Privacy

The short version

No account is required to use ZlefRemote.

We cannot see your keystrokes, mouse movements or screen. In remote mode everything is end-to-end encrypted, and the relay only ever handles sealed data it has no key to open.

In local-network mode, nothing leaves your own network at all.

No tracking cookies. No advertising. Nothing sold to anyone.

The agent on your computer

The agent is a small program you run on the computer you want to control. It injects mouse and keyboard events into your operating system and does nothing else in the background.

Each time it starts it generates a fresh 256-bit encryption key, on your machine. That key is placed only inside the QR code it shows you — it is never sent to any server.

If you start the agent with the optional --remember flag, the key is instead saved locally on that computer (in your user config directory, readable only by your account) so your saved phones can reconnect in one tap without rescanning. The relay “room” is then derived from that key by a one-way hash — it still reveals nothing about the key and is never sent to any server. You can rotate it any time with --reset-identity.

On startup the agent sends one anonymous ping (its version, operating system, architecture and the chosen mode — nothing else, and nothing about your session, your input or the computer) so we can gauge how many people use it. You can turn it off with the --no-telemetry flag, the DO_NOT_TRACK=1 environment variable, or a build compiled with telemetry off — see the repository for details.

Apart from that single ping, the agent contains no analytics or telemetry. Its source code is public, so anyone can verify all of this.

Remote mode — the relay (remote.zlef.fr)

When you connect from outside your network, your phone and computer pair through our relay using a short room code. The relay’s only job is to pass messages between the two.

Every message is encrypted on the device that sends it and decrypted only on the device that receives it. The relay holds no key, so it cannot read a single keystroke or mouse movement — it forwards opaque bytes.

Sessions live in memory only. A room exists while your session is open and is discarded when you disconnect or after a period of inactivity. We never store the contents of a session.

Local-network mode

On the same Wi-Fi, your phone talks directly to your computer. The relay is not involved and your data never leaves your network.

The Android app

The app holds one 256-bit key per saved computer, in the Android Keystore. Those keys never leave the phone: they are what encrypts your session, and losing them is the only thing that can un-pair a device.

Permissions and why: the camera reads pairing QR codes and is used for nothing else, and no image is stored or sent; notifications carry the session card with your computer’s playback controls; a foreground service keeps the connection alive while the screen is off; “install packages” exists only so the app can install its own update, which you download from this site.

The app plays no audio and takes no audio focus — the lock-screen controls are a real media session, so music playing on the phone itself is left alone.

The app contains no analytics and sends no telemetry. It contacts remote.zlef.fr for exactly two things: the encrypted relay socket, and the update manifest when you check for a new version.

There is no iOS version, so no data is processed on iPhones by any app of ours — an iPhone uses the web remote, covered above.

This website

Analytics: our pages load a lightweight, shared analytics script that counts anonymous page views and visible time. It uses no cookies and no fingerprinting; a per-visit identifier lives only in your browser tab and is erased when you close it. It never follows you across sites.

Server logs: like any website, requests to remote.zlef.fr reach our server, which keeps short-lived technical logs (IP address, browser user-agent, time and path) to keep the service running and to prevent abuse.

Optional sign-in: you can use ZlefRemote without an account. If you choose to sign in with a zlef.fr account, we recognise it only to attribute your session and apply fair-use limits.

“Send to your desktop” buttons: the email, Telegram, share and copy actions on the “Start a session” page run inside your own apps. The only information involved is the public download link — we do not see or store anything from those actions.

No third parties

We don’t use advertising networks, and we don’t sell or share your data. The relay and this website are operated as part of zlef.fr.

Your choices & contact

Because we don’t hold the contents of your sessions, there is nothing of yours for us to retrieve or delete from them. For anything else — a question, or a request about website logs or an optional account — write to [email protected].

Changes

If this policy changes, we’ll update the date at the top of this page.