use this data to answer you and to handle your request. We keep correspondence for as long as needed to resolve it and to follow up, and afterwards only where we are required to keep it by law or need it to establish or defend legal claims.

Legal basis: taking steps at your request or performing a contract with you (Article 6(1)(b) GDPR) and our legitimate interest in answering enquiries (Article 6(1)(f) GDPR).

Please do not send us passwords, pairing codes or other secrets — we never need them.

If you download ErtiDesk from the App Store, Apple processes data about the download under its privacy policy. If you download it from our website, our hosting provider records technical data as described in the section on our website above.

We do not sell personal data and do not share it for advertising. We use service providers to host the website and the signaling service and to handle email; they process data on our behalf and under our instructions.

We may disclose data if we are legally required to do so, for example to comply with a binding order of a court or a public authority, or where this is necessary to protect our rights or the safety of others.

We are based in Georgia. Our service providers may process data in other countries. Where the data protection law that applies to you requires it, we transfer personal data outside your country only if the destination ensures an adequate level of protection or appropriate safeguards are in place, such as standard contractual clauses. You can ask us for information about these safeguards.

Depending on the law that applies to you, you have the right to:

• get access to your personal data and a copy of it;
• have inaccurate data corrected;
• have your data deleted;
• restrict processing or object to processing based on our legitimate interests;
• receive data you gave us in a portable format;
• withdraw any consent you have given, without affecting processing before the withdrawal.

To exercise a right, write to privacy@erticloud.com. We may ask you to confirm your identity. We will answer within the time limit set by the applicable law — under the GDPR, within one month.

Because ErtiDesk has no accounts, we can only find signaling data by device identifier. To make a request, write to privacy@erticloud.com and include the device identifier shown in the app.

You also have the right to lodge a complaint with a supervisory authority: in Georgia, the Personal Data Protection Service; in the EU, EEA or UK, the data protection authority of the country where you live or work. We would appreciate the chance to address your concern first.

ErtiDesk is a tool for managing your own computers and is not directed at children. We do not knowingly process children’s data beyond the technical metadata described above.

ErtiDesk uses established cryptographic libraries for authentication and end-to-end encryption, stores keys in the system credential store and checks permissions on the host for every request. The website is served over encrypted HTTPS connections. We collect as little data as possible and restrict access to logs and correspondence to the people who need it. No method of transmission or storage is completely secure, but we take appropriate technical and organisational measures for the risks involved.

We do not make decisions based solely on automated processing, including profiling, that have legal or similarly significant effects on you.

If ErtiDesk starts processing new kinds of data, we will update this policy before releasing the change and, where required, ask for your consent in the app. Each version is listed in the version history below.

Privacy questions and requests: privacy@erticloud.com.