Acceptable Use Policy

1. Purpose

This Acceptable Use Policy (the “AUP”) forms part of the Terms of Service between you and Trendifyr Tech (Private) Limited and applies to every use of DeskTunnel (the “Service”), on free and paid plans alike.

It exists because a remote-desktop product is powerful and genuinely useful, and because the same capability in bad hands causes real harm to real people. Breach of this AUP is a material breach of the Terms of Service.

2. Authorisation to connect

You must not connect to, control, view, record or transfer files to or from a device unless the person or organisation that owns or lawfully controls it has authorised you to do so.

Authorisation means all of the following:

• It is genuine. It is not obtained by pretending to be someone you are not, by inventing a problem, or by creating urgency or fear.
• It is informed. The person understands that you will be able to see and control their screen, and what you intend to do.
• It is given by someone entitled to give it. An employee cannot authorise access to an employer’s machine beyond their own authority; a child cannot authorise access to a family computer.
• It is current. Permission for one task is not permission for everything afterwards. Permission given once is not permission for ever.

Where you configure a device for unattended access, the authorisation must have been given by its owner at the point of configuration, and must cover unattended access specifically.

Unauthorised access to a computer system is a criminal offence in most jurisdictions, including under the Prevention of Electronic Crimes Act 2016 in Pakistan, the Computer Misuse Act 1990 in the United Kingdom and the Computer Fraud and Abuse Act in the United States.

3. Prohibited uses

You must not use the Service to:

3.1 Break the law

• commit, assist, facilitate or conceal any criminal offence;
• gain or attempt to gain unauthorised access to any system, account, network or data;
• breach sanctions or export-control law, or make the Service available to a person with whom dealing is prohibited;
• store, transmit or access material that is unlawful where you are, where the remote device is, or in Pakistan — including child sexual abuse material, which we report to the authorities without exception or notice.

3.2 Deceive or defraud

• impersonate any person, company or authority, or misrepresent your affiliation with one;
• obtain credentials, card details, one-time codes, banking access or cryptocurrency keys by deception;
• induce anyone to make a payment, install software or disclose information by false pretences;
• operate any scheme that relies on a person granting remote access to their own machine against their interests.

3.3 Harm people

• stalk, harass, threaten, intimidate, defame or blackmail anyone;
• monitor a person covertly, including a partner, family member, employee or child, where you do not have the lawful right to do so and they have not been informed;
• install or configure the Service on somebody’s device so that you can watch them without their knowledge.

Employee monitoring is lawful in some jurisdictions and unlawful in others, and almost everywhere it requires notice. It is your responsibility to comply with the employment, privacy and works-council law that applies to you.

3.4 Distribute malware or infringe rights

• transmit a virus, worm, ransomware, keylogger, spyware or any other harmful code;
• use a Session to deploy, configure or operate software designed to damage or covertly control a system;
• infringe any copyright, trade mark, patent, trade secret or other right;
• circumvent a technological protection measure, or distribute material that does so.

3.5 Abuse the Service itself

• probe, scan, penetration-test or stress-test the Service or its infrastructure without our prior written consent;
• circumvent authentication, authorisation, rate limits, lockouts, plan limits or billing;
• attempt by brute force or automation to discover device addresses or unattended-access passwords;
• interfere with, overload or disrupt the Service or anybody else’s use of it;
• resell, white-label or make the Service available to third parties except under a written agreement with us.

4. Technical-support fraud

We treat the use of DeskTunnel for technical-support fraud as the most serious breach of this AUP, and we act on it without warning.

That means contacting a person who did not ask for help — by telephone, pop-up, e-mail, search advertisement or message — persuading them that their computer has a problem, and persuading them to install remote access software and give you their address. It ends in stolen money, emptied bank accounts and, very often, an elderly victim.

You must not:

• use the Service in any cold-contact support operation;
• claim or imply an affiliation with Microsoft, a bank, a tax authority, a telecommunications provider, an antivirus vendor or any authority;
• display fabricated warnings, error messages or diagnostic output to persuade somebody they have a problem;
• direct anyone to a banking site, a payment page or a cryptocurrency exchange during a Session you initiated by cold contact;
• obscure a victim’s screen, or lock their input, to conceal what you are doing.

If you are reading this because somebody has asked you to install DeskTunnel: no legitimate company telephones people unprompted about their computer. If you did not start the conversation, end it, do not give out your address, and uninstall the software. If you have already done so, disconnect the machine, contact your bank, and write to us at [email protected].

5. Network and infrastructure

A device may act as a relay for other users’ encrypted traffic, as set out in the Network Participation Terms. In connection with that, you must not:

• enable relay participation on a network where you are not permitted to carry third-party traffic;
• attempt to intercept, decrypt, log, modify or analyse traffic relayed through your device;
• misrepresent your device’s location, capacity or network characteristics in order to be selected as a relay;
• operate relay participation in a way designed to consume a disproportionate share of the network.

6. Plan limits and fair use

Each plan states its limits, and you must stay within them. In addition you must not:

• share a user account between individuals — each user account is one named person, and its remote sessions run from one computer at a time;
• create multiple free accounts or installations in order to avoid a paid plan or to claim a coupon more than once;
• use the free plan to deliver paid support services to third parties;
• automate the Service so as to generate load materially beyond ordinary interactive use.

7. What we can and cannot do

We cannot see inside your Sessions. They are encrypted end to end and we hold no key. We cannot read screen contents, keystrokes, clipboard data or transferred files, and we cannot intervene in what happens inside a Session in progress. This is deliberate, and it is what makes the Service safe for everybody else.

What we can do:

• observe connection metadata — which device connected to which, when, for how long;
• end a Session relayed through one of our own servers when that server is at its limit, as described in section 2 of the Network Participation Terms;
• observe patterns consistent with abuse, such as mass connection attempts or address scanning;
• act on reports from victims, from other users, and from law enforcement;
• suspend accounts and devices, and block addresses from the coordination server.

We do not monitor Sessions and we have no ability to do so. Nothing in this AUP obliges us to monitor, and no failure to detect a breach waives our right to act on it later.

8. Reporting abuse

If you believe the Service is being used in breach of this AUP, write to [email protected]. Please include:

• the DeskTunnel address involved, if you know it;
• the date, time and, if you can, the time zone;
• what happened, in your own words;
• any evidence — a screenshot, a recording, a transcript, a bank reference;
• a way to contact you, if you are willing to be contacted.

We acknowledge abuse reports and investigate what we are able to investigate. If you have lost money, report it to your bank and to the police as well as to us — we can suspend an account, but we cannot recover funds. In Pakistan, cybercrime is reported to the National Cyber Crime Investigation Agency.

Security researchers: if you have found a vulnerability rather than an abuse, see the Security Statement. We will not pursue you for good faith research conducted within the boundaries described there.

9. Consequences

Where we conclude that this AUP has been breached we may, at our discretion and without liability:

• warn you and require the breach to be remedied;
• restrict, suspend or terminate the account, the device or the organisation involved;
• block a device address from the coordination server;
• withhold a refund of fees paid, to the extent permitted by law;
• preserve and disclose relevant records to law enforcement, where lawful to do so;
• report the matter to the authorities.

For a breach of section 4, or for any matter involving the safety of a child, we act immediately and without notice. For less serious matters we will ordinarily give an opportunity to put things right.

10. Contact

Trendifyr Tech (Private) Limited
Pakistan
Abuse and security: [email protected]
Legal: [email protected]