Legal

Privacy policy

Who is responsible. The operator named in the imprint (a private individual, not a company). Contact: noreply@ucagg.de.

What we process and why

• Account: your email address, optional name, and a scrypt hash of a password if you set one (never the password itself) — to give you an account and access. Legal basis: the contract with you (Art. 6(1)(b) GDPR).
• Sign-in codes and reset links: stored only as hashes, valid for 15 minutes / 1 hour.
• Admin two-factor: for administrators, an encrypted authenticator secret and hashed recovery codes.
• Devices: for each device you add: its name, operating system, app version, a public connect number, the time it was last seen, and its IP address — to let you connect to it and manage it (Art. 6(1)(b) GDPR). A one-way, keyed hash of a device identifier derived on the device is stored to dedupe devices and resist abuse; it cannot be turned back into the original (Art. 6(1)(f) GDPR).
• Organisations and members: for freelancer and company accounts: the org name, members and their roles, customers, and the business details you enter for invoices (Art. 6(1)(b) GDPR).
• Support sessions (metadata): who connected to which device, when, for how long, in which mode (view/control), the consent method, and whether an elevation was shown — to give you a session log and an audit trail (Art. 6(1)(b) and (f) GDPR). We do not record, store or have access to the content of your screen, your files or your chat.
• Subscription: plan, status, renewal date and the Dodo customer and subscription IDs, received from Dodo Payments (Art. 6(1)(b) GDPR). We never see or store your card details.
• Emails: a copy of every email we send you is kept in our outbox log for support and troubleshooting.
• Server logs: IP address and request details for security and abuse prevention, kept for a short time (Art. 6(1)(f) GDPR).

How a connection works (end-to-end encryption)

Screen, control, files and chat travel directly between the two devices wherever possible, sealed end-to-end with AES-256-GCM under a key the two devices establish between themselves. Our relay server only helps the two devices find each other and, when a direct path is not possible, forwards the already-encrypted bytes. The relay cannot read the content of a session. Every connection requires the explicit approval of the person at the far end, who can stop it at any time.

Where your data is processed — outside the EU

This service runs on a server rented from IONOS SE (Elgendorfer Str. 57, 56410 Montabaur, Germany) located in an IONOS data centre in Kansas City, USA. Data stored by this service is therefore processed outside the European Union. The transfer is covered by a data processing agreement with IONOS that includes the EU Standard Contractual Clauses (Art. 46 GDPR). Emails are sent and received through IONOS mail servers. The direct, encrypted device-to-device media does not pass through this server except, as a fallback, as ciphertext the server cannot read.

Who else receives data

• IONOS — hosting and email, as our processor.
• Dodo Payments — payments, as merchant of record, under their own privacy policy.
• UCA ID (ucagg.de) — if you use more than one UCA product, your email, name, plan and status are shared with the UCA account hub run by the same operator, so you see all your UCA products in one place.

No advertising networks, no analytics, no tracking, no data sales.

Cookies

Two technically necessary cookies: a session cookie that keeps you signed in, and a security cookie that protects forms against cross-site request forgery. No tracking cookies, so there is no cookie banner.

How long we keep data

Account, devices, orgs, session metadata and the email log: until you delete your account or org — then they are deleted from this server; device/abuse hashes are deleted 12 months later. Invoices you generate stay in your org until you delete them; payment records are kept by Dodo Payments as required by tax law.

Your rights

You can ask for access, correction, deletion, restriction, data portability, and object to processing (Art. 15–21 GDPR), and complain to a supervisory authority.

Last updated: 22 October 2026