In short
Your screen, keyboard and mouse input, clipboard, chat, files and camera travel end to end encrypted between the two computers. The relay that connects them forwards data it cannot read, and Arcnode Network records nothing from a session. The person being helped needs no account. What we do process is limited to helper accounts, the short-lived data the relay needs to pair two computers, the list of computers a helper may reach with any-time access, and update checks.
01 About this notice
This notice covers Arcnode Remote: the desktop application for Windows, the Arcnode Remote relay, the website at remote.arcnode.dev, and the Arcnode Remote features of our identity provider at backboard.arcnode.dev. Terms such as Helper, Person Being Helped, Session, Session Code, Verification Code, Device Key, Relay, Relay Id, Computers List, Any-time Access and Privacy Mode have the meanings given in the Arcnode Remote Terms of Service.
Our Privacy Policy continues to apply to everything this notice does not change, including how your Arcnode Account itself is handled, your rights, and how to contact us. Where this notice is more specific about Arcnode Remote, it applies.
02 Who is responsible for what
- Arcnode Network is the controller (Article 4(7) GDPR) for the personal data described in this notice: helper accounts and helper access, the data the relay processes to pair two computers, the Computers List, update checks and downloads, and visits to remote.arcnode.dev.
- The helper, or the organization they help for, is responsible for the session. What a helper sees, does, copies or receives during a session, and anything they note down or keep afterwards, is their responsibility (or their organization’s), not ours. A helper who supports customers for an organization does so under that organization’s privacy notice.
- Where an organization uses Arcnode Remote to help its own customers, it can enter into our Data Processing Agreement. For the data listed there, Arcnode Network then acts as the organization’s processor (Article 28 GDPR).
- Arcnode Network never sees session content. Screen images, input, clipboard text, chat, files and camera pictures are encrypted on one computer and decrypted only on the other. The relay forwards them in encrypted form and holds no key, so we cannot read, change or keep them.
03 How a session works
- Over the internet, the helper’s app asks the relay for a nine-digit Session Code. The person being helped types it, or opens a Support Link that fills it in. Both apps connect outward to the relay, which pairs them on that code and from then on only forwards bytes. A code works once and expires after 10 minutes.
- On the same local network, two computers can also connect directly, without the relay, if the person being helped has switched on accepting direct connections (off by default).
- The two apps then run an encrypted handshake (the Noise protocol, Noise_XX_25519_ChaChaPoly_BLAKE2s) and everything after it is end to end encrypted, with fresh keys for every session.
- The person being helped sees who is asking (an Arcnode-confirmed name and picture, or a warning that this can’t be confirmed), a six-digit Verification Code that the helper should read out, the helper’s Device Key, and what the helper wants to do. Nothing is shared until they select Allow, and they can disconnect at any moment.
- Arcnode Remote has no audio and no session recording. Chat is kept in memory for the session only and camera pictures are never stored.
04 If you get help
You don’t need an Arcnode Account to get help, and we do not ask who you are. When you get help over the internet, the following is processed by Arcnode Network:
| Data Point | Value / Format | Purpose |
|---|---|---|
| IP address | The address your computer connects to the relay from | Needed to make the connection. Also used, in memory, to count wrong codes (10 wrong codes lock that address out for 30 minutes) and to cap connections per address at 30. Never written to the relay’s logs. |
| Session Code | The nine digits you enter | Used once to pair you with the helper who opened it. The relay holds open codes in memory only, and forgets a code when it is used, cancelled or expires. |
| Public key requests | Your app fetches our public signing keys from backboard.arcnode.dev | So your app can check that the helper’s name was confirmed by Arcnode. Like any web request, this reaches our server with your IP address. |
| Helper’s picture | Your app loads the helper’s profile picture | From backboard.arcnode.dev or, if the helper uses their Discord avatar, from Discord’s image server, which then receives your IP address. |
The relay does not learn your name, your computer’s name or anything from the session. Your computer’s name, your screens and what you choose to share go only to the helper, inside the encrypted session.
What the helper receives
Whatever you allow, the helper sees directly: your screen (including notifications and other windows on it), and, if you allow them, control, clipboard text, files you accept or send, chat and your camera. Their app also keeps a session history with your computer’s name, its Device Key fingerprint and when the session started and ended. Only allow people you trust, and ask the helper (or their organization) how they handle what they see.
