Privacy Policy

1. Desktop app: your data never leaves your computer

All data in the CM Remote Panel desktop client — connection profiles, server addresses, accounts, passwords and private keys — is stored in a local SQLite database on your device, encrypted with AES-256-GCM. The encryption key is derived from your login password, exists only in memory after login, and is never written to disk.

• No telemetry: The app contains no analytics, statistics or crash reporting, and never sends your server information to us.
• Direct connections: Traffic between the app and your servers is end-to-end encrypted (SSH / FTPS) and never relayed through our servers.

2. Optional email recovery — only if you turn it on

Email recovery is off by default. If you choose to bind it inside the software (Settings → Recovery), the following is sent to our server so it can later help you regain access to a forgotten password:

• Your email address: Used only to send verification codes and to look up your recovery binding — never used for marketing and never shared.
• Machine code: A non-secret device identifier already shown on the login screen, used only to tell your devices apart.
• An encrypted helper key (SRK): A randomly generated key, encrypted at rest on our server. On its own it cannot decrypt anything: your password, private keys and saved credentials never leave your device, and unlocking your local database also requires a separate piece that only ever exists there — a server breach alone is not enough to read your data.

Binding, verification and redemption attempts are recorded in the same security audit logs described below, and follow the same retention.

3. What the website collects

When you visit this Site, we collect only what is needed to keep the service running:

• IP address: Used for rate limiting and abuse protection on download, recovery and contact endpoints, and recorded in security audit logs.
• Message content and email: When you submit the contact form, your message and email address are forwarded to the administrator by email, solely to reply to you.
• Captcha answers: The arithmetic answer before downloads is verified once and then deleted.

This Site uses no third-party analytics or advertising trackers and sets no tracking cookies; only the administrator login uses a necessary session cookie.

4. Storage and sharing

Rate-limit counters and verification data are kept in a cache and expire automatically. Audit logs are used for security investigations and cleaned up periodically. We never sell or share your personal information with third parties, except where required by law.

5. Your rights

You can ask us to delete your contact-form records, unbind an email recovery registration, or raise any privacy question via the contact form in the Help Center. Desktop app data lives on your own device — uninstalling the app and deleting its data directory removes it completely.

6. Changes to this policy

Material changes will be published on this page with an updated date. Please check back periodically.