Omni Remote Privacy Policy

1. Data we access and why

On your phone, Omni Remote stores saved PC names, addresses, ports and connection type; a generated app device identifier and device name (which may use the phone manufacturer and model); the last connected PC; favourites; module preferences; appearance and setup settings. These support connecting to your PC and remembering your choices. The desktop stores its configuration, enabled modules, local device approvals and any configured shortcuts or text templates.

For a cloud account, we process your email address, account ID, email-verification status, password hash when you use a password, security settings, session and authentication records, and account creation/update times. If you enable two-factor authentication, we store an encrypted authenticator secret and hashed recovery codes. These data support sign-in, account protection and access management. If Google or Facebook sign-in is configured and you choose it, we receive your provider identifier, email address and verification status to authenticate you.

When you link a PC to the cloud, we store its registration ID, name, account owner, hashed device credential, revocation status and last-seen time. The service also stores cloud entitlement and subscription-sync status, and any service-issued access grant. We use these data to determine which account may control which computer and whether cloud access is active.

Remote-control data depend on the controls you use. They can include typed text, key presses, pointer movements, URLs you ask the PC to open, window titles and identifiers, media/system status, and file or folder names, paths and metadata. File operations run on the PC; the current file manager browses, searches, opens, copies, moves or deletes files on that PC. It does not implement uploading your file contents to an Omni Remote file-storage service. Paths, listings and operation results can nevertheless contain private information and are returned to your phone. Only use controls on computers you are authorised to manage.

2. Direct and cloud connections

Direct control sends commands between your Android phone and Windows PC without passing through the Omni Remote cloud relay. The control connection uses HTTPS/WSS. The owner approves phone pairing on the PC, and Android checks the paired computer key before sending control traffic. Each paired phone has a separate credential that can expire or be revoked. The standalone Windows service also has an owner setup page using HTTP on loopback only; this local page is separate from the encrypted phone connection. Older versions without secure pairing must be updated on both devices.

Cloud control is optional and requires an account, a linked online PC and active cloud access rights. Production cloud clients require HTTPS/TLS. The relay authenticates sessions, checks device ownership and access rights, and forwards commands and their responses. This is not end-to-end encryption: the Omni Remote server processes and can read the command and response contents, including typed text, requested URLs, window information and file paths/listings when you use those controls.

Direct control does not by itself disable other online services. The Android subscription SDK can contact RevenueCat even when you have not signed in to a cloud account. The desktop can check the Omni Remote download service for updates. Websites or applications you open on your PC process data under their own policies.

3. Subscriptions, email and other recipients

The Android app uses Google Play Billing and RevenueCat to retrieve offers, process and restore purchases, and check Premium access. RevenueCat receives purchase history, purchase/receipt tokens, product and entitlement information, and an SDK-generated customer ID. After cloud sign-in, the app uses your Omni Remote account ID as the RevenueCat customer ID so the backend can verify your cloud entitlement. Subscription processing also uses technical request and SDK information, such as IP address, app/OS version, locale and currency. The app does not explicitly send your account email as a RevenueCat customer attribute or enable advertising-identifier collection. RevenueCat uses purchase information for subscription functionality and subscription analytics. Omni Remote does not receive your full payment-card details from Google Play.

Account verification and password-reset email are sent through Mailgun (Sinch Email), configured to use its EU API. Mailgun receives the recipient email address, the message and its verification/reset link, and processes delivery records. Your email service also receives the message. Selecting the EU API is not a promise that all recipients or all service data remain exclusively in the EU.

If you choose an available Google or Facebook sign-in option, that provider processes the sign-in request and supplies the account data described above. The Omni Remote hosting infrastructure processes requests for the website, accounts, relay and desktop downloads. Authorised service administrators can access stored account/device information and operational connection metadata to manage the service and troubleshoot problems.

If you contact support, we receive the email address and information you include, and use them to respond, resolve the issue or handle your data request. Please omit passwords, access tokens, authenticator secrets and private file contents from support messages and diagnostic attachments. Provider processing may take place in countries other than your own and follows the provider's applicable terms.

4. Diagnostics and website preferences

The relay holds connection metadata such as IP address, user agent, connection time, account/device identifiers, command type/time and success/error status in memory while connections are active. The current backend does not store a command-content history in its database. Hosting and proxy software can produce request and error logs; this is separate from the relay's database behaviour.

The desktop/local service writes diagnostic logs on your computer, including connection information, errors and module actions. Depending on module and logging settings, logs can include keystrokes, typed text, requested URLs or file paths. Mobile code and the RevenueCat SDK also produce diagnostic output. There is no automatic upload of desktop log files or an integrated mobile crash-reporting service in the current app. Logs that you choose to send to support are processed as support data.

The current Omni Remote landing page uses a language-preference cookie (NEXT_LOCALE) for one year. It does not load Clarity or Google Tag Manager analytics scripts. The separate account application uses a secure HttpOnly refresh-session cookie for web sign-in, and temporary browser state for sign-in redirects. The current mobile app has no advertising SDK or general usage-analytics SDK; RevenueCat subscription analytics and service diagnostics still apply.