05 If you help others
Helping requires an Arcnode Account with Helper Access, which an Arcnode owner gives per account. Your account itself is handled as described in the Privacy Policy. On top of that, Arcnode Remote processes:
| Data Point | Value / Format | Purpose |
|---|---|---|
| Sign-in | Login with Arcnode (OAuth 2.0, OpenID Connect, PKCE) | Your app receives your account id, name, email address and picture, and access and refresh tokens. These stay on your computer in Windows Credential Manager. Your password never reaches the app. |
| Helper Access | Whether your account may help, and changes to it | Checked at sign-in, at every token refresh and before every session. Giving or removing it is recorded in your account’s security activity, with the time, an anonymized IP address and the browser of the person who changed it. |
| Operator attestation | A signed statement: your account id, name, picture, Device Key fingerprint and whether your account has two-step verification | Issued for 10 minutes before each connection and sent to the person you help, so their app can show your confirmed name. Never contains your email address. We do not keep a copy. |
| Relay token | A five-minute, single-use token with your account id, name and picture | Lets the relay check your Helper Access without seeing your sign-in token. The relay remembers the token’s id until it expires so it can’t be used twice. |
| Open codes | Your account id, name and picture, held with each open Session Code | Shown on the Support Link page and kept in the relay’s memory until the code is used, cancelled or expires (10 minutes at most). At most 3 codes at a time. |
| Rate limits | Counters per account and per IP address | Limit how often tokens, attestations and lists can be requested. They expire with their window. |
The name people see is your Arcnode Account name. Names that pose as a company, bank or authority are refused, and “Arcnode” is kept for our staff. When you send a Support Link by email, the app opens your own email program: Arcnode Network sends no invitations.
Your app keeps a session history on your computer (see section 9). If you help for an organization, that organization decides what you may keep about the people you help.
06 Any-time access
Any-time access lets a helper you trust connect later without someone clicking Allow. It is off until the person being helped turns it on for a specific helper, during a session, after ticking that they trust that helper. When it is on:
- The computer makes a random Relay Id (128 bits) and waits at the relay under it while Arcnode Remote runs. The relay sees the Relay Id and the computer’s IP address while it waits, and nothing else about it.
- The trusted helper’s Computers List on backboard.arcnode.dev gets an entry with the Relay Id, the computer’s name and its Device Key fingerprint, so every device the helper signs in on can find it. Only that account, with Helper Access, can read or change it. A list holds at most 200 computers.
- The computer keeps a trust file listing its trusted helpers (see section 9). Its app lets in only those helpers, confirmed by Arcnode, within the limits the person set: keyboard and mouse and clipboard can each be allowed or not, and trust can end after 30 days or a year.
- Arcnode Remote then starts with Windows and shows an icon in the tray. Turning any-time access off, from the tray or Settings, or removing the last helper, stops waiting at the relay, forgets the Relay Id and removes the start-with-Windows entry.
- When a computer moves to a new Relay Id, it proves this to backboard.arcnode.dev with its Device Key. Backboard then updates or removes the entries in helpers’ Computers Lists and records a security event with the first eight characters of the old and new ids, the Device Key fingerprint and an anonymized IP address.
07 Visitors to remote.arcnode.dev
remote.arcnode.dev sets no cookies, uses no analytics and loads nothing from other sites, except the helper’s picture on a Support Link page (from backboard.arcnode.dev or Discord’s image server). Pages send no referrer, so the code in a Support Link never travels to another site.
- Our hosting provider processes your IP address and request to deliver the page, as any website does.
- On a Support Link page, an unknown code counts as a wrong guess against your IP address, in memory, with the same lockout as in the app. Looking at a page never uses a code up.
- The download button sends you to backboard.arcnode.dev, which counts downloads per IP address (30 an hour) and redirects you to a link into our private storage that works for five minutes.
08 Updates and downloads
The app checks for updates 8 seconds after it starts and then every 6 hours. The check is a request to backboard.arcnode.dev that contains the app’s version, the operating system and the processor type, and reaches us with your IP address, which is counted for rate limiting (120 checks an hour). We do not link update checks to an account or a computer.
An update installs only when you choose Install or Install after this session, never while someone is connected, asking to connect or waiting with a code, and only if it carries Arcnode Remote’s update signature.
09 Data that stays on your computer
Arcnode Remote keeps the following on your own computer, in your Windows user profile (mostly under %APPDATA%\dev.arcnode.remote and %LOCALAPPDATA%\dev.arcnode.remote). Arcnode Network has no access to it and the app does not upload it.
