PC Remote CommanderPrivacy & data controls
What PCRC processes, why it is needed, and how to close your account.
How the connection works
Your AI client sends requests to the PCRC gateway. The gateway authenticates the account, checks permissions, and routes allowed requests to the selected computer. The local agent returns results through the gateway to your AI client. HTTPS protects transport. This is not end-to-end encryption that hides requests from the gateway.
Requested files, terminal output, browser content and screen captures may contain personal data and can enter your AI conversation. Choose your workspace and permissions carefully. Your AI provider has its own retention and privacy terms.
Beta.9 interactive agent terminals display bounded request and result previews locally. Recognized secret fields, authentication values and images are omitted, but previews can still contain private task content. PCRC does not create a separate trace file for these previews; your terminal or operating system may retain scrollback. Consider this before sharing your screen or terminal output.
Data and retention
| Data | Purpose and store | Retention and deletion |
|---|---|---|
| GitHub numeric ID and username | Sign-in, account ownership and owner support directory in Cloudflare Durable Objects. PCRC does not receive your GitHub password. | Kept while your account exists. Account deletion removes the username and directory entry. A minimal ID closure marker remains to prevent old credentials or delayed events recreating a closed account. |
| Sessions, OAuth and pairing | Browser sessions, CSRF protection, assistant authorization and matching-code pairing. Sensitive portal and action records are encrypted at rest. | Portal sessions expire after 24 hours; sign-in and pairing transactions after 5 minutes. Assistant access tokens last 15 minutes, refresh tokens 24 hours, and client registration records 7 days. Expired local records are removed by background maintenance; OAuth provider records follow their configured expiry and revocation behavior. |
| Device identity, public key, capabilities and presence | Approved-device routing and status in account storage. The service does not store the device private key. | Active device records last until account deletion. Revocation blocks the device immediately; revoked metadata is removed after 30 days during maintenance. Older revoked records start that clock when first processed. |
| Usage and recent activity | Quotas, usage graphs and troubleshooting. Records contain tool name, device ID, time, duration and outcome, not tool arguments or result bodies. | Daily counts cover approximately 186 days. Recent activity keeps at most 50 entries for 30 days. Lifetime totals remain until account deletion. |
| Approved action results | After you click Approve and run once, PCRC briefly stores the exact action and a bounded result encrypted for your account in Cloudflare Durable Objects. This lets your assistant retrieve completion without repeating the action. Approved screenshot results may include private screen content and are delivered to your AI client for inspection. | Results are inaccessible after 10 minutes; maintenance removes expired records. Account deletion also removes them. Text results larger than 32 KiB and image results larger than 768 KiB are replaced with a size-limit notice. Larger supported image results are stored as encrypted chunks. |
| Pending control approvals and replay protection | One-time approval of exact actions and protection against reused device proofs. | Approvals expire after 5 minutes and relay nonces after 3 minutes. Maintenance removes expired stored entries. |
| Request abuse counters | The gateway uses edge IP and route in bounded in-memory counters. Shared counters use a keyed pseudonym derived from edge IP, site origin and route group. | Memory counters use minute windows; shared counters are removed by an alarm after the hour plus one minute. Shared counters do not store raw IPs, request bodies or tokens. |
| Subscription and payment references | Paddle processes checkout and payment details. PCRC stores subscription ID, status, price ID, event references and cancellation state for entitlements and support. | PCRC references are removed on account deletion after all subscriptions are fully canceled. Paddle retains its own transaction, tax and legal records under its policies. Deleting PCRC does not delete Paddle records. |
| Local credentials, backups and audit records | The installed agent stores these on your computer to reconnect and recover supported file changes. | Account deletion and revocation do not uninstall software or erase local files and recovery backups. You manage local removal separately. |
Background cleanup and recovery copies
Maintenance runs every five minutes and processes five accounts per run, rotating through the account directory. Physical cleanup can occur after a validity period ends; failures are retried on later sweeps. Large accounts may need multiple cleanup passes. We do not claim a guaranteed deletion completion time during beta.
Cloudflare SQLite Durable Object point-in-time recovery can retain earlier database states for up to 30 days. Active-service deletion does not instantly erase provider recovery history. Recovery must preserve closed-account restrictions before access resumes. The production restore drill is still pending.
Close your account
Open Account & privacy, review the consequences, and type DELETE. All subscriptions must already be fully canceled. PCRC blocks computer access, disconnects device connections, revokes assistant grants, removes account data and clears the public account directory. Cleanup can continue in the background if a provider is unavailable. Commands already accepted by a computer cannot necessarily be stopped.
A minimal account-ID closure marker and deletion time remain to enforce closure. Closure is permanent in the self-service flow. Contact support before attempting to rejoin. This does not delete your GitHub account, AI conversations, files on your computer, or independently retained Paddle records.
Providers, access and your requests
Paddle sandbox checkout is for test payments only; live checkout charges real money. The billing page identifies the mode. When you view localized pricing, your browser contacts Paddle, which uses your IP address to estimate your country, currency and applicable tax. PCRC displays Paddle’s current formatted quote without retaining that preview or adding a fixed exchange rate.
GitHub provides sign-in; Cloudflare hosts the gateway and storage; npm distributes the launcher; Paddle processes billing; your chosen AI provider processes its conversation. Their infrastructure may process data outside India. The owner console provides support, account status, usage, subscription management and public prompt publishing; it does not grant the operator control of users' computers.
We use account and connection metadata to provide the requested service, protect access, enforce quotas and handle support. For access, correction, deletion assistance or a privacy concern, email the contact above from an address you control. We may ask you to verify account ownership through sign-in. Do not email passwords, access tokens, pairing codes, private keys or identity documents. Changes to this notice will be dated on this page.