5. How data are protected

Direct control and cloud transport use encrypted connections. The backend hashes passwords and session/device secrets, encrypts authenticator secrets, expires authentication tokens, and supports session and device revocation. Cloud control checks account authentication, email verification, ownership or accepted invited access, and active cloud access. The connection section above describes the cloud relay's processing of command contents.

On Android, saved cloud sessions and direct-pairing credentials are encrypted using keys in Android Keystore and stored in the app's no-backup storage. The app does not fall back to Preferences or browser storage when secure storage is unavailable. Browser previews hold cloud credentials only in memory. The desktop protects cloud credentials and direct-pairing secrets using the operating system's secure storage; the standalone Windows service uses DPAPI for direct-pairing secrets. Saved device addresses, ordinary preferences and local diagnostic files are separate from these protected secrets. Android allows backup of ordinary app preferences, so those preferences may be handled by your configured backup service.

6. Retention

Phone and PC settings and local approvals remain until you remove or reset them. Clearing the phone's application data removes its saved preferences; uninstalling or clearing an app does not delete your cloud account, provider purchase records or any operating-system backups. Desktop configuration and logs can remain on the PC after uninstalling.

Cloud account, device registration and entitlement records are kept to operate your account until deletion is carried out. They have no automatic age-based deletion in the current backend. Revoking a device disables its credential but retains its registration record. Refresh-session records expire after 30 days from issuance and are scheduled for database cleanup; access tokens expire after 15 minutes. Verification/password-reset codes expire after 30 minutes, and other temporary authentication tickets have shorter, flow-specific expiry. Expired database records are removed by background cleanup, which need not run at the exact expiry time.

Relay command payloads and responses are handled in memory for the request rather than saved as a command history. Connection metadata remains in memory while the connection is active. Desktop log rotation is configured for 14 days for general logs and 30 days for error logs. Rotation applies when the logging service runs and is not a guarantee about copies you make or files remaining on an inactive PC.

There is currently no published fixed retention period for hosting logs, backups or support correspondence. RevenueCat, Google Play and Mailgun have their own retention practices. For a deletion request, we explain any records that must be retained, the reason and the applicable period; this policy does not promise an unverified universal deletion deadline or backup-erasure schedule.

Deletion requests retain the account identifier, random request identifier, date and processing status while approval or cleanup is incomplete. Successful supported cleanup removes the account-linked request. A minimal receipt containing only its random request identifier and completion time remains so a repeated confirmation can return the same result. The receipt contains no account ID, email, profile or secrets and has no automatic expiry configured.

7. Your choices and account deletion

You can use direct control without creating a cloud account, disconnect a PC, disable its cloud connection, revoke a registered cloud device, sign out, or clear saved mobile preferences. These actions do not by themselves delete your cloud account.

Open the account-deletion page at omniremote.app/account/delete in a browser; you do not need to install the app. To send a request, sign in to your own account with a verified email address and complete a full sign-in within the previous five minutes, including two-factor authentication if enabled. The page asks you to confirm the consequences and shows the recorded request date and status. Sending the same request again does not create another request.

Your request waits for an administrator's approval. Until approval, sending a request alone does not delete your account or stop its access. Once an administrator starts deletion, account sessions and cloud device credentials are blocked, and the account's cloud connections are disconnected. The workflow then performs external cleanup and removes associated live server records. A request awaiting external cleanup or an administrator retry is not completed deletion. Processing is manual and we do not promise a fixed completion time.

Current availability on 10 October 2026: the web request page is published, but final automated erasure is awaiting configuration and verification of subscription-provider cleanup. Do not treat a submitted request as proof that your data have been deleted. Use the web page to record and track an account-deletion request.

The deletion workflow covers the cloud account's profile and email, password and linked sign-in identities, two-factor secret and recovery codes, sessions and temporary authentication records, registered cloud devices, access grants, subscription state and the deletion request. It also addresses linked RevenueCat customer data and Mailgun bounce, complaint and unsubscribe entries that can be identified as belonging to the account. RevenueCat cleanup is asynchronous; external errors or a profile shared with another named account prevent completion and require an administrator's follow-up. The workflow must avoid deleting another person's data.

Account deletion does not itself remove personal files on your PC, local preferences or diagnostic files on your devices, operating-system backups, delivered emails, Mailgun delivery logs, or Google Play's own transaction records. An anonymous RevenueCat profile that has never been linked to your account cannot always be identified from that account alone. Local direct connections are independent of your cloud account. Hosting logs, backups and support correspondence have the retention limits described above.

After supported cleanup succeeds, only a minimal completion receipt remains: a random request identifier and completion time, without the account ID, email, profile or authentication secrets. Deleting an account does not permanently reserve its former email or sign-in identity; a later explicit registration can create a new account.

Deleting an Omni Remote account does not automatically cancel a Google Play subscription. Manage or cancel it in Google Play separately. For privacy questions or requests concerning other personal data, the published contact is [email protected].

8. Contact and policy updates

Omni Remote is operated by Universal Terminal System, Ltd. (UTS). For privacy questions and data requests, contact [email protected]. Company information is available at utsplay.com. Depending on applicable law, you may have rights to access, correct, erase or restrict processing of your personal data and to complain to a data-protection authority.

We update this policy when the app or its data handling changes. The version and date at the top identify this policy. This English policy is the current application policy; the surrounding website interface may use your selected language.