BrowserDeskPrivacy
As at 11 October 2026 · Deutsche Fassung
In short: this website loads nothing from third-party servers, sets no cookies and does not track you across pages or visits. We count how often our program files are downloaded — the network address for at most 14 days (§ 7), after that only totals and approximate places without any personal reference remain. The service itself stores what operation and accountability require — and if you run the relay yourself, we receive none of it.
1Controller
We are not legally required to appoint a data protection officer; please send enquiries to the address above.
2Visiting the website
This website embeds no third-party content — no external fonts, no map, video or analytics services, no content delivery network. It sets no cookies. There is no recognition across pages or visits and no usage profile.
One exception, so that the statement holds: if you switch the language to English at the top right,
the page remembers that choice in your browser’s local storage (entry bd-lang).
This happens only in response to your action, contains no identifier relating to you and serves
solely the display you asked for — which makes it permissible without consent under
section 25(2) no. 2 TTDSG. You can remove the entry by clearing website data in your
browser.
Retrieving a page creates the technically unavoidable server logs: IP address, time, file requested, volume transferred, browser identification. The purpose is secure operation and defence against attacks; the legal basis is Art. 6(1)(f) GDPR (legitimate interest in undisrupted operation). These logs are overwritten automatically after 14 days.
Download counting. We count how often our program files are retrieved from this server — by day, platform, version and type of retriever (browser, command line, a device updating itself, a mirroring server, a search engine) and by approximate location (see below). These daily totals contain no IP address and no identifier of yours and are kept permanently; they answer how often and from roughly where a version was retrieved, and nothing else. The corresponding log line carrying your IP address is part of the server logs described above: it serves secure operation and the defence against misuse (Art. 6(1)(f) GDPR) and is deleted in full after 14 days, not merely obscured. The counting remains complete after that — it does not need your address. No profile is created, and the numbers are not combined with other data.
Approximate location. From the IP address of a retrieval we determine country, region and city on our own server, using a location database kept there. Your address is not passed to anyone for this. The daily totals then contain only this approximate location, never the address; for addresses from private networks no location is determined at all. After 14 days we merge the city into its region if fewer than three different addresses downloaded from there on one day. The information is imprecise (it often reflects the internet provider’s site rather than yours) and serves only to evaluate where our programs are used (Art. 6(1)(f) GDPR). On our home page we may show a map “Where BrowserDesk is already in use” derived from it — aggregated only: a place appears only once several different addresses have downloaded from there on one day, and it shows coarse tiers instead of numbers. The location database is provided by IP Geolocation by DB-IP (licence CC BY 4.0).
3Using the service
If you use BrowserDesk through our relay, we process the following data. The legal basis is Art. 6(1)(b) GDPR (performance of the usage relationship), and for security and log data additionally Art. 6(1)(f).
| Category | Content and purpose |
|---|---|
| Device | Name, platform, version, tags, time of first and last check-in, plus a device certificate — so a device can prove who it is. |
| Session | Target device ID, IP addresses of both sides, start and end. The content of the session (picture, input, files) is not stored (for recordings see section 4). On the direct path and via TURN it is encrypted between the endpoints. If a network blocks these paths, the relay carries the session itself: the content is then encrypted between the endpoints only if both sides run the program from version 20261010.19 onwards. From version 20261012.1 the device signs the key exchange with a device-held identity that the viewer verifies and remembers — so a relay interposed later is detected and the operator cannot read along even in relay mode. With an older counterpart — and always with the client for Windows XP/7 — the content in relay mode is protected only by TLS on the way to the relay, and the operator of the relay could technically see it. A program from 20261010.19 onwards shows during the session whether it runs encrypted and verified, encrypted, or unencrypted. |
| Voice and sound | If the participants want it, a session can carry voice (microphone) and the device's sound. The helper switches their own microphone on; the microphone at the supported device opens only after a consent prompt on that device, per session, and never by default. Sound only travels on the direct path encrypted between the endpoints (WebRTC), is neither stored nor recorded and does not leave the session. The device shows during the session whether its microphone is open or sound is being transmitted; the consent is noted in the audit log (who, when — never the content). A voice is personal data; the legal basis is your consent given at the prompt (Art. 6(1)(a) GDPR), which you can withdraw at any time by ending the session. |
| Feedback | If a user reports a bug or suggests an improvement in the app, the relay stores the kind, title, text, the stated device ID, the IP address of the report and — only if ticked — diagnostics (version, platform, operating system, language) plus an excerpt from the program log. The purpose is fixing the bug or improving the product (Art. 6(1)(f) GDPR); only what the user sends is transmitted. If you run your own relay, the report stays there until you forward it to us; we do not forward the device ID or the IP address. |
| Audit log | Who triggered which action and when, with tenant, device and details of the action, for some events (such as sign-ins and quick codes) with the IP address — hash-chained, so later changes become visible. |
| Consent | Which consent was given for which capability, by whom, and for how long it applies. |
| Script runs | Script name, the person who triggered it, exit code and duration. Parameters passed in are stored as well — only parameters of the type “secret” are masked, all others are stored in clear text. |
| Accounts | User name and a hash of the password (PBKDF2 with salt). Passwords are never held in clear text — device access passwords included. |
| Requests | For a subdomain request: the name requested, e-mail, organisation and the IP address of the request — for processing and against misuse. |
| Licences | For a licence request or order on the website: company, contact person, e-mail, phone (optional), billing address and VAT ID (optional), the licences ordered with their price, your message and the IP address — for quote, contract, invoice and issuing the licence (Art. 6(1)(b) GDPR) and against misuse (point (f)). You receive an acknowledgement of receipt by e-mail. If you pay online, we additionally store the payment status, the amount including VAT and the identifiers of the payment at Stripe — no card or account data (section 6). |
| Free access | When you request it: name, e-mail address and the IP address of the request; when you set it up via the link in the e-mail: the address you choose (tenant), your username and a hash of your password — to create and run the access (Art. 6(1)(b) GDPR) and against misuse, such as several Free accesses for the same purpose (point (f)). We send the link only to the address given; it is valid for 48 hours. |
4Preview and recording
Screen previews and automatic session recording are off by default. They are created only where they have been expressly enabled for a device. Independently of that, a technician can start a recording during a running session — to the console (the recording is uploaded to the relay after the session) or as a file on their own computer. The controlled device then shows a notice that a recording is running (program version 20261006.8 or later). Whoever switches on or starts such recording is responsible for informing the people affected and — where required — for involving the works council. Recordings to the console sit on the relay and can be deleted there; local recordings stay with the technician.
