The deal

aRDee gives you a way to reach computers you own from somewhere else. That is a serious capability and it is easy to point at the wrong machine, or at the right machine at the wrong moment. This page is what you agree to when you use it, written so you can actually read it.

1 · The deal, in short

• You may only connect to machines you own, or have clear permission to access. That is the one rule that matters.
• Your account is yours to look after. Its password is the key to every machine on it.
• The service is free right now, runs on one server, and comes with no uptime promise. Do not make it the only way to reach something you cannot afford to lose.
• Sessions can be recorded by the person viewing. Getting consent for that is on you.
• The operator can technically reach your machines. Section 8, and section 6 of the privacy page, say exactly how and what limits that.
• Either side can walk away at any time.

2 · What the service is

You install an agent on a computer. It connects out to the aRDee service. The browser portal is at ardee.help; installed apps may use ardee.cksz.us as the underlying connection endpoint. From a browser or an app you can then see that computer's screen, use its keyboard and mouse, move files, print, look at how much disk it has left, wake it up, and be emailed when something changes.

These terms are an agreement between you and the operator of that service. They cover the hosted aRDee service at ardee.help, including its underlying connection endpoints. They do not cover a copy you host yourself, where you are the operator and this page is a template rather than a contract.

3 · Your account

• Signup is invite-only at present. Do not create accounts for other people using an invite meant for you.
• One human, one account. Do not share a login. If two people need access, ask for a second invite.
• Minimum password length is eight characters. That is a technical floor and a bad password. Your account password unlocks every machine enrolled to it — use something long, and use a password manager.
• Give a real email address. It is how a password gets reset and how you are told if something is wrong.
• Tell the operator promptly if you think someone else has your password. Then change it — changing your password, or using "sign out everywhere", ends every session on every device immediately. That is the fastest thing you can do on your own, and you do not need anyone's help to do it.
• You are responsible for what is done through your account, including by anyone you gave access to.

4 · What you may point it at

Some specific cases, because they come up:

• A family member's computer. Fine if they know it is installed and know you can reach it. Not fine as a way to watch what they do.
• A work computer. Check your employer's policy first. "I could technically reach it" is not permission, and installing remote access on a corporate machine without approval is a firing offense at most places and a security incident at the rest.
• A client's machine. Get it in writing. Leave the agent installed only if they agreed to that, and tell them how to remove it.
• A machine you sold, gave away, or left behind. Remove it from your portal. Its enrollment key dies with the record.
• A shared or public computer. Don't.

If you enroll a machine that other people also use, tell them. The desktop app shows a panel while someone is connected and the machine writes its own record of what was done, but a person who does not know the software is installed will not know to look for either.

5 · Support codes

For one-off help, a person can start the app in support mode and read you a six-digit code. You type it and you are connected to their screen.

The code is the whole authentication. There is no account check on the other side — that is deliberate, because the person needing help usually has no account. It means the code should be read to one person, over a channel you trust, and it means the code stops working when the session ends. If someone you did not expect connects, the person at the machine should close the app.

Repeated wrong codes get slower and then locked out, because six digits is otherwise a small enough space to guess at machine speed. A few mistypes are free — support codes get read down a phone line by someone already having a bad day.

If you are the one giving help: you are a guest on someone else's computer. Say what you are about to do before you do it. The machine keeps its own written record of what happened, and they are entitled to read it.

6 · Recording and consent

The viewer can record a session to a video file. The recording is made and stored on the viewer's own machine; no copy goes to the server.

When recording starts, the software tells the other end: the desktop app shows a red ● REC badge while it runs, and the machine's own session record notes it. That notice is sent by our client software. Someone running a modified client — or pointing a phone at their screen — can record without it, so the badge is a courtesy that works normally, not a guarantee.

Recording a person's screen, and any audio with it, may legally require their consent where you are, where they are, or both. Wiretapping and two-party-consent rules catch this more often than people expect. Getting that consent is your responsibility. The badge is not consent; it is a notification.

7 · Things you must not do

• Access any computer you are not authorized to access, or help anyone else do so.
• Use the service to monitor a person covertly — a partner, a child old enough to have a reasonable expectation of privacy, an employee who has not been told, anyone.
• Use it to run a scam. Remote access is the primary tool of the tech-support scam, and this is the clause that says so out loud. Accounts used this way will be disabled without warning and reported.
• Use it as command-and-control for malware, as a jump host into a network you do not control, or to hide the origin of anything.
• Attack the service: password guessing, scraping accounts, probing for holes in production, or trying to reach other people's machines. If you want to test security, see the note at the end of section 14 — do it properly and you will be thanked.
• Move illegal material through the file-transfer or share features.
• Resell access, or run a service on top of it, without agreeing that first.
• Use the relay as general-purpose bandwidth. It exists so sessions work when two networks cannot see each other, not as a tunnel.

Breaking these gets your account disabled. A disabled account cannot sign in from anywhere, and the machines enrolled to it become unreachable through this service. They keep working; you just cannot reach them remotely until it is sorted out.

8 · What the operator can reach

The privacy page explains the mechanism, and you should read it. The summary: the key that signs session tokens sits in a plain file on the server, so anyone with root on that server can create a valid session for any account and use it to reach any enrolled machine. This is a property of hosting, not a defect in the code, and it is true of every hosted remote-access product.

