Privacy Policy

Effective date: August 24, 2026

This Privacy Policy explains what personal information SquidSpark Inc. ("SquidSpark", "we", "us") collects in connection with the RDP Engine desktop application ("the Software") and the SquidSpark store at store.squidspark.com, how we use it, who we share it with, and the choices you have.

SquidSpark Inc. is a Canadian corporation with its registered office at 7030 Woodbine Avenue, Suite 500, Markham, Ontario, L3R 6G2, Canada. We are the organization accountable for the personal information described here, under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and other applicable privacy laws.

The short version. Your connections, credentials, files, and queries stay on your own device. We never see them. The only things we collect are what we need to sell you a licence, deliver it, keep it working on your devices, and support you.

1. What stays on your device — always

The Software stores the following only on your device, under your Windows user profile at %AppData%\mrdp:

• Connection profiles — names, hostnames and addresses, ports, usernames, domains, database names, start folders, display and TLS options, and your folder organization.
• Saved passwords and private-key references — encrypted with Windows Data Protection (DPAPI), tied to your Windows user account. They cannot be decrypted by another user, on another machine, or by us.
• Saved SSH commands — the names, descriptions, and command text you save.
• Application state — window and sidebar preferences, expanded folders, and a cached copy of your licence status.

This information is never transmitted to SquidSpark. It leaves your device only if you choose to export it (section 3).

2. What we never see

We have no visibility into, and never receive:

• the contents of any remote session — screen content, keystrokes, clipboard data, or terminal output;
• files you upload or download over SFTP, FTP, or FTPS;
• SQL you write, or any query results;
• the hostnames, addresses, usernames, passwords, or private keys of the systems you connect to.

Remote desktop, SSH, file-transfer, and database traffic flows directly between your device and the systems you connect to. It does not pass through SquidSpark infrastructure. Any personal information handled on those remote systems is under your control and your organization's control, not ours.

The Software contains no analytics, no crash reporting, and no usage telemetry.

3. Export files

If you use the export feature, the resulting .mrdp.json file contains your connection profiles and folder structure and — only if you opt in — your saved passwords, sealed with a passphrase you choose (PBKDF2 + AES-GCM). Raw DPAPI blobs never leave the machine.

You control where that file goes. We never receive it and cannot recover its passphrase. Anyone with both the file and the passphrase can read the passwords inside, so protect both.

4. Licence activation and validation

If you activate a paid licence, the Software contacts our licence server at license.squidspark.com when you activate, when you deactivate, and periodically to revalidate. Each request transmits:

We use this solely to operate licensing: enforcing activation limits, letting you see and manage which devices are activated, detecting abuse, and confirming subscription status. We do not use it for advertising, and we do not sell it.

A device name may identify you (for example, if it contains your name), so we treat these records as personal information.

If you never activate a licence, the Software makes no network connections to SquidSpark at all.

5. Purchases from the SquidSpark store

When you buy or renew a licence at store.squidspark.com, we collect and hold:

• your name and email address;
• your billing address and country, and your business name and tax registration number if you provide them;
• order and subscription records — products, prices, taxes, dates, renewal status, licence keys issued, refunds, and invoices;
• correspondence about the order.

Payment card details are handled by Stripe, not by us. Stripe processes the payment as our payment processor; we receive only a transaction reference, the card brand, and the last four digits. We never see or store your full card number. Stripe's own privacy policy governs its handling of your payment data.

We use this information to take payment, deliver your licence key, provide receipts and invoices, administer renewals and refunds, provide support, meet our tax and accounting obligations, and detect fraud.

6. Email we send you

• Transactional email — licence keys, receipts and invoices, renewal and payment notices, refund confirmations, and important security or service notices. These are necessary to the transaction and are not marketing.
• Product email — release announcements, new features, and occasional product news. If you have bought a licence, we may send these under the existing-business-relationship provisions of Canada's Anti-Spam Legislation (CASL); otherwise we send them only if you asked us to.

Every product email includes an unsubscribe link, and we honour requests promptly. You can also unsubscribe at any time by emailing privacy@squidspark.com. Unsubscribing from product email does not stop transactional email about a licence you hold.

7. Support

When you contact support@squidspark.com, we receive your email address and whatever you choose to include — which may contain log excerpts, screenshots, or configuration details. Please redact hostnames, credentials, and any sensitive data before sending; we do not need them and would rather not have them. We use support correspondence only to answer you and to improve the Software.

8. Website and store logs

Our web and store servers keep standard access logs — IP address, timestamp, requested URL, referrer, and user-agent string — for security, abuse prevention, and troubleshooting. The store uses only cookies strictly necessary for sign-in, checkout, and security. We do not use advertising or cross-site-tracking cookies.

9. Why we may use your information (legal bases)

Where a legal basis is required — for example under the EU or UK GDPR — we rely on:

• Performance of a contract — delivering, activating, validating, renewing, and supporting your licence.
• Legitimate interests — securing our systems, preventing fraud and licence abuse, and keeping customers informed about the product they bought, balanced against your privacy rights.
• Legal obligation — tax, accounting, and record-keeping requirements.
• Consent — product email where you subscribed without a prior purchase, and anything else we ask you to opt into. You may withdraw consent at any time.

Under PIPEDA we rely on your consent, which you give expressly when you