Sound is never recorded. A recording contains the picture only. Should recording with sound ever become possible, then only after express consent by both sides — at the supported device and at the helper — through a consent prompt of its own.
5Self-hosting
If you run the relay yourself — via Docker, as a Windows service or as a Linux package — then we process none of the data above. It stays entirely on your server, and you are the controller under the GDPR. The only thing still reached from us is the update feed, whose retrieval creates the usual server logs (section 2). The retention periods in section 7 apply to our relay; on your own relay you set them yourself — the automatic clean-up after 30 days is switched off there by default.
6Recipients and place of processing
The service runs on a server of IONOS SE in Germany; IONOS is bound as a processor. E-mails (notifications or replies to enquiries) are also sent via IONOS. We ourselves transfer no data to third countries — except feedback (paragraph after next). We download the location database from DB-IP once a month; no data about you is transmitted in doing so. Beyond this we pass on no data unless we are legally obliged to or you pay online (next paragraph).
Online payment. If you choose “Pay online” when ordering, we transmit the order number, e-mail address, company and the items and amounts ordered to Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland. You enter your payment data (for example card or PayPal account), the billing address and, where applicable, your VAT ID directly at Stripe; we do not see them. Stripe processes this data to handle the payment, calculate VAT, issue the invoice and prevent fraud, partly as a controller in its own right (Art. 6(1)(b) and (c) GDPR); data may also reach the USA, for which Stripe cites standard contractual clauses and its certification under the EU-US Data Privacy Framework. Details: Stripe privacy policy.
Feedback. We may turn feedback into a work item in our development environment at GitHub, Inc., 88 Colin P. Kelly Jr. Street, San Francisco, CA 94107, USA. Title, text, kind and — if sent — the diagnostics including the log excerpt go there, but not the device ID or the IP address. For the transfer to the USA GitHub refers to the EU-US Data Privacy Framework certification and standard contractual clauses; details: GitHub privacy statement. Please do not put passwords or confidential content into feedback.
Where we act as a processor for our customers, our data processing agreement under Art. 28 GDPR applies — including the list of sub-processors and the technical measures. It takes effect as soon as you request it; on request we will also sign it.
7Retention
- Server logs (including the download log lines carrying an IP address): 14 days, then deleted automatically.
- Download daily totals (with approximate location, without IP address): permanently.
- Session data and device logs: 30 days. A nightly run deletes older entries automatically.
- Device and account data: for as long as the usage relationship lasts. We delete earlier on request; statutory retention duties remain unaffected.
- Audit log (hash-chained): for as long as the usage relationship lasts; there is no automatic trimming.
- Database backups: the most recent 14; older ones are discarded.
- Recordings: until you delete them — they are yours.
- Feedback from the app: until it is deleted — no period runs out automatically. At present only the operator of the relay can delete it, directly in the relay’s database; for our relay we do so at your request to info@browserdesk.de. A work item created from it remains part of the development history.
- E-mail enquiries: until the matter is settled, then six months at most.
- Licence orders and billing data: for as long as statutory retention duties require (up to ten years, section 147 AO, section 257 HGB). Requests without an order are deleted on request. A cancelled online payment remains marked as “cancelled”; we delete it on request as well.
- Free access: for as long as it exists (see device and account data). If the link is not used within 48 hours, it expires; we delete the request on request.
8Your rights
You may request access to your data (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You may object to processing based on a legitimate interest (Art. 21). Consent once given may be withdrawn at any time with effect for the future.
You also have the right to lodge a complaint with a supervisory authority. The authority responsible for us is the Bavarian Data Protection Authority (Bayerisches Landesamt für Datenschutzaufsicht), Promenade 27, 91522 Ansbach, Germany.
No automated decision-making or profiling takes place.
This English text is provided for convenience. In case of doubt, the German version prevails.