Four things constrain it regardless of anyone's word, and they are worth knowing:

• Every session on your machines appears in your own connection history in the portal, with the account and IP it came from. A session opened with a minted token is brokered by the same server and logged the same way, so it lands in your list next to the ones you started.
• The machine writes its own record of what was done in each session, to a plain text file in its own Documents folder. The server cannot rewrite it.
• macOS lights its screen-recording indicator whenever the screen is being captured, and the agent stops capturing the moment nobody is watching so that the indicator stays meaningful.
• Quitting the agent, or removing the machine from your portal, ends it.

If that trust is not one you want to extend, host it yourself. The software is built for that, and an account can even point at its own relay so no traffic touches this server.

9 · Software on your machines

The agent and desktop apps are licensed to you to use with this service, for as long as you use it. Do not redistribute or resell them, and do not strip the notices that tell a person at the machine that a session is running — those exist for the person whose computer it is, not for you.

The apps update themselves. That means the operator ships code that runs on your computer, at their timing, without you approving each version. Two things gate it: the download must match a SHA-256 published in the update manifest, and the app must carry a valid Apple code signature, which is checked before anything is swapped in. The manifest comes from the same server, so the signature is the check that actually matters — it is anchored to a certificate the operator would have to lose control of, not merely to a file on the box. You can also trigger an update yourself from the portal for a machine you cannot walk over to.

If you would rather approve every version by hand, say so and turn automatic updates off. Understand what you are choosing: an old agent is an unpatched agent.

10 · Money

There is no charge at the moment and no payment mechanism exists, so there is nothing to refund and no subscription to cancel. Each account has a relay allowance of 100 GB per month, counted on UTC calendar months, with a fresh allowance each month.

Most sessions never touch it. Where two machines can reach each other directly the traffic goes straight between them and nothing is counted — that is the normal case. What the counter measures is screen sharing the server itself has to carry, which is what an iPhone or iPad share always does, for the reason set out in the privacy page. Relay carried by the separate TURN component is not metered against your allowance today, so treat the number as a generous ceiling rather than an exact meter.

When an account is over its allowance, new sessions stop being issued relay credentials: a session that cannot connect directly will fail to start until the month rolls over, and starting a screen share from an iPhone or iPad is refused outright with a message saying why, because that path is always relayed and can never fall back to a direct one. A share already running is not cut off part-way. Nothing is deleted, the account is not disabled, and sessions that connect directly keep working. You can see where you stand under Settings → Relay allowance in the portal, which also says so plainly when the allowance has run out. Section 7 applies regardless of the number — the relay is there so sessions work between networks that cannot see each other, not as a tunnel.

If charging starts, existing accounts will be told before it applies to them, with enough notice to leave. Nobody's card will be taken quietly.

11 · Availability, and what to expect

One server. One person maintaining it. No uptime guarantee, no service credits, no support hours.

Restarts

Deploys restart the server. Active sessions drop and need to be reconnected.

Outages

If the server is down, nothing is reachable through it. Sessions already running peer-to-peer may survive briefly; new ones cannot start.

Your data

Snapshots of the account file are kept on the same machine. That is protection against a bad write, not against losing the machine, and it is not a promise: no backup schedule is guaranteed by these terms. Do not treat it as a disaster-recovery plan. Your machines and their files are never backed up here — they are on your computers, where they always were.

Features

This is young software. Things change, and occasionally something that worked stops working while it is being fixed.

Do not rely on this as the only way to reach a machine that matters. Keep a second route — physical access, a colleague nearby, another tool. And do not use it for anything where a failure hurts someone: medical monitoring, industrial control, emergency response, anything load-bearing for safety. It is not built for that and is not tested for it.

12 · Ending it

You can stop whenever you like: quit the agents, remove your machines in the portal, and stop signing in. When you want it gone, delete the account yourself in the portal — it asks for your password and makes you type the word DELETE, then removes the account, every machine enrolled to it, their connection history, your alert rules and anything queued for delivery. Sessions in progress end at once. There is no undo, so take a copy first with Download My Data if you want one. Two things survive: the audit log is append-only, so lines recording your past sign-ins are not erased by deleting an account, and backups of the account file taken before the deletion are not rewritten. If you want those gone too, ask the operator explicitly.

The operator can disable an account that is breaking section 4 or section 7, or that is causing a problem for the service. Where it is not urgent you will be told why and given a chance to fix it. Where it is urgent — an active scam, an attack in progress — it will happen first and be explained after.

If the service shuts down, account holders will be emailed with enough notice to move, and the software remains self-hostable.

13 · Warranty and liability

The service is provided as it is, with no warranty of any kind. Nobody promises it will be available, that it will be free of faults, that a session will connect, or that it is fit for a particular purpose.

To the extent the law allows, the operator is not liable for lost work, lost data, lost business, lost time, or any indirect or consequential loss arising from using or being unable to use the service. Since the service is free, there is no fee to refund and no cap to negotiate.

What the law does not allow to be excluded is not excluded: death or personal injury caused by negligence, fraud, and anything else your local consumer-protection law reserves. If you are a consumer, your statutory rights are not affected by anything on this page.

You are responsible for what you do with the access this gives you, including for any loss you cause on a machine you connected to.

14 · Changes, law, contact

These terms can change. If a change matters, the date at the top changes and account holders are emailed. Continuing to use the service after that is how you accept it; if you would rather not, stop using it and ask for your account to be removed.

Governing law and jurisdiction: the Commonwealth of Pennsylvania, United States, and the state and federal courts sitting in Pennsylvania. This draft will not guess, because guessing here is how a clause becomes unenforceable.

If a clause turns out to be unenforceable, the rest still stands.

Contact: support@ardee.cksz.us. Security problems especially — report them and you will be thanked, not threatened. Give the operator a reasonable window to fix it before publishing, and do not test against other people's accounts or machines while you are looking.