Privacy Policy

1. Who We Are

Your privacy is important to us. This policy explains what personal data is processed when you visit vesselrdp.com or use the Vessel RDP software ("the Software"), why, and what choices you have.

The controller of this data is Carlos Sura, an individual developer based in El Salvador. Email: vesselrdp@carlossura.com. We have not appointed a data protection officer or an EU/UK representative.

2. At a Glance

3. Information We Collect

3.1 Support Form Data

When you contact us via our Support page, we collect your name, email address, and the contents of your message. This data is transmitted via Formspree and delivered to our support inbox. It is used only to respond to your inquiry and provide support. We aim to reply within 48 hours. The form is protected by Cloudflare Turnstile, which receives your IP address and browser signals to tell people from bots.

3.2 Website Usage Data and Cookies

Server logs. Our web server records standard log data for each request, including your IP address, browser type, the page requested, and the time. We use it to operate and secure the site. We do not combine it with other data to identify you. Because the site is served through Cloudflare, every request passes through Cloudflare's network first: Cloudflare sees your IP address and keeps its own logs under its privacy policy, and our server may record Cloudflare's address in place of yours.

Analytics. We use Google Analytics 4 to measure how the site is used, including clicks on our download buttons (with the release version and file name). Analytics cookies are off by default. If you decline in the cookie banner, or do not respond, Google Analytics does not set cookies or store identifiers on your device. In that case it still receives a limited, cookieless signal from your browser (page address, referrer, browser and device information, and your IP address, which Google uses to derive an approximate location). We use that signal for aggregate, modelled statistics. If you click Accept, Google Analytics also sets first-party cookies (_ga and _ga_*, typically lasting up to two years) to recognise returning visits. The statistics are pseudonymous, not anonymous. We do not enable Google Signals or advertising features, and we do not use this data for advertising. We do not sell your data.

Your cookie choice. Your choice is remembered in your browser's local storage (key vessel_cookie_consent). You can change or withdraw it at any time: Cookie settings.

3.3 Downloads

The Software is downloaded from download.vesselrdp.com, which is hosted on Cloudflare. Cloudflare receives your IP address and browser details when you download, and keeps its own request logs.

3.4 Data Stored Locally by the Software

The Vessel RDP software runs on your own machine. Your connection profiles, including server addresses, ports, usernames, display and quality preferences, and feature toggles (clipboard, audio, microphone) and, for SSH connections, the optional key file path, jump host and keepalive settings, are stored locally in an application database on your device (on Linux, under ~/.local/share/vesselrdp/). If you choose to save a connection password, it is stored in your operating system's keyring where available, and in an AES-256-GCM-encrypted local database as a fallback; where supported, authentication tokens are also kept in the keyring. We never receive your stored credentials, and SSH passwords, key passphrases and verification codes are never stored at all: they are handled by your system's OpenSSH. Separately, the Software keeps a local certificate-trust record (hostname, port, and certificate fingerprint for each server you've connected to) to detect impersonation on future connections, the same trust-on-first-use model used by SSH. This record also never leaves your device.

3.5 Crash and Error Reporting

Crash reporting is off unless you say yes. The first time you start the Software, it asks once whether you want to send crash reports. Nothing is sent before you answer, and closing the dialog counts as "no".

If you agree, the Software uses Sentry to report unexpected crashes and errors. A report contains technical diagnostic data: the error and stack trace, the application version, operating system details, and recent application log lines. Those log lines can include connection details such as a server address or username that you entered. We do not configure the Software to send personal identifiers, and before a report leaves your device we strip user, hostname and request context and replace your home-directory path. We do not intentionally collect your passwords, keystrokes, screen contents, clipboard data, or the contents of your remote sessions. Sentry's servers necessarily receive your IP address when a report is delivered. Reports are sent to Sentry's United States region.

Withdrawing. Open the Help (?) button in the Software and untick the crash-report option; it takes effect immediately and nothing further is sent. Setting the VESSEL_DISABLE_CRASH_REPORTS environment variable turns reporting off regardless of that setting. Crash reports are kept for up to 90 days. To have a report deleted sooner, contact us.

A local crash.log file is also written to your device; it is never sent automatically, and you may attach it when contacting support.

3.6 Your Remote Sessions

When you connect to a remote host, the Software communicates directly between your machine, that remote host, and, for Microsoft Entra ID (Azure AD) sign-in, Microsoft's authentication services. This traffic does not pass through us. The data exchanged during a session (including any clipboard, audio, or microphone content you enable) flows between you and the remote host you have chosen, governed by your organization's IT policy.

4. Legal Bases

If you are in the European Economic Area, the United Kingdom or Switzerland, we rely on these legal bases:

• Crash reports and analytics cookies: your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time without affecting earlier processing.
• Cookieless analytics signal and server logs: our legitimate interest in understanding how the site is used and keeping it secure (Art. 6(1)(f) GDPR).
• Support requests: taking steps at your request, and our legitimate interest in answering you (Art. 6(1)(b) and (f) GDPR).
• Spam protection (Turnstile): our legitimate interest in keeping the support form secure (Art. 6(1)(f) GDPR).

We do not make decisions about you by automated means.

5. Third-Party Services

These providers process data on our behalf or are contacted by the site or the Software:

• Formspree: processes support form submissions. Subject to Formspree's privacy policy.
• Cloudflare: proxies and protects vesselrdp.com (every page request passes through it), provides Turnstile spam protection on the support page, and hosts our downloads at download.vesselrdp.com. Subject to Cloudflare's privacy policy.
• Google (Analytics): analyzes website usage as described in section 3.2. Subject to Google's Privacy Policy and Google's data processing terms.
• Sentry (Functional Software, Inc.): processes crash and error reports from the Software, if you opt in, as described in section 3.5. Subject to Sentry's privacy policy.
• Microsoft: when you sign in to a remote host using Microsoft Entra ID (Azure AD), the Software contacts Microsoft's authentication endpoints. This interaction is governed by Microsoft's privacy policy.

6. International Transfers

We are based in El Salvador, and Formspree, Cloudflare, Google and Sentry process data in the United States and other countries. Where personal data is transferred out of the EEA, the United Kingdom or Switzerland, we rely on the provider's transfer mechanism: the EU-US Data Privacy Framework where the provider is certified under it, or the Standard Contractual Clauses in the provider's data processing terms.

7. Data Retention and Security

We keep personal data only as long as needed for the purpose it was collected for: server logs for 90 days, analytics data for 2 months, crash reports for up to 90 days, and support correspondence while needed to assist you, after which it is deleted. We protect the data we hold with commercially reasonable measures against loss, theft, and unauthorized access, disclosure, or modification. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

8. Your Rights

Depending on where you live, you have the right to:

• access the personal data we hold about you and receive a copy;
• have inaccurate data corrected, and have your data deleted;
• restrict or object to our processing, including processing based on legitimate interests;
• receive your data in a portable format; and
• withdraw consent at any time (see sections 3.2 and 3.5).

To exercise these rights, contact us at the address in section 11. We aim to respond within one month. You also have the right to lodge a complaint with the data protection supervisory authority in the country where you live or work.

9. Children

The website and the Software are not directed at children under 16, and we do not knowingly collect their personal data.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the new version on this page and update the date above. Where a change affects how we use data you have already consented to, we will ask again.

11. Contact Us

If you have any questions or concerns about our privacy practices or your data, please contact us at: vesselrdp@carlossura.com.