Privacy by design

1. Overview

This Privacy Policy explains how RemotePC by Breadworks (“RemotePC,” “the Software,” “we,” “us,” or “our”) handles information in connection with the Android App, the Windows Listener, and the website at remotepc.tech.

RemotePC is designed as a local-first remote control solution. All remote control communication occurs directly between your devices over your local network (LAN) and is not routed through external servers that we operate.

By downloading, installing, accessing, or using any part of RemotePC, you acknowledge this Privacy Policy. It should be read together with our Terms of Service, which govern your use of RemotePC generally and which this Policy is incorporated into by reference.

2. Definitions

Software

The Android App, the Windows Listener, related documentation and updates, and the Website.

Local Network / LAN

A private network not exposed to the public internet by default.

You / User

The person or entity using the Software.

Personal Data

Any information relating to an identified or identifiable natural person, as defined under Article 4(1) of the GDPR and analogous provisions of other applicable data protection laws.

3. Who We Are (Data Controller)

RemotePC by Breadworks is an independent, non-commercial project developed and made available by an individual developer operating under the name “Breadworks” (based in Athens, Greece). “Breadworks” is a project name used for RemotePC only — it is not a registered company, corporation, or other formal legal entity.

For the purposes of the GDPR and other applicable data protection laws, the individual developer behind RemotePC is the data controller for any personal data processed in connection with your use of the Software. You can reach us using the details in Section 19.

4. Scope of This Policy

This Policy applies to:

• The RemotePC by Breadworks Android App
• The RemotePC Windows Listener software
• The website at remotepc.tech

It does not apply to third-party services you choose to use alongside RemotePC — such as the Google Play Store or GitHub — which process data under their own privacy policies. See Section 10.

5. Data We Do Not Collect

RemotePC is built to minimize data processing. Other than the narrow exceptions described in Section 10 (a GitHub update check, and two Firebase-based connections maintained by the Windows Listener), we do not collect, store, or transmit personal data to external servers.

• No personal information (e.g. name, email, location)
• No account data (no account system exists)
• No device identifiers or advertising IDs
• No behavioral tracking, profiling, or advertising analytics — the only "usage" signal we receive is a single anonymous, aggregate ping described in Section 10, which does not identify you, your device, or your network
• No remote session data leaves your local network

6. Local Data Processing

RemotePC processes data locally on your devices only, for functionality purposes, including:

• Network communication between your devices
• Input simulation (keyboard/mouse)
• Screen streaming within your local network
• File transfers initiated by the user

This processing does not involve servers operated by us and is not accessible to us. The current version of the Windows Listener also does not create or keep local logs of remote-control sessions.

The one exception to purely local, peer-to-peer processing is described in Section 10: the Windows Listener maintains two limited, one-way connections to Google's Firebase platform (a broadcast/notification channel and an anonymous usage ping). Neither connection is used to relay, route, store, or otherwise facilitate a remote-control session, and neither gives us access to your screen, input, clipboard, files, or any other session content.

7. Legal Basis for Processing (GDPR)

Where applicable under the General Data Protection Regulation (GDPR), the minimal, on-device processing described in Section 6 and Section 8 is carried out on one or both of the following bases:

• Performance of a contract (Article 6(1)(b)): processing that's strictly necessary to provide the remote-control functionality you've asked for by installing and using RemotePC.
• Legitimate interest (Article 6(1)(f)): where processing supports the core operation, stability, or security of the Software and doesn't override your rights and freedoms.

We don't rely on consent as a legal basis for this on-device processing because we don't collect the personal data in question in the first place — it never leaves your device or your local network. Where any narrow exception to that applies (for example, the GitHub update check or the Firebase-based connections described in Section 10), the relevant basis is noted there.

For the Windows Listener's Firebase-based broadcast/notification channel and anonymous usage ping specifically, our legal basis is legitimate interest (Article 6(1)(f)): keeping users informed of important announcements, and understanding how many people are using RemotePC at any given time, are legitimate interests in operating and maintaining the Software, and this processing is limited to what's necessary for those purposes. Because the usage ping is anonymous and aggregate, and the broadcast channel does not use any identifier to target or profile a specific person, we don't consider either to involve personal data in the ordinary case; to the extent any technical identifier involved (such as a push-messaging registration token) is ever considered personal data under your local law, legitimate interest remains our basis, and you retain the rights described in Section 13, including the right to object. If you object to this processing, the only way to fully stop it is to uninstall the Windows Listener, since — as disclosed in Section 10 — the broadcast channel is a fixed part of how that software is built and does not have an in-app toggle.

