Stop
Requests cooperative cancellation at Connect AI's next safe boundary. It neither removes remote authority nor deletes history.
Source-verified product facts
Privacy and data handling
Remote control necessarily carries sensitive data. RemoteEndpoints stores account, device, prompt, result, activity, and desktop-picture data so an authenticated browser can reach a paired LocalEndpoint Connect computer.
This page describes the current server implementation, including controls that are not available yet. It is first-party product documentation, not a legal privacy notice, independent audit, certification, or compliance claim.
At a glance
Private does not mean temporary.
- Account-boundLive computers, pictures, prompts, results, and activity are not public pages.
- Pictures are shortest-livedUploads keep the newest five and lazily prune pictures older than 24 hours.
- Prompts and results persistNo automatic age or count deletion exists for command history today.
- The demo is syntheticEntered mock values are validated and immediately discarded.
Where private control data moves
Browser to server to the paired Connect computer
The browser and Connect use separate credentials. The web server can see the data it authenticates, stores, and relays; it does not directly scan the computer or call Windows APIs.
-
Authenticated browser
Shows computers owned by the signed-in account, sends prompts, reads private pictures and results, and requests Stop, Pause, Resume, or Revoke.
-
RemoteEndpoints server
Authenticates account and device credentials, stores the current data categories below, and relays work and state through outbound Connect polling.
-
LocalEndpoint Connect
Captures desktop pictures, receives prompts, performs Windows work with its enabled capabilities, and returns state and results. No target-side person is expected to approve each later prompt.
Account email side path
Mailgun receives verification or neutral registration-attempt messages.
When account email is configured, RemoteEndpoints sends Mailgun the recipient address, message subject, and message text. An eligible unverified account message contains a time-limited verification URL. Every valid request that passes the outer abuse throttle makes exactly one provider attempt; ineligible, unknown, already verified, or inner-throttled states use the same state-neutral notice with no verification link. Outer-throttled requests uniformly skip delivery. Desktop pictures, prompts, and results are not part of either message.
Current server records
What is stored, who can use it, and when it leaves active storage
Four-column table. Scroll sideways to compare.
Expiry can end authority without deleting its database record. Revocation has a deliberately narrower deletion effect than account or history deletion.
| Data category | What is stored and why | Who can use it | Current lifecycle |
|---|---|---|---|
| Account and password | Account ID, email, display name, verification state, timestamps, and a salted password hash support authentication. Registration starts with email only and stores a non-credential marker until setup is finished. The plaintext password is not stored. | A current email link opens the protected form where the email owner sets the account password and optional display name. The service then verifies the account, uses the normalized email for display, and makes every outstanding link unusable. Verified profile credentials cannot be changed by this flow. LocalEndpoint Connect never receives the password. | No automatic account expiry, self-service account deletion, password reset, or account export exists today. |
| Account session and sign-in metadata | A purpose-scoped session-token digest, creation, expiry and last-seen times, IP address, and browser user agent support authenticated access. | The browser holds the HttpOnly session cookie; the server accepts the matching cookie or explicit bearer for that account. | The configured session authority expires after 1 day. Sign out now deletes the current server session and clears its cookie; otherwise expired rows are not automatically purged. |
| Registration, sign-in, recovery, and pairing abuse controls | Purpose-scoped HMAC digests of normalized email/account and request source plus timestamps enforce request limits without storing plaintext email or source values in the attempt tables. | The account service checks email and source limits for registration/recovery, account and source limits for sign-in, and a source limit before an unauthenticated device-code start. Public account responses do not reveal whether an address exists. | Registration/recovery and sign-in attempt rows at least 30 days old are deleted during a later request. Device-code-start attempt rows at least 7 days old are deleted during a later start. Cleanup is request-driven, not a clock-driven physical maximum. |
| Verification and pairing records | Email-verification digest and status; device client name, human setup code, device/access-token digests, account binding, status, and timestamps support one-time setup. | Opening an email link moves its secret into a short-lived HttpOnly cookie without finishing the account. The protected setup form sets the password, verifies the email, and makes every outstanding link unusable. The signed-in account and polling Connect client use only their correctly scoped pairing step. | The verification link is configured for 1 hour and reissue for no more than once per configured interval. The device setup code lasts 10 minutes and issued device access is single-use for 15 minutes. Expired device-code rows are deleted during a later start; email-verification rows remain stored. |
