HCKConnect← Legal
Privacy Policy
This policy explains what we collect when you use HCKConnect, why, and your choices. If you are helped through Quick Support, or your computer is managed by someone else, that person or organization decides how the session is used and is responsible for it.
1. What we collect
| Data | Why |
|---|---|
| Account: name, email, username, password (stored only as an Argon2 hash), two-factor secret if you turn it on, and when you accepted our Terms | Create and secure your account, and keep a record of your agreement. |
| Computers: device name, friendly name, operating system, app version, online status, last-seen time, network hardware (MAC) address, public IP address, and a hashed device identifier | Show your computers, route connections, recognize a reinstall, and send Wake-on-LAN. |
| What you enter: computer notes, groups, favourites, install link names, team names, and invited email addresses | Provide those features. Notes are not end-to-end encrypted, so do not store passwords in them. |
| Activity: sessions (who connected to which computer, when, how long, and from what IP address), sign-ins and failed sign-ins, and changes to your account | Show you your activity log, and for security and abuse prevention. |
| Quick Support: the helped computer's name and operating system, its IP address, and a hashed copy of the one-time code | Connect the session and prevent abuse. |
| Server logs: IP addresses, request details and errors | Run, secure and fix the service. |
2. Session contents
The contents of a remote session (screen video, audio, keystrokes, mouse input, clipboard and transferred files) are end-to-end encrypted between the two devices. Our relay passes the encrypted data along and does not record or store it. If you record a session, the recording is saved on your own device, and getting any consent that recording requires is up to you. See Security for how this works and its current limitations.
3. Cookies and tracking
We do not use advertising or analytics trackers. The web app stores your sign-in token in your browser's local storage so that you stay signed in. Our website's font and scripts are served from our own servers.
4. How we use data
We use data to provide and secure the service, authenticate you, connect sessions, prevent and investigate abuse, contact you about your account or changes to the service, and meet legal obligations.
5. How we share data
We do not sell or share your personal information for money or for cross-context behavioral advertising. We disclose data only:
- to service providers, currently DigitalOcean for hosting. If we add an email or payment provider, it will process only what it needs for that purpose, and we will update this page;
- within your team, where members see computers shared with them, but not the owner's notes;
- to the person you connect with, who sees your account name or email in the connection prompt and on install pages;
- when the law requires it, or where reasonably necessary to protect people, the service or our rights, including investigating unauthorized access or fraud; and
- in a business transfer, such as a merger or sale, subject to this policy.
6. How long we keep it
- Account and computer records: while your account is active.
- Activity log entries: up to 12 months.
- Quick Support codes: deleted about 2 hours after creation. Unused temporary computer records: deleted after about 24 hours.
- Password reset links: deleted within about a day of expiring.
- Backups and server logs: kept for as long as we need them for operations and security.
Ask us to delete your account and we will delete or de-identify its data, except what the law requires or allows us to keep, such as records needed to investigate abuse.
7. Security
We use TLS in transit, end-to-end encryption for sessions, Argon2 password hashing, optional two-factor sign-in and rate limiting. No system is perfectly secure, and we cannot guarantee security. If a breach affects your personal information, we will notify you as the law requires.
8. Your rights
You can see and change much of your data in your account. Depending on where you live, you may also have the right to access, correct, delete or get a copy of your personal information, and to object to or restrict certain processing. To make a request, email support@hcktechnologies.com from your account's address. We will respond within the time the law requires, and may need to verify your identity first. We will not treat you differently for exercising these rights.
California residents: the California Consumer Privacy Act gives you the rights to know, delete and correct, to limit the use of sensitive personal information (we use account credentials only to provide and secure the service), and not to be retaliated against. We do not sell or share personal information, and you may use an authorized agent. In the past 12 months we collected the categories in Section 1 for the purposes in Section 4.
EEA and UK: we process data to perform our contract with you, for our legitimate interests in securing the service, to meet legal obligations, and with consent where required. You may complain to your local data protection authority.
9. Where data is processed
Our servers are in the United States. If you are elsewhere, your data will be transferred to and processed in the United States, where the law may differ from yours.
10. Children
HCKConnect is for people aged 18 and over. We do not knowingly collect children's data. If you believe a child has given us data, contact us and we will delete it.
11. Changes
We will post changes here and update the date above, and will notify account holders of material changes.
12. Contact
HCK Technologies, Inc. — support@hcktechnologies.com