Privacy Policy
Last updated: October 30, 2026
In short: We do not record or store your screen. We process only what is needed for your account: your email address, device information, and usage-right and subscription information. We ask for your consent for personalized advertising. You can delete your account in the app at any time.
1. Controller
The controller is JustDesk (the operator of the app). Contact: support@justdesk.com.tr.
This policy also serves as our notice under the Turkish Personal Data Protection Law No. 6698 (KVKK), Article 10, and describes our privacy practices for users everywhere, including the EEA and the UK.
2. What we process, why, and on what basis
Personal data is collected automatically through the app and our servers, only as far as needed for your account and the service.
| Data | When collected | Purpose | Legal basis | Retention |
|---|---|---|---|---|
| Email address | When you sign up or sign in with Google | Create your account; verification and password reset codes; account notices | Contract (performance of the service) | Until you delete the account |
| Password (email sign-up only) | When you sign up | Sign-in | Contract | Until you delete the account. Never stored in plain text; only an irreversible hash (argon2id) |
| Google account identifier | When you sign in with Google | Sign-in | Contract | Until you delete the account. Google never gives us your Google password |
| Device information: 9-digit device ID, hash of the secret device key, device name, platform and device type, last seen time | When a device is added to your account and when it connects | My Devices screen, routing a connection to the right device, security | Contract | Until the device is removed or the account is deleted |
| Session information (hash of the session refresh key, dates) | When you sign in | Keep you signed in | Contract | Up to 60 days or until you sign out |
| Connection information: identities of the connecting devices, connection type (view/control), start and duration | When a connection is set up | Set up the connection, enforce time limits and usage rights | Contract | In server memory while the connection lasts; we keep no permanent connection history (the history list stays on your own device) |
| IP address | Every time you connect to the server | Rate limiting, preventing PIN/password guessing and abuse, security | Legitimate interests | The application server does not write IP addresses to disk; it only keeps short-lived counters in memory. Operating-system/network logs: up to 30 days |
| Usage-right (quota) information: right usage times, device time-zone offset, rewarded-ad credit records | When you connect on the free plan | Apply daily right and time limits; reset the day in your own time zone | Contract | Until you delete the account |
| Subscription information: Google Play purchase token, product, status and end date | When you buy a Pro subscription | Verify and apply the Pro plan | Contract | Until you delete the account. We never see your card or payment details; Google Play handles them |
| Advertising data (Android, free plan, only when you watch a rewarded ad): advertising ID, IP, device information | When an ad is shown | Rewarded ads (Google AdMob); verify the reward | Consent (consent screen), and Google's own terms | According to Google's policy. We only keep the reward verification record |
| Technical server logs | While the server runs | Debugging and security | Legitimate interests | Up to 30 days |
What we do not process: your screen image and control commands (they flow encrypted between the two devices and are not stored by us), your location, contacts, photos, microphone or camera data, text shown on your screen and passwords. We do not collect special categories of personal data.
3. Screen sharing and remote control
- The screen image flows end-to-end encrypted (DTLS-SRTP) between the two devices. If a direct connection is not possible, encrypted traffic passes through a relay (TURN) server that we operate; we cannot see it and we do not record or store it.
- Every connection starts with the other person's explicit approval; a banner is visible throughout sharing and you can end the connection at any time.
- On Android, remote control uses the Accessibility service. It works only during a control session you accepted, for taps, swipes, system buttons and typing into the selected text field. It does not record, store or send screen content, passwords or other apps' data to us or anyone else. The app explains this clearly before you turn it on.
4. Recipients and international transfers
We do not sell your data. We work with the following providers to deliver the service:
| Recipient | Purpose | Data | Location |
|---|---|---|---|
| Contabo GmbH (hosting) | Application server and database | All account data | Europe (Germany) |
| Brevo (email delivery) | Verification and deletion code emails | Email address, the code text | European Union |
| Google (Google Sign-In, Google Play Billing, AdMob, STUN) | Sign-in, subscription verification, rewarded ads, network address discovery | Google account identifier and email, purchase token, advertising ID and device information, IP address | Global (including the US) |
| Competent public authorities | Legal obligations | As required by law | Türkiye |
Transfers outside Türkiye are made in line with Article 9 of KVKK (adequacy decision, appropriate safeguards, or necessity for the service). Where required, advertising personalization is based on your consent, which you can withdraw in the app's ad privacy options or your device's ad settings.
5. Retention
We keep data for the periods in the table and in any case only until the purpose ends, then delete, destroy or anonymize it. When you delete your account, it and its data are deleted from the server. Deleted data may remain in our daily security backups for up to 7 more days and is then deleted automatically.
6. Security
- Encrypted connections (TLS) between the app and the server; DTLS-SRTP between devices.
- Passwords are hashed irreversibly (argon2id); device keys and verification codes are stored only as hashes.
- Approval for every connection, one-time time-limited PINs, rate limiting, short-lived relay credentials.
- Key-only remote server access, firewall, automatic blocking of unauthorized login attempts, regular updates.
- Limited access to backups and short backup retention.
7. Your rights
Under KVKK Article 11 (and, where applicable, the GDPR/UK GDPR) you can: learn whether your data is processed and request information; learn the purposes; know the recipients; request correction; request deletion or destruction (you can also delete your account yourself in the app); object to results based solely on automated analysis; request compensation for damage; and, where the GDPR applies, request access, restriction and portability and object to processing based on legitimate interests.
Send requests to support@justdesk.com.tr from the email address of your account so we can verify your identity. We respond free of charge as soon as possible and within 30 days. You may also lodge a complaint with the Turkish Personal Data Protection Board or, where applicable, your local data protection authority.
8. Cookies and website
This website uses no cookies, does not track visitors and loads no third-party resources. The advertising ID and ad privacy choices apply only inside the Android app, when a rewarded ad is shown.
9. Children
JustDesk is not directed to anyone under 18. We do not knowingly process data of people under 18 and will delete such accounts if we learn of them.
10. Changes
We update this policy when features or laws change. We announce important changes in the app or by email. The current version is always on this page.