| Pre-auth browser cookies | Random form-binding nonces, a short-lived verification bearer token after URL stripping, and signed account-result receipts support CSRF defense and refresh-safe registration/verification pages. They contain no email, password, account ID, prompt, result, or desktop picture. | Form-binding and result cookies are HttpOnly and SameSite=Strict. The path-scoped HttpOnly verification bearer is SameSite=Lax so a top-level cross-site email navigation can survive its token-stripping redirect; the subsequent POST remains browser-bound by a purpose-scoped Strict form cookie. | The form cookie lasts up to two hours, verification authority no longer than the configured link lifetime, and result receipts about ten minutes. They do not create an authenticated account session. |
| Paired computer metadata | Installation ID, computer and app-instance labels, app version, capabilities, authority gates, credential digest/generation, heartbeat, and revoke timestamps identify and govern one enrollment. | The owning account reads and controls its computers; the matching device credential can use only device-side routes. | Pause preserves the enrollment. Revoke invalidates the credential but retains the device record and metadata; fresh pairing can reauthorize that installation. |
| Prompts and results | Full prompt text, result message, status, stop flag, idempotency key, lease/attempt data, claim-token digest, and timestamps carry Connect AI work and its outcome. | The owning account reads history and queues/stops work; the matching device leases and updates its commands. | No automatic age limit, count limit, or self-service history deletion exists. Revoke stops queued/running work but retains prompt and result records. |
| Desktop pictures | Private JPEG, PNG, or WebP bytes plus type, size, dimensions, hash, capture time, and storage time show the signed-in desktop. | The matching device uploads them; only the owning account can read them through private no-store responses. | Each upload keeps the newest five. Pictures older than 24 hours are deleted on a later picture upload or read, so 24 hours is a lazy cleanup threshold rather than a clock-driven physical maximum. Revoke deletes all retained active pictures. |
| Activity history | Server-authored event type, headline, detail, and time explain control changes without copying prompt or result text into the activity record. | The owning account can read activity for its computer. | A new activity insertion keeps the latest 200 for that computer. There is no age expiry, and revoke retains activity. |
| Synthetic demo | Fixed fake computers, pictures, prompts, activity, and results explain the authenticated workspace without a real account or computer. | Anyone can view the clearly labeled public mock. | Entered demo values are validated and immediately discarded; no account, device, or production request record is created. |
Authority and deletion are different
What each control actually does
Pause
Stops unstarted work, signals running work to stop, and blocks new delivery while preserving the pairing and its stored history.
Disable or uninstall
Closes or removes the extension's local authorization gate. It is separate from server-side credential revocation and server data deletion.
Revoke
Invalidates the durable credential, terminalizes queued/running server state, and deletes retained active desktop pictures. Device, prompt, result, and activity records remain.
Sign out
Deletes the current server-side account session and expires its browser cookie. Other account sessions and paired-computer authority are unchanged.
Expiry
Causes an expired session, verification link, or setup code to fail authorization. Expiry alone is not database-row deletion.
Completed computer effects are separate. Stop, Pause, Disable, Revoke, Sign out, and Expiry cannot reverse a Windows or network effect that already completed.
Controls that are not self-service yet
- Delete the account and all related server records
- Export a complete account-data package
- Delete selected prompt, result, or activity history
- Use a password-recovery flow, passkey, or multi-factor authentication
- Send a private request to a verified public privacy or security contact
Until those controls exist, this page does not imply that a public form, email address, or automated rights-request workflow is available.
What this disclosure does and does not cover
- Mailgun carries account verification email when configured.
- The application source contains no advertising or analytics integration; hosting or reverse-proxy access-log retention is not specified here.
- The server stores token digests and password hashes, but this page makes no blanket encryption-at-rest or end-to-end-encryption claim.
- LocalEndpoint Connect and independently installed plugins can handle additional local or external data outside this server schema.
- This server does not store a dedicated .uai memory field or implement MemoryEndpoints agent-name or memory-lease ownership enforcement. A prompt, result, or visible desktop picture can still contain related material.
- Backup deletion, hosting region, legal-controller identity, and formal data-request terms are not established by this code.