Tonttu — Privacy Policy

Last updated: 3 November 2026

1. Who I am, and the short version

Tonttu is made by Volodymyr Linkevych, an individual developer in Cyprus. It lets you control your computer's mouse and keyboard, and related things such as apps, files, sound and the microphone, from your phone or tablet ("your device") over your own network. I am the controller of the personal data described here. Contact: feedback@tontturemote.app.

The short version:

• There is no account, no analytics, no advertising and no tracking.
• Everything you do with the remote stays on your own network, between your device (the phone, tablet or other computer you control from, through its browser) and your computer (the Windows PC that runs the app). That includes what you type, the text around the cursor in the field you are typing in (sent to the device so its text field can follow; never password fields), your clipboard, files you send or download, microphone audio, and which apps and windows are open. None of it is sent to me.
• Data reaches me only when you send feedback yourself.
• Your computer contacts my website and GitHub to check for updates and download them.

2. What is stored on your computer

This data stays on your computer. I never receive it.

Logs never contain what you type, clipboard contents, file or folder names, window titles, app names, web addresses, pairing codes or keys. Network addresses are shortened to their last part; the names you give your devices are kept. A troubleshooting mode in Settings adds more detail (timings, technical state) for 24 hours under the same rules. You can open or delete the logs from Settings.

When you uninstall, you choose whether to keep or delete pairing, certificates, settings and logs.

3. What is stored on your device

The web remote keeps a few items in your browser's storage on your device:

• a random device ID, so your computer can recognise the device without showing a notification every time;
• the device's pairing key.

This is not used for tracking and is never sent anywhere except to your own computer. Clearing the website data for the remote in your browser deletes it. The certificate profile you install stays on the device until you remove it (on an iPhone or iPad: Settings › General › VPN & Device Management).

4. What leaves your devices

Update checks and downloads (my website and GitHub). About once a day your computer downloads a small update information file from my website, tontturemote.app, which is hosted by GitHub Pages, and downloads new versions from GitHub. GitHub receives your IP address and the app's name and version. No device ID or other identifier is sent. You can turn update checks off in Settings. GitHub, Inc. (USA) handles this under its own privacy statement.

The website (GitHub Pages). When you visit the website or download the installer, GitHub receives your IP address and browser details as part of serving the page. The website uses no cookies, analytics or third-party scripts.

Feedback, only when you send it. During the beta, feedback is an email you write and send yourself from your own email app, so I receive what you write and the address you send it from. The email is addressed to feedback@tontturemote.app; it passes through Cloudflare (email routing for my domain) to a Google mailbox, each under their own privacy terms. If you tick "Attach diagnostics", the app saves a zip file on your Desktop for you to attach: your message, the app, Windows, .NET and WebView2 versions, and the app's recent logs after addresses, your Windows user name, email addresses and keys are removed. You can open the zip and see exactly what is in it before you attach it.

The microphone driver. If you use the microphone feature, the app can open VB-Audio's website so you can download VB-CABLE. VB-Audio's own privacy policy applies there.

I don't sell or share your data with anyone else.

5. Legal bases (GDPR)

Update checks and downloads go to GitHub in the USA. GitHub is certified under the EU-US Data Privacy Framework. Feedback email is handled by Cloudflare, Inc. and Google LLC (both USA, both certified under the same framework).

6. How long I keep feedback

• Your reply email address and any diagnostic log: deleted when our conversation is closed, and at the latest after 12 months.
• The feedback text and type: kept without your email or log, to track problems and ideas.
• Data held by GitHub, Cloudflare, Google and VB-Audio is kept under their own policies.

Data stored on your computer and device is described in sections 2 and 3, and you control it.

7. Your rights, children, changes, contact

Your rights. You can ask me to access, correct, delete or export personal data I hold about you, to restrict its use, or object to it. Where you gave consent, you can withdraw it at any time. Write to feedback@tontturemote.app; I'll answer within one month. You can also complain to the Commissioner for Personal Data Protection in Cyprus (dataprotection.gov.cy) or the authority where you live.

Children. The software is not aimed at children under 14. I don't knowingly collect data from them. If you think a child sent me feedback, contact me and I'll delete it.

Security. Connections between your device and computer are encrypted (TLS) and need a pairing key. The certificate you can install on your device only works for home-network addresses, so it cannot be used to impersonate websites. Feedback logs are redacted before you attach them. To report a security problem, write to security@tontturemote.app.

Changes. If this policy changes, I'll update the date at the top and show the change in the app's update notes or on the website. New kinds of data collection will be described here before they start.

Contact. Volodymyr Linkevych, Cyprus · feedback@tontturemote.app