| Item | What it holds | Notes |
|---|---|---|
| Device Key | The private key of this installation (identity.bin) | Encrypted with Windows DPAPI for your Windows user. Never logged or exported. Settings can make a new one. |
| Session history | Up to 200 sessions: direction, the other computer’s name, its address or “relay”, its Device Key fingerprint, whether control was given, start, end and how it ended | Clear it at any time on the Sessions page. |
| Preferences | Theme, language, scale, this computer’s name, quality, the control glow and similar settings; saved computers; screen arrangements | Kept in the app’s own local storage (see the Cookie Policy). |
| Any-time trust file | any-time.json: the Relay Id, and per trusted helper their account id, name, when they were added, their limits, when trust ends and their last connection; whether to start with Windows | Only while any-time access is on. Turning it off clears the Relay Id. |
| Computers (helpers) | computers.json: a copy of your Computers List | So the Computers page works on this device. |
| Sign-in (helpers) | Access and refresh tokens; account id, name, email address and picture | In Windows Credential Manager. Signing out removes them. |
| Diagnostics | diagnostics.json: typed event codes, numbers and times, with a random id per session | On by default, local only, never uploaded: at most 2,000 events, 14 days and 1 MB. Holds no names, addresses, keys, codes, content or file names. It leaves your computer only if you save it to a file yourself. Clear or switch it off in Settings. |
| Received files | Files you accepted, in Downloads\Arcnode Remote | Marked by Windows as from another computer, so running a program from them asks first. |
Uninstalling Arcnode Remote (Windows Settings, Apps) removes the program. To remove its data too, delete the two folders above, sign out first to remove the sign-in from Credential Manager, and turn off any-time access.
10 Purposes and legal bases (Art. 6)
| Processing activity | Lawful basis |
|---|---|
| Pairing two computers through the relay (IP addresses, Session Codes, Relay Ids) | Performance of a contract (Art. 6(1)(b)): it is how the connection you ask for is made. |
| Helper sign-in, Helper Access checks, attestations and relay tokens | Performance of a contract (Art. 6(1)(b)) with the helper. Showing the person being helped who is asking also serves our and their legitimate interest in preventing impersonation and scams (Art. 6(1)(f)). |
| The Computers List for any-time access | Performance of a contract (Art. 6(1)(b)) with the helper, at the request of the person who turned on any-time access. |
| Wrong-code lockouts, connection caps and rate limits | Legitimate interests (Art. 6(1)(f)): keeping sessions safe from code guessing and the service available. |
| Security events (Helper Access changes, Relay Id moves) | Legitimate interests (Art. 6(1)(f)): accountability and abuse prevention, so a grant is never silent. |
| Update checks and downloads | Legitimate interests (Art. 6(1)(f)): delivering the app and keeping installed copies secure. |
| Serving remote.arcnode.dev and Support Link pages | Legitimate interests (Art. 6(1)(f)): providing the website you visit. |
| Diagnostics you choose to send us | Legitimate interests (Art. 6(1)(f)): answering your support question. The file holds no personal data by design. |
| Investigating reports of misuse | Legitimate interests (Art. 6(1)(f)) in protecting people from scams and unauthorized access, and legal obligation (Art. 6(1)(c)) where the law requires it. |
Where we rely on legitimate interests, you can object under Article 21 GDPR, as described in the Privacy Policy.
11 Retention
| Data | How long |
|---|---|
| Open Session Codes with the helper’s account id, name and picture | In the relay’s memory until the code is used, cancelled or expires: at most 10 minutes. |
| Wrong-code counters and connection counts per IP address | In the relay’s memory: a counter lasts 10 minutes, or until a 30-minute lockout ends; connection counts only while connected. |
| Relay Id of a waiting computer | In the relay’s memory while that computer waits. |
| Used relay-token ids | In the relay’s memory until the token expires: at most 5 minutes and 30 seconds. |
| Relay logs | Event names and times only (such as “paired” or “session ended”), with no addresses, codes, accounts, tokens or content. |
| Computers List entries | Until the helper removes the computer on the Computers page, the computer moves to a new Relay Id without that helper, or the helper’s account is deleted. |
| Security events | 90 days, as for other security events in the Privacy Policy. |
| Rate-limit counters | Until their window ends (at most one hour). |
| Session Content | Never stored by Arcnode. Chat lives in memory for the session only. |
| Data on your own computer | Until you clear or delete it, as described in section 9. |
A restart of the relay clears everything it holds in memory. When you ask us to delete your Arcnode Account, we also delete your Computers List.
