Privacy

This page lists what the Utly Remote service stores, in the words of the tables it stores it in. Anything not listed here is not collected.

The service is operated by Utly Development Studio. It consists of the broker at broker.utly.dev (the introduction service and the account service), the relay at turn.utly.dev, and this website. All of it runs on one server rented from Hetzner Online GmbH in Finland. No analytics, advertising or tracking service of any kind is used, on the website or in the app.

Without an account

Identity. When the app starts, it registers an Ed25519 public key with the broker, which assigns it a nine-digit ID and keeps the pair, with the time of first registration, for as long as the ID exists. The private key never leaves your PC.

Presence and sessions. While the app runs, the broker knows the ID is online and the IP address it connects from. When one ID asks for another, the broker relays the request, the answer, and the connection descriptions (session-description and ICE messages, which contain IP addresses of both sides). It keeps in memory which pairs accepted a session in the last ten minutes. None of this is written to disk; the broker’s log records IDs coming online and going offline with their IP address, and is capped at a hundred megabytes, after which the oldest lines are discarded.

Relayed traffic. When two PCs cannot reach each other directly, the relay carries their encrypted packets. The relay sees both endpoints’ addresses and the amount of traffic; the content is encrypted end to end between the two PCs with keys the relay does not have. Relay credentials are minted per accepted session and expire after ten minutes.

Session content — the picture, keyboard and mouse input, clipboard, audio and files — travels only between the two PCs. The service never has it.

On your PC the app keeps: the identity key (sealed to your Windows account), the public keys of machines you have connected to, the address book, the unattended-access record (an OPAQUE registration from which the password cannot be recovered), settings, and a session log. The installer keeps these under %ProgramData%\Utly Remote, the portable exe under your local application data. Nothing on your PC is sent anywhere except as described here.

With an account

Accounts are optional. If you create one, the broker stores:

• your email address, used as the account name and not verified or written to;
• an OPAQUE registration record, from which your password cannot be recovered;
• the secret of the authenticator app you enrolled;
• eight recovery codes, stored as SHA-256 hashes;
• for each device: a name the device chose (computer and user name), the IP address it last connected from, the times it was created and last seen, and a hash of its session token;
• your address book as ciphertext: one blob per entry under an opaque key, sealed on your PC with a key derived from your password. The broker cannot read an entry, cannot tell which ID it names, and can see only how many entries there are and when they change.

The email address is not used to contact you. There is no password reset, because the server holds nothing that could perform one.

Abuse reports

A report you send from the app is stored with your ID, the reported ID, the text you wrote (at most 500 characters), your IP address and the time. Reports are read by a person and kept until acted on. An ID placed on the blocklist is stored with the reason and the time.

Updates

The app fetches an update manifest from this site half a minute after it starts and every six hours. The request carries no identifier beyond what any web request carries (your IP address, which the web server logs and rotates). Which version you run is not reported anywhere.

Retention and deletion

Identity records live as long as the ID does; delete the app’s data folder and the machine registers a new ID next time. Account data lives until the account is deleted, which today means asking us. Reports are kept until acted on. The broker’s log is capped as described above; the web server’s access log is rotated daily and kept for fourteen days. Backups of the broker’s database are taken nightly and kept for thirty days.

Your rights

Ask us what the service holds about an ID or an account, ask for it to be corrected or deleted, and we will do it. Until a public contact address is published on this page, use the repository’s issue tracker.

Changes

This page changes when the service changes what it stores; the date of the current version is in the site’s source history.