Privacy Policy

Last updated: November 1, 2026

This English version is provided for convenience. If there is any conflict between it and the Spanish version, the Spanish version prevails, except where the law of your country of residence requires otherwise.

1. Controller

Kreatt Enlace Inmobiliario (“we”, “us”), with its address at Plaza Lomas 56-A, Col. Lomas del Tecnológico, C.P. 78215, San Luis Potosí, S.L.P., Mexico, is responsible for processing your personal data in DuoRemote. Privacy contact: Juan Chalita, juanchalita@gocodex.dev.

2. What we don’t see

Your screen, what you type and what you do on your Mac travel end-to-end encrypted between your iPhone and your Mac. The keys exist only on your devices. Our relay servers only pass along bytes they cannot read and never store session content.

3. Data we process

• Account: internal identifier, email address (if you provide it or Apple shares it, which may be a private relay address) and name (if you share it).
• Sign in with Apple: the user identifier contained in Apple’s identity token and, where applicable, a token that lets us revoke access when you delete your account. We never receive your Apple password.
• Passkeys: only the public key and technical metadata; the private key never leaves your device.
• Devices: name, type and public keys of each paired Mac and iPhone, and pairing and last-used dates.
• Subscription and billing: plan, status, dates and your Stripe customer ID. Payment details (card, billing address) are collected and handled by Stripe; we never see your full card number.
• Country: the country Cloudflare infers from your IP address and the one in your billing details, to show prices in your currency and calculate taxes.
• Relay metadata: when you connect away from home, IP addresses, device identifiers, start and end times and the amount of data transferred, to operate the service, prevent abuse and troubleshoot.
• Technical and security logs: API requests, errors and sign-in attempts.
• Support: whatever you write to us when you contact us.

4. How we use it

Purposes necessary to provide the service:

• creating and protecting your account and letting you sign in without a password;
• pairing your devices and connecting them, at home and away;
• managing your subscription, charges, taxes and invoicing;
• sending you notices about your account, payments and important changes;
• security, fraud and abuse prevention, and compliance with legal obligations.

We do not sell your data, we do not use it for advertising and we do not share it for advertising based on your activity. If we ever want to send you product news, we will do so only with your consent, which you can withdraw at any time.

Legal bases (if the GDPR applies to you): performance of the contract (account, connection and subscription), our legitimate interests (security, abuse prevention and service improvement), compliance with legal obligations (tax and accounting) and, where applicable, your consent.

5. Who we share it with

Only with providers that process data on our behalf (processors) under contract:

• Cloudflare, Inc.: hosting for the website, API, database and relay servers; IP-based country detection.
• Stripe, Inc. and affiliates: payment processing, subscriptions, tax calculation and fraud prevention.
• Resend, Inc. (United States): sending sign-in emails and account notices.
• Apple Inc.: when you choose Sign in with Apple, and to revoke that access when you delete your account.

We may also disclose data when required by law or a competent authority, or to defend our rights. Transfers to these providers are necessary to provide the service.

6. International transfers

Our providers may process data outside your country, including in the United States and other countries. Where the law requires it, we use appropriate safeguards such as standard contractual clauses or recognized adequacy mechanisms.

7. How long we keep it

• Account, passkeys and devices: for as long as your account exists.
• Relay metadata: up to 30 days.
• Technical and security logs: up to 90 days, unless needed to investigate an incident.
• Subscription, payment and invoice records: as long as tax and commercial laws require (in Mexico, generally 5 years); Stripe keeps them under its own obligations.
• When you delete your account, we erase your data from our active systems immediately or within 30 days at most; backups are overwritten within the following 35 days.

8. Deleting your account

You can delete your account at any time from your account or from the DuoRemote apps. When you do, we cancel your subscription immediately, erase your account data, unpair and delete your devices and revoke Apple access, except for records the law requires us to keep.

9. Your rights

• Mexico (Federal Law on the Protection of Personal Data Held by Private Parties, LFPDPPP): rights of Access, Rectification, Cancellation and Opposition (ARCO), to withdraw consent and to limit the use or disclosure of your data. If you believe your rights have been infringed, you may contact the competent data protection authority.
• European Union, European Economic Area and United Kingdom (GDPR): access, rectification, erasure, restriction, portability and objection, and the right to lodge a complaint with your supervisory authority.
• California (CCPA/CPRA) and other U.S. states: the right to know what data we hold, to request its deletion or correction and not to be discriminated against for exercising your rights. We do not sell or “share” personal information as those laws define it.

To exercise them, email juanchalita@gocodex.dev from your account’s email address. We may ask for information to verify your identity. We respond within the legal deadlines (for example, 20 business days in Mexico and one month in the EU).

10. Security

We use end-to-end encryption for sessions, encryption in transit for everything else, passwordless authentication and restricted access to our systems. No system is infallible; if an incident affects your data, we will notify you as required by law.

11. Cookies and local storage

We use only one essential cookie to keep you signed in, and your browser’s local storage to remember preferences such as language. We do not use advertising or third-party tracking cookies.

12. Children

DuoRemote is not directed at children under 16 and we do not knowingly collect their data. If you believe a child has given us data, contact us and we will delete it.

13. Changes to this policy

We may update this policy. We will post the new version here with its date and, if the changes are material, notify you by email or in the service.

14. Contact

Kreatt Enlace Inmobiliario · Plaza Lomas 56-A, Col. Lomas del Tecnológico, C.P. 78215, San Luis Potosí, S.L.P., Mexico · Juan Chalita, juanchalita@gocodex.dev