8. Android App Permissions

The Android App requests the following device permissions. Each is scoped to what's required for RemotePC's core local-network remote-control functionality — none is used for location tracking, advertising, profiling, or analytics of any kind.

Network & connectivity

INTERNET

Allows the app to open network sockets so it can communicate with your remote PC over the network.

ACCESS_NETWORK_STATE

Required for ConnectivityManager queries (allNetworks, getNetworkCapabilities, getLinkProperties) used by ServerDiscovery's VPN-aware channel selection.

ACCESS_WIFI_STATE

Required for reliable Wi-Fi state queries and for the multicast fallback strategy in ServerDiscovery (WifiManager.MulticastLock needs this to prevent the Wi-Fi radio from filtering multicast frames).

CHANGE_WIFI_STATE

Allows the app to modify Wi-Fi connectivity states when necessary for establishing or managing direct local network connections.

CHANGE_WIFI_MULTICAST_STATE

Works alongside ACCESS_WIFI_STATE to allow the app to acquire a multicast lock, ensuring incoming network discovery broadcasts are received.

ACCESS_LOCAL_NETWORK Android 17+ (SDK 37+)

Required for Android 17 (SDK 37+) Local Network Protections. Local network access (broadcast, multicast, unicast UDP/TCP to LAN addresses in both directions) is blocked by default and requires this permission.

Background operation & notifications

FOREGROUND_SERVICE

Required for running any background tasks as a foreground service with a visible notification (such as active connection or file transfer states).

FOREGROUND_SERVICE_CONNECTED_DEVICE

Specifically required by FileReceiveService using the connectedDevice foreground service type.

WAKE_LOCK

Required by FileReceiveService to hold a PARTIAL_WAKE_LOCK for its entire lifetime so Doze mode cannot suspend the CPU mid-transfer and stall or corrupt incoming file data.

POST_NOTIFICATIONS Android 13+ (API 33+)

Required on Android 13+ (API 33+) to post notifications, such as status updates during file transfers or connection states.

Storage & interface

WRITE_EXTERNAL_STORAGE maxSdkVersion 28

Used to save downloaded files. Marked with android:maxSdkVersion="28" because it only takes effect on Android 9 and below; MediaStore APIs handle storage writes on Android 10+ (API 29+).

VIBRATE

Gives access to the device vibrator for haptic feedback when interacting with controls or actions.

None of these permissions is used to collect analytics, build an advertising profile, or transmit data to us or to third parties. All network communication they enable occurs directly between your Android device and your Windows PC over your local network, consistent with Section 6.

9. Windows Listener Security Features

RemotePC is designed with a local-first security model. The Windows Listener, as the side accepting incoming connections, includes the following features to help protect data in transit:

These features are designed to reduce the risk of unauthorized access to data in transit, but they don't guarantee it in every case — for example if a feature is bypassed, misconfigured, or fails. Full disclaimers and liability limits for these features are set out in Sections 7, 12, and 13 of our Terms of Service.

Separately from these security features, and separately from any remote-control session, the Windows Listener also maintains two limited, one-way connections to Google's Firebase platform — a broadcast/notification channel and an anonymous usage ping. These do not carry remote-control session data and are not configurable through the security features above. They are described in full, including their legal basis and your rights, in Section 10.

10. Data Sharing & Third-Party Services

We do not sell, rent, or otherwise share any user data with third parties for their own purposes, and RemotePC does not integrate with advertising networks, data brokers, or third-party analytics SDKs. RemotePC does maintain the following limited, disclosed connections to external, third-party-operated infrastructure, each described in full below:

• Update checks: RemotePC may contact GitHub's public API to check for new versions. Like any internet request, this sends your device's IP address to GitHub, which processes it under GitHub's own privacy statement — we don't receive or store it. Nothing else is transmitted for this purpose.
• Google Play Store: if you downloaded the Android App from the Google Play Store, your use of that distribution channel is also subject to Google Play's own terms and privacy practices, which we don't control.
• Broadcast/notification channel (Windows Listener, Firebase): the Windows Listener maintains a persistent, one-way connection to Google's Firebase platform (Firebase Cloud Messaging) so that we can push message notifications to the app — for example, announcements, security notices, or other important updates. This channel is a built-in, fixed part of how the Windows Listener is designed to operate, and — unlike the security features in Section 9 — it does not have an in-app or configuration-file toggle to disable it. Maintaining the connection necessarily involves Firebase issuing a device-specific messaging token and processing ordinary connection metadata (such as your device's IP address at the time of connection) as part of delivering the message — this is inherent to how push-messaging infrastructure works, not something we separately request. We do not use this token or metadata to identify, profile, or track you, and we do not combine it with any other data we hold (we hold none).
• Anonymous usage ping (Windows Listener, Firebase): the Windows Listener also sends a periodic, anonymous ping to us via Firebase, solely so we can see how many people are using RemotePC at a given time. This is a live, aggregate count of concurrent usage, not a cumulative record of everyone who has ever used RemotePC. The ping is not linked to an account, name, email address, or any other identifier that could reasonably be used to identify you, your specific device, or your network, and we do not attempt to re-identify it.

