Who is responsible
ZRemote Control is an independent software project, and the same project operates the ZRemote Cloud account service and this website. There is no separate company, and we are not going to invent one here — when a legal entity exists, this section will name it.
For any privacy question or request, write to support@zremote.app. That address reaches the people who actually run the service.
The server runs in the European Union (Falkenstein, Germany). The website is served by Cloudflare Pages.
The short version
- We store what is needed to run an account: your e-mail, your linked computers, and a record of when sessions happened.
- We do not store what you actually do. Screen images, keystrokes, mouse movement, transferred files and clipboard content are encrypted end to end and are never written down by us.
- There is no analytics SDK, no crash-reporting SDK, no advertising SDK and no tracking script — not in the Android app, not in the Windows app, not on this site.
- We do not sell personal data, and we do not share it for advertising.
What we store on the server
Account: your e-mail address, the display name derived from it, and your password stored only as a salted PBKDF2 hash. We cannot read your password.
Linked computers: a name, the operating system, the app version, the device public key, when it was linked, when it was last seen, whether it is online, its most recent public IP address, the detected NAT type and the measured latency. This is what lets your phone find the right PC and what makes the device limit enforceable.
Remote sessions: which computer, which account started it, the controlling IP address, the transport used (local network, direct or relay), the start and end time, the number of bytes relayed and, if it failed, the reason. This is metadata about the connection — never its content.
Sign-in sessions: a hash of each refresh token (never the token itself), when it was created and expires, whether it was revoked, the IP address and the browser or app user agent that created it. This is what powers the session list in your account area and the "sign out everywhere" button.
Password resets: a single-use token, hashed, with a short expiry.
Subscription: your plan, its status, the date paid through, and the Google Play purchase records used to verify it.
What passes through but is not stored
When you control your PC, the two devices agree on keys and encrypt the traffic between them with AES-256-GCM. When a direct path is not possible and the connection falls back to our relay, the relay forwards two already-encrypted streams. It counts bytes, so plan allowances can be applied, and it does not write the traffic to disk or to the database.
That covers everything you would consider the actual session: screen frames, keyboard and mouse input, ZDrop file transfers, and clipboard synchronisation.
On your own Wi-Fi, this traffic does not reach us at all — the phone talks to the PC directly.
What stays on your devices
On your phone: your account name, an authentication token and a device identifier, kept in the operating system’s secure storage (Android Keystore). Your password is deliberately not stored — after sign-in nothing in the app needs it. ZDrop history and clipboard history are kept in the app’s own storage, capped in size, and never uploaded. Files you receive are saved where you choose.
On your PC: a signed entitlement file and licence state under %APPDATA%\ZRemote. The entitlement file is what allows the PC app to keep working for a short period without internet.
Uninstalling the apps removes this local data. It does not delete your Cloud account — see the deletion page for that.
Permissions the Android app asks for
Internet and network state, to reach your PC. Wi-Fi state and multicast, to discover the PC on your local network. Notifications, to tell you about incoming transfers and connection status. Media and file access, only so you can pick a file to send with ZDrop and open what you received.
The app does not request location, contacts, camera, microphone or SMS.
Third parties we actually use
That is the whole list. There is no advertising network, no data broker and no analytics vendor in it.
- Google Play — distributes the Android app and processes subscriptions. Google is the seller of record; we receive the purchase state, never your card details.
- Cloudflare — serves this website and manages the domain.
- Hetzner — hosts the ZRemote Cloud server, in Germany.
- An e-mail provider — delivers password-reset messages when you request one.
Why we are allowed to process this
To perform the contract with you: running your account, linking your computers, enforcing your plan, and delivering the connection.
Our legitimate interest: keeping the service secure and abuse-free — which is why sign-in IP addresses and session records exist.
Legal obligation: keeping billing records for the period tax law requires.
How long we keep it
Account data lives as long as the account does. Session and device records are kept while the account exists so you can review them.
Server logs, which may contain IP addresses, are kept for a short operational window and then rotate away.
When you delete your account, the account row and everything that hangs off it — linked computers, session records, sign-in tokens, reset tokens and Play purchase lookups — are deleted with it. Billing event records are kept but detached from you: they stop pointing at any account. They are the proof that a payment happened, which we cannot delete and which tax law requires us to keep. A line stating that the account was deleted, including the e-mail address, remains in the server log so the deletion itself can be audited.
Cookies
This site does not use analytics, advertising or tracking cookies. There is no consent banner because there is nothing to consent to.
It does use strictly necessary cookies, but only in the account area: when you sign in, two cookies hold your session so the pages can tell it is still you. They are HttpOnly and restricted to this site, they are not readable by scripts, and they carry nothing beyond the session. Signing out or deleting your account clears them.
The marketing pages you are reading right now set no cookies at all.
Where the data is processed
The ZRemote Cloud server runs in Germany, inside the European Union, and that is where account data lives.
Two of the providers we rely on operate globally: Cloudflare serves this website from whichever of its locations is closest to you, and Google Play processes subscriptions under its own terms. Traffic to those services may therefore be handled outside the European Union, under the safeguards those providers publish.
Your rights
You can access, correct, export or delete your data. The account area does most of this directly and immediately: it shows your account data and linked computers, lets you change your password, remove a computer, end an individual sign-in session or all of them, and delete the account.
There is no automatic export button yet. To request a copy of your account data, contact support@zremote.app from the address on the account — that is the real flow today, and we would rather say so than promise a button that does not exist.
For a correction, an objection or a complaint, write to the same address. Under GDPR you may also complain to your local supervisory authority; under the LGPD, to the ANPD.
Security
Passwords are stored as salted PBKDF2 hashes. Session traffic is encrypted with AES-256-GCM and the local connection is protected by TLS with certificate pinning on first connect. The entitlement your PC receives is signed with ECDSA, so it cannot be forged by editing a file. Sign-in tokens are stored as hashes and rotate on use, so a stolen token stops working once the real one is used. Sensitive routes are rate limited.
No system is beyond compromise, and we will not claim otherwise. What we can say is what we do and what we do not keep — and the largest part of what you would care about, the content of your sessions, is something we never hold in the first place.
Children
ZRemote is not directed at children under 13, and we do not knowingly create accounts for them. If you believe a child has an account, write to us and we will remove it.
Changes
When this notice changes, the date at the top changes with it, and material changes are noted in the release notes. Continuing to use ZRemote after a change means the updated notice applies.
Contact
Questions about this document: support@zremote.app