12 Recipients and processors
We do not sell personal data and do not use Arcnode Remote data for advertising. Besides the helper and person being helped themselves, the following processors are involved in Arcnode Remote. They are also listed in the Privacy Policy.
| Processor | Purpose and location |
|---|---|
| Railway | Application hosting for the identity provider and other network services, and managed PostgreSQL database hosting. Also hosts the Arcnode Remote relay and its website remote.arcnode.dev, and the private storage bucket that holds Arcnode Remote installers. (European Union / United States) |
| Resend | Transactional and notification email delivery. (United States / European Union) |
| Discord | Hosting of the Arcnode community server and Discord OAuth used to link a Discord account to an Arcnode Account (to earn a Verified badge). When you link, we receive your Discord user id, username, global display name, and avatar. An account that uses its Discord avatar as its picture has that picture served from Discord’s image server (cdn.discordapp.com), so apps and pages that show it, such as Arcnode Remote and remote.arcnode.dev, load it from Discord, which then receives the viewer’s IP address. (United States) |
| Upstash Redis | Rate limiting and request throttling, where configured. IP addresses are processed transiently as rate-limit keys and expire automatically within the rate-limit window; they are not retained. (European Union / Global edge) |
| Cloudflare DNS | DNS for arcnode.dev and its subdomains, including remote.arcnode.dev and the Arcnode Remote relay. The relay also uses it to prove control of its domain name when it obtains its TLS certificate. Cloudflare answers DNS lookups for these names; it does not receive the content of any page or session. (Global edge) |
The relay’s TLS certificate comes from Let’s Encrypt, a public certificate authority. It receives only our domain name and our own contact address, not data about you, and is not a processor. We may disclose data where the law requires it, for example to the police on a lawful order; given the end-to-end encryption, we have no session content to disclose.
13 International transfers
Some processors operate infrastructure outside the European Economic Area, in particular in the United States. Where personal data is transferred outside the EEA, we rely on appropriate safeguards under Chapter V GDPR, such as the European Commission’s Standard Contractual Clauses or the EU-US Data Privacy Framework where the recipient is certified, as described in the Privacy Policy. Session content is never transferred to us, so it is not part of any transfer.
14 Security measures
- End-to-end encryption with the Noise protocol and forward secrecy; tampered messages are rejected. The relay forwards ciphertext only and holds no keys.
- A Verification Code and Device Keys, so a person in the middle shows up as a different code or key.
- Explicit consent for every session, for more access, for privacy mode, the camera and any-time access, each in a dialog that names the helper. Requests time out to “decline”.
- Only accounts with Helper Access can open codes, get attestations or reach computers; removing access stops new sessions at once (a relay token issued just before stays valid for at most five minutes).
- Two-step verification for helpers is supported and can be made mandatory. We strongly recommend it.
- Session Codes from a cryptographic random source, single use, 10 minutes, with lockouts after wrong guesses.
- The first message each app sends to the relay (a Session Code, a Relay Id or the helper’s token) is protected by TLS when the app connects to the relay at relay.remote.arcnode.dev. Versions of the app that connect to the relay without TLS send that first message unencrypted. The session itself is end to end encrypted either way.
- The Device Key is encrypted with Windows DPAPI; sign-in tokens are kept in Windows Credential Manager.
- Updates install only when signed with Arcnode Remote’s own update key.
- The relay logs event names only.
No system is perfectly secure, and Arcnode Remote cannot protect against malware already on a computer. If a personal data breach is likely to result in a high risk to you, we will tell you without undue delay (Article 34 GDPR). To report a vulnerability, see our Security Policy.
15 Your rights
You have the rights described in the Privacy Policy: access, rectification, erasure, restriction, portability, objection and withdrawal of consent. Some practical notes for Arcnode Remote:
- If you get help, we hold almost nothing that identifies you, and only for minutes. We cannot link a past session to you, so for most requests there is nothing to find (Article 11 GDPR). Data on your own computer you can view and delete yourself.
- About what a helper saw or kept, contact the helper or the organization they helped for: they, not Arcnode Network, decide about that data.
- If you help others, you can see and remove the computers on the Computers page in the app, and request a copy or deletion of your account data from us.
Contact legal@arcnode.dev. We answer within one month (Article 12(3) GDPR) and may ask you to confirm your identity.
16 Automated decisions
We do not make decisions based solely on automated processing that produce legal effects for you or similarly significantly affect you (Article 22 GDPR). Automatic safety limits, such as a 30-minute lockout after ten wrong codes or a rate limit, are temporary technical measures, not such decisions. Helper Access is given and removed by people.
17 Children
Arcnode Remote follows the age limits in the Privacy Policy: it is not directed at children under 16 in the EEA, or under 13 elsewhere, who should only get help with a parent or guardian present. Helpers must be adults (see the Terms of Service). If you believe a child’s data has reached us, contact legal@arcnode.dev.
18 Complaints
You can complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) at autoriteitpersoonsgegevens.nl, or to the supervisory authority where you live. We would appreciate the chance to help first at legal@arcnode.dev. To report a scam or misuse of Arcnode Remote, see the Acceptable Use Policy.
19 Changes and contact
We update this notice when Arcnode Remote changes. The date at the top shows the current version; for material changes we give notice on this website or in the app. For any privacy question about Arcnode Remote:
Arcnode Network, Netherlands
legal@arcnode.dev