Privacy policy

Effective October 31, 2026

YepControl is operated by Graehl Arts (Kyle Graehl). It lets you pair a browser or CLI controller with an Android phone you control, then request access to that phone. No account is required. We do not include advertising, advertising identifiers, marketing analytics or an analytics SDK.

Your screen and controls

Screen images, video, text, control actions, device details and any PIN you enter remotely are encrypted between your phone and paired controller. Our relay forwards encrypted records when a direct connection is unavailable. The relay does not have the session keys needed to decrypt those records, and does not save screen recordings or control content.

The phone and your paired controller can read the content you deliberately share. Only pair browsers and devices you trust. Android can restrict protected screens and sensitive fields. Screen sharing and control require the relevant Android permissions and your approval.

Optional camera and microphone sharing

Remote camera and microphone sharing are separate optional features, both off by default. Each requires its own in-app setting and Android permission. Enabled paired controllers can deliberately start the selected sensor. Android shows its camera or microphone indicators and, when notifications are allowed, an active sharing notification with Stop sharing. Connecting, reconnecting or waking the app does not start capture.

Camera images/video and microphone audio are encrypted between the phone and the paired controller, through a direct connection or the relay. The relay cannot decrypt them and does not record them. The phone does not save a recording. The browser displays camera frames and plays live audio without requesting its own camera or microphone. A CLI controller can deliberately save private JPEG or WAV files locally; those files remain until their owner deletes them. Your controller and anyone with access to those files can read their content.

Stop sharing, turn off either sensor setting, pause or remove a paired controller, or turn off remote access to stop sharing. Loss of permission or connection and expired media leases also stop capture. Android may prevent background sensor access or interrupt it; reopening the app or restoring screen-access permission may be needed. Use sharing only on phones you control and with the awareness and permission of people nearby.

Connection information we handle

Our relay stores random pairing identifiers, public cryptographic keys, signed pairing receipts, access settings and revocation records so it can authenticate paired devices and enforce your choices. These are connection metadata, not your shared screen, camera or microphone content. Browser nicknames, phone names, local activity history, private identity keys and saved PINs are not uploaded as readable relay data.

Like other network services, the relay receives your IP address and can observe connection times and encrypted traffic sizes. We use IP addresses for short-lived request-limit counters. We do not run a website analytics beacon or configure routine web-access logging for YepControl. Operational error logs may contain technical network information; we do not intentionally log pairing secrets or screen, control, camera or microphone payloads.

Optional background connections

Cloudflare operates our hosted website and relay, including storage of the connection metadata described above. Cloudflare also processes network information to deliver and protect its infrastructure under its privacy policy.

If you enable background connection requests, the app uses Google's Firebase Cloud Messaging and Firebase Installations. An installation identifier is registered with our relay so it can ask Google to wake this app when an authorized browser requests a connection. A push contains connection-request identifiers and expiry information, never your screen, typed text, PIN or a command to control the phone.

Google processes installation and service metadata needed to operate Firebase. Direct WebRTC connections also use Google's public STUN service to discover network routes; that service can see network addresses, not the encrypted remote session. See Firebase privacy information and Google's privacy policy. We do not enable Google Analytics or Firebase message-delivery export to BigQuery.

Information kept on your devices

The Android app keeps paired-device settings, private identity keys and activity history locally. Activity records describe connection and settings events, not screenshots or typed content, and are limited to 30 days or 10,000 entries. An optional saved PIN is encrypted on the phone, excluded from Android backup and removable in the app. It is not sent to the relay or your controller as a saved credential.

Your browser uses local storage and IndexedDB for appearance preferences, pairing keys, saved phones and contact history. These are functional storage, not advertising or tracking cookies. Removing a phone from a browser deletes that browser's saved entry; revoke the browser in the phone app to remove its permission to connect.

Retention and your choices

When Allow unrestricted remote control is on, trusted paired controllers can operate this app’s configuration, change unlock settings and add independently removable controllers. For Android 0.10.0 only, an upgrade with an existing non-revoked pairing enables this setting once. New installations default to off. You can change the setting in the app’s Settings; paused or removed access and per-device unlock permission remain separate.

You can turn off remote access, disable background requests, remove a paired device and forget a saved PIN in the app. Changes that need to reach our relay take effect there when the phone can connect. Removing a paired device revokes its access and removes its background-wake address from the active registry.

We retain revoked pairing identifiers, public keys and receipts to prevent reuse of old grants. Relay-storage recovery history and retained encrypted authority backups can contain pairing metadata, revocation records and background-wake addresses. They do not contain screen content, private identity keys or PINs. Cloudflare provides a rolling relay-storage recovery history for up to 30 days; an address removed from active storage can remain in that history or in retained backups. We do not currently apply a fixed expiration to revocation records or authority backups. Google controls retention of data within Firebase under its own policies.

Request data deletion

To request deletion of identifiable connection metadata, email graehlarts@gmail.com with the subject “YepControl data deletion”. Describe the device or pairing concerned. We may ask for a pairing or installation identifier and proof that you control the device. Do not email PINs, pairing secrets, private keys or screenshots containing private information. There is no YepControl account to delete.

Removing a paired device in the app deletes its active background-wake address from our relay when the phone can connect. You can also request that we remove an identifiable active wake address. Revoked pairing identifiers, public keys and receipts remain in revocation records and encrypted authority backups to prevent old access grants from being reused; these records currently have no fixed expiry. Removed wake addresses may remain in recovery history or retained backups as described above. Screen recordings, camera images, microphone audio, control content and private keys are not stored by our relay. Google manages data within Firebase under its own retention policies.

Sharing and international processing

We do not sell data or share it for advertising. Connection metadata is processed only to provide, secure and operate the service, including through infrastructure providers and Google where described above. Service providers may process data in countries other than yours. We may disclose information when legally required.

Children and policy changes

YepControl is intended for people aged 13 and older and is not directed to children under 13. Contact us if you believe a child has supplied identifiable information to the service. We will update this page when our practices change and show the effective date above.