Verified account
The host validates Firebase ID-token signatures and project claims. Email/password accounts must be verified; Google accounts use Google sign-in verification.
Access protection
Several checks before a PC command.
The service applies account, browser-session, pairing, and PC-side checks. These controls reduce unauthorized access risk; no internet-connected system can be promised free of every vulnerability.
Protected control requests
The server issues an expiring Secure, HttpOnly, SameSite session cookie. Control APIs check that session and reject requests without valid account and device authorization.
One-use control capability
Before each browser control connection, the host issues a short-lived, single-use capability bound to the paired PC room. The browser carries it in the secure WebSocket handshake, not in a URL.
PC-side command checks
The relay forwards encrypted messages. The Windows agent authenticates commands with the pairing secret and applies its action allow-list before performing supported operations.
- Keep Windows, Android, the host service, and dependencies updated.
- Use HTTPS and WSS only; do not disable certificate checks or share account credentials.
- Test access controls on the deployed host and review hosting logs and account recovery settings before inviting other users.
This is an engineering summary, not an independent penetration test or a guarantee. Account and session records use Cloudflare Durable Object storage. Website sessions expire with the Firebase sign-in token or when you sign out; control capabilities expire after 45 seconds and can be used once. Service interruptions may temporarily prevent access.
Open your dashboard
Sign in, link your PC once, and control it from any browser.