# MasterDesk privacy notice

Last updated: 2026-08-01

This notice describes the test MasterDesk service operated through
`masteronline.space`. The current API deployment is intended for authorized
testers and is not yet a production commercial service.

## Data processed

MasterDesk may process the following data when the corresponding feature is
used:

- account identifier and securely hashed account password;
- authentication tokens and login timestamps;
- public IP address, MasterDesk device ID, device name, operating-system and
  client-version metadata;
- address-book entries, aliases, tags, notes and sharing rules entered by the
  account user;
- connection and file-transfer audit metadata generated by the service.

Remote screen contents, transferred files, clipboard contents and audio/video
streams are not intentionally stored by the ID, relay or account API services.
Relay traffic may pass through the MasterDesk relay server when a direct
peer-to-peer connection cannot be established.

At startup, when update checks are enabled, the client requests a small
version manifest from `api.masteronline.space`. The web server may record the
source IP address, request time and standard HTTP metadata. The request does
not include address-book contents or remote-session data.

## Purpose

The data is processed only to authenticate users, synchronize address books,
establish explicitly requested remote-access sessions, protect the service
against abuse, investigate failures and maintain service security.

## Storage and disclosure

Test data is stored on infrastructure controlled by the MasterDesk operator.
It is not sold and is not used for advertising. Infrastructure providers may
process limited network and hosting metadata as required to operate the
service.

Test accounts and address-book data may be removed when the test is reset.
Production retention periods and customer agreements will be published before
commercial availability.

## User choices

Account login and synchronized address books are optional. A user or system
administrator may configure another compatible self-hosted server or use the
client without signing in. Requests to inspect or delete test account data can
be submitted through the private security contact described in
[SECURITY.md](SECURITY.md).

## Source code and licensing

The MasterDesk client source is published under AGPL-3.0 in this repository.
The test account/address-book API is based on the MIT-licensed
[`lejianwen/rustdesk-api`](https://github.com/lejianwen/rustdesk-api) project.
