Privacy Policy

1. Operator and contact

Privacy questions and rights requests: Luxwarp privacy contact · inquiry@luxwarp.com

2. Information we use

• Beta applications, invitations and accounts: the email you provide, optional description of your needs, application/invitation/registration times, team membership and role, to handle beta access, sign-in and team administration.
• Registered devices: device name and identifier, host/viewer role, owning account and team, registration, activity and revocation times, to list devices and control access.
• Sign-in security: sign-in and device-approval codes, token hashes, sessions and expiry times, to verify access and approve devices. We do not collect or manage a separate Luxwarp account password.
• Connections and operations: IP addresses, ports and network addresses, device certificate fingerprints, display size/frame rate, CPU, memory and traffic statistics, connection times and errors, to discover devices, establish direct connections, show status, diagnose failures and prevent abuse.
• Support: contact details, messages and attachments you send, to answer your request. Do not send passwords, sign-in codes or unnecessary work files.

Without required account and connection information, sign-in or remote access may not work. The description of your needs on the beta application is optional.

3. Google sign-in

When you connect Google sign-in, we associate Google's account identifier with your existing Luxwarp account so we can recognize you on later visits. We store the provider, that identifier, your Luxwarp account identifier and the time of linking.

We currently request only the basic openid authentication scope. We do not request Google email, name, profile-photo, Gmail, Drive or contacts permissions. We verify the ID token during authentication; Google access tokens, refresh tokens and raw ID tokens are not retained in our account database.

The email already provided for a Luxwarp beta application, invitation or account remains separate. Connecting Google does not automatically delete that email. We use the Google identifier only for sign-in and account security, not advertising, sale, credit decisions or AI model training. Google's handling of sign-in is also covered by the Google Privacy Policy.

4. Remote content and your team

During direct sessions, screen, audio, input and enabled clipboard data travel between the connected devices. The account and signaling service exchanges connection information; it does not relay or record the screen/audio stream of a direct session. Someone you authorize to connect can see the screen and applications you share. Share only what you intend to make available.

If a separately provided Enterprise relay is enabled, encrypted remote-session traffic passes through the relay. Relay service is not included in Free or Plus direct connections.

Authorized people in your team can see devices and connection status. Team administrators can see member emails, roles, devices and invitations and manage access.

5. Service providers and international processing

• Cloudflare, Inc.: website delivery, account storage, sign-in email delivery, device signaling, security and error logs. It processes the account, authentication, device and connection information needed for these services.
• Google: authentication when you choose Google sign-in. Luxwarp sends authentication requests and exchanges authorization codes to receive the account identifier described above.
• ㈜이카운트 (ECOUNT): mail sent to the customer support address is forwarded through Cloudflare Email Routing to the operator's info@skyfall.studio mailbox, provided by ECOUNT. ECOUNT handles receiving, storing and replying to support messages and attachments. Your email service also handles delivery.

Cloudflare and Google operate internationally, so information may be processed outside your country. Our account database currently reports the Asia-Pacific region and is not configured with a country-specific storage restriction. This region does not describe every location used for web requests, authentication, email or logs. See Cloudflare's privacy information and Google's privacy information for their practices.

Information needed for sign-in and connections is transmitted through encrypted communications. You can use the existing email sign-in method instead of Google. Contact inquiry@luxwarp.com about external processing required for the account service or to request that you stop using it.

We do not sell personal information to advertisers or share it for ad targeting. We may provide necessary information where applicable law permits it to meet legal duties or respond to security incidents.

6. Retention and deletion

Account, linked sign-in, team and device records are kept while needed to operate the account and manage access. Application and invitation records support beta administration and invitation history. Support materials are kept while needed to handle the request. Use the contact below to request deletion.

• Email sign-in links are valid for 15 minutes, device approval codes for 5 minutes, and social sign-in transactions for 10 minutes.
• The website sign-in cookie lasts 30 days. Website sign-out ends that browser session. App device credentials are managed separately.
• Expiry ends the validity of authentication information; it does not immediately erase every associated account, email or record. Some expired authentication and rate-limit records may remain until database cleanup.
• Removing a team member or revoking a device stops access. It does not by itself erase all personal information for that account.
• When reviewing a deletion request, we identify the affected operational records and separate files and the methods needed to handle them. We explain what was completed and the reason and period for any remaining records. Cloudflare database recovery history may retain earlier copies for up to 30 days. If information must be retained by law, we identify the applicable basis, information and period.

7. Your choices and rights

Contact inquiry@luxwarp.com to request access, correction, deletion, restriction of processing or removal of a Google sign-in association. Depending on the law where you live, you may also have rights to withdraw consent, object to processing or obtain portable data. An authorized representative can contact us; we may verify their authority.

We may verify account ownership before acting, without asking for your password. If a legal reason limits a request, we will explain it. Full account-data deletion is currently handled through support, not a self-service button. You can also withdraw Google authorization in Google account connections; that action alone does not delete information stored by Luxwarp.

You may complain to your local data-protection authority. In Korea, you can contact the Personal Information Infringement Report Center or Personal Information Dispute Mediation Committee.

8. Cookies and safeguards

We use essential cookies to maintain sign-in and bind authentication requests to your browser. You can block or delete cookies in browser settings, but sign-in may stop working. The current website code does not install advertising or behavioral-tracking cookies or third-party advertising analytics. Infrastructure providers may process request information for security and service operation.

We use HTTPS, access checks, hashed authentication tokens and expiry/revocation controls. Protect your devices, Google account and email account, and revoke devices you no longer need.

9. Children and changes

Luxwarp is a remote-access service for workstations and is not directed to children. Contact us if you believe a child has provided personal information. We update the revision date when practices change and provide notice or obtain consent for material changes where required.