Privacy
What we collect, and what we don't.
Two things are covered here: this website, and the TZX Desk console when we host it for you. Last updated 4 September 2026.
This website
The site is a set of static pages. It sets no cookies, runs no analytics and carries no tracking pixels. Nothing you type on it is sent to us: the request-access forms open your own mail app with the message filled in, and that message travels from you to us as ordinary email.
The theme switch keeps one value in your browser's local storage (tzx-theme, either dark or light) so your choice survives a reload. It never leaves your browser.
The typefaces (IBM Plex Sans and IBM Plex Mono) are served from this site itself. Loading a page here makes no request to any other domain.
These pages are served by Cloudflare Pages. We keep no access logs of our own. Cloudflare processes the request data that any web request carries — the address it came from, the page requested, the time, and the browser's user-agent string — to run and protect its network, under its own privacy policy.
The hosted console
When we host the console for you, it stores what it needs to run the approval gate and to answer “who did what”:
- Devices. Each device's connect ID, and the alias, hostname, operating system and last-seen time it reports on its heartbeat.
- Approval decisions. Whether each device is pending, approved or revoked, which account changed that, and when.
- Accounts. For each console account: email address, role, a password hash, and a two-factor secret if two-factor is enrolled.
- Deploy tokens. Stored as a hash. The token itself is shown once and never kept in the clear.
- Audit entries. Console actions, connection sessions (which account connected to which device, and when) and file-transfer records, kept append-only. Console actions are kept for as long as the account exists and are never pruned. Connection-session and file-transfer records are kept up to one million entries per customer workspace, oldest removed first.
What happens inside a session — the screen, the keyboard, the files — travels encrypted between the two machines. When they cannot reach each other directly, the relay carries that encrypted stream without being able to read it. We do not record sessions.
If you self-host, none of this reaches us. The server and console have no telemetry and no licence check.
Your data, and who is responsible for it
To ask what we hold about you or your devices, to have it corrected, or to have it deleted, write to privacy@tzxdesk.com. Deleting an account removes its devices and approval records; audit entries that name it are kept for the retention period above, because they are the record of what happened.
The service is provided by TECHZONEX L.L.C-FZ (Licence No. 2307611.01, Meydan Free Zone), Meydan Grandstand, 6th floor, Meydan Road, Nad Al Sheba, Dubai, United Arab Emirates.
If this page changes, the date at the top changes with it.