RemoteSync Privacy Policy

Overview#

This policy explains what the RemoteSync app for Mac and this website do with data. The app and the website work differently, so they are described separately. In short: the app collects no data about you or your code. It has no account, no analytics and no server of ours. It connects only to the destinations you set up, to the sign-in services you choose to use, and to your repository’s Git LFS server. The website sets no cookies.

Who we are#

RemoteSync is made by Krk Today d.o.o., Croatia (“we”), the controller of the personal data described here. This policy covers the RemoteSync app for Mac and this website, remotesync.krk.today. For anything about privacy, write to info@krk.today.

Data we do not collect#

The RemoteSync app sends nothing to us. In particular, it has:

• no analytics, usage statistics or telemetry, and no automatic error reporting;
• no advertising, advertising identifiers or tracking across apps and websites;
• no account, registration or sign-in with us;
• no update checks or other requests to a server of ours;
• no copies of your code, file names, server addresses, user names or passwords sent to us.

What is stored on your Mac#

Everything RemoteSync remembers is stored only on your Mac, inside the app’s sandbox container: your projects (name, repository folder, deploy folder, host, port, user name, remote folder, exclude rules, the trusted SSH host key or FTPS certificate, and the folders you have given the app access to), the upload history of each project (which files were sent with which content), and your preferences.

Passwords, SSH key passphrases, Google Drive, Dropbox and GitHub sign-ins, Git LFS tokens and the OAuth clients you enter in Settings are kept in your macOS Keychain, never in a project file.

Git LFS files downloaded for a deploy are cached in the container and pruned to 2 GB after each deploy. The activity log is kept in memory only and is gone when you quit; you can copy it yourself, and it never contains passwords or tokens.

Your repositories and files#

RemoteSync runs in Apple’s App Sandbox. It sees only the folders and files you choose in the standard macOS Open dialog: repositories and SSH key files are opened read-only, and it writes only to the local, iCloud Drive or mounted-share folders you choose as targets. Check Out Branch asks separately, once, for permission to change a repository folder.

• Files you deploy go only to the destination of that project, and only the rows of the plan you left checked.
• Older commits are written to a temporary folder inside the app’s container for the deploy and deleted afterwards.
• SSH private keys are never copied: the key is decrypted in memory to sign the SFTP login, and only the signature goes to the server.

Servers, cloud services and sign-ins#

RemoteSync connects directly from your Mac, and only to:

• the servers you set up (SFTP, FTPS, FTP or SMB), with the user name and password or key you entered;
• Google Drive or Dropbox, for projects that use them: you sign in in your browser, and RemoteSync receives a token for your account and its email address, which it shows as the project’s account;
• GitHub, only if you sign in under Settings to download Git LFS files of private repositories;
• your repository’s Git LFS server, only when a Git LFS file isn’t already on your Mac.

During a Google Drive or Dropbox sign-in the app listens on your own Mac (127.0.0.1) for the browser’s reply. iCloud Drive and local folders are written through macOS; RemoteSync makes no network requests of its own for them. These services handle your data under their own privacy policies; nothing passes through a server of ours. Sign Out removes the token from your Keychain and, where the service allows it, revokes it there too.

Settings export files#

Export Settings writes one file, where you choose, with your projects, their passwords and sign-ins, upload history and preferences, so you can move them to another Mac. The file is encrypted with a password you choose (AES-256-GCM); without that password it can’t be read, and we never receive it or the password. Keep both safe: anyone with the file and its password gets your server logins.

App Store purchases and diagnostics#

RemoteSync will be sold through the Mac App Store. Apple handles the purchase and payment under Apple’s own privacy policy; we don’t receive your name, email address or payment details. Apple gives us aggregated sales and download figures.

If you chose in macOS to share analytics with app developers, Apple may also give us crash reports and usage statistics that do not identify you. We use them only to find and fix problems.

Website privacy#

• No cookies, analytics or advertising, no third-party scripts or fonts, and nothing stored in your browser.
• The small flag images of the language switcher are loaded from flagcdn.com, which receives your IP address and the request like any web server. The screenshots and the demo video come from this website.
• Server logs: like any web server, ours may keep technical access logs (IP address, time, page requested, browser type) to keep the site secure and running. They are processed by our web hosting provider on our behalf, kept only as long as needed for that purpose, and never used to identify or track you. Legal basis: our legitimate interest in operating a secure website (GDPR Art. 6(1)(f)).

Contact emails#

If you email us, we use your email address and message only to answer you and handle your request; the same goes for an activity log or a file you choose to send us to show a problem. They are processed by our email provider on our behalf, kept only as long as needed for that and any follow-up, and never sold or shared for marketing. Legal basis: answering you and taking steps you ask for (GDPR Art. 6(1)(b) and (f)).

Children#

RemoteSync collects no personal data from anyone, including children.

Your rights under the GDPR#

You may ask us what personal data we hold about you, and have it corrected, deleted or restricted, object to its use, or receive a copy. As the app collects none, this normally concerns only website logs and emails you sent us. Write to info@krk.today; we answer within one month.

You may also lodge a complaint with the Croatian data protection authority, AZOP (azop.hr), or with the authority of the EU country where you live.

Policy changes#

If this policy changes, we update it here and change the date at the top. If a version of the app ever handles data differently, this page will say so before that version is released.