Firebase as a processor: Firebase is a platform operated by Google LLC / Google Ireland Limited. For the broadcast channel and anonymous ping described above, Firebase acts as an infrastructure processor / service provider that transmits and delivers this limited data on our behalf, under Google's own privacy policy and, where applicable, its data processing terms with us. We don't control Firebase's infrastructure and aren't responsible for its independent obligations as a global platform provider, but we have configured our use of it to request the minimum functionality needed for the two purposes described above.

Other than the GitHub update check, the Google Play Store, and the two Firebase-based connections described above, the Windows Listener and Android App make no further outside connection to us or to any other party. Nothing here is used for advertising, cross-app tracking, or building a profile of you.

11. International Data Transfers

The only data leaving your device through your use of RemotePC is: (a) the request described in Section 10 that your Android App or Windows Listener may make to GitHub's API to check for updates; (b) any data you choose to submit through the Google Play Store; and (c) the two limited Firebase-based connections maintained by the Windows Listener (the broadcast/notification channel and the anonymous usage ping), also described in Section 10. GitHub and Google are both US-based companies that process data under their own privacy policies and applicable international-transfer safeguards, including — where relevant — self-certification under the EU-U.S. Data Privacy Framework, the UK extension to that framework, and the Swiss-U.S. Data Privacy Framework, or Standard Contractual Clauses, as maintained and updated by Google and GitHub respectively.

We do not receive, store, or control this data beyond the aggregate, anonymous usage count described in Section 10, and we do not operate any servers of our own outside your local network to which your data could be transferred.

12. Data Retention

Since RemotePC does not collect or store personal data on servers we operate, we do not retain user data. Any data processed during use remains temporarily on your own devices and is controlled entirely by you.

Basic technical data (such as server logs for this website) may be temporarily retained by our hosting provider under its own retention practices, for security and operational purposes. See Section 16.

The anonymous usage ping described in Section 10 is only ever retained by us in aggregate, anonymized form (for example, as a live concurrent-usage count), never as an individual record tied to a device or network, and never as a cumulative history of past usage. Any connection-level data that necessarily passes through Firebase to deliver the broadcast channel or the ping (such as a messaging token or IP address at time of connection) is retained, if at all, by Google under Google's own retention practices for Firebase, which we don't control.

13. Your Rights (EEA / UK / GDPR)

14. California Privacy Rights (CCPA/CPRA)

15. Children's Privacy

RemotePC is not directed at children under the age of 13 (or the equivalent minimum age in your jurisdiction), and we don't knowingly collect personal data from children.

If you're using RemotePC on behalf of, or in the presence of, a minor, our Terms of Service require that you be their parent or legal guardian, or otherwise legally authorized, and that you accept both the Terms and this Policy on their behalf.

If you believe a child has given us personal information, contact us using the details in Section 19 and we'll take appropriate steps to address it.

16. Website

This website does not use analytics, tracking cookies, or advertising technologies.

Basic technical data (such as server logs) may be temporarily processed by the hosting provider for security and operational purposes (e.g. preventing abuse or diagnosing issues).

17. Changes to This Policy

We may update this Privacy Policy periodically to reflect changes in functionality, legal requirements, or improvements to the service — including changes to the permissions listed in Section 8 or the third-party connections listed in Section 10.

Material changes will update the “Last Updated” date above and, where practical, be flagged in the app or on the Website. Continuing to use RemotePC after changes take effect means you accept them, to the extent the law allows; where the law requires your affirmative consent, we'll ask for it.

18. Governing Law

This Policy is governed by the laws of Greece (the Hellenic Republic), the developer's country of residence, consistent with Section 19 of our Terms of Service. If you're a consumer habitually resident in the EU, EEA, or UK, this doesn't take away the protection of mandatory consumer-protection or data-protection rules in your country of residence.

19. Contact

If you have any questions about this Privacy Policy, the permissions RemotePC requests, or our data handling practices, you can contact:

legal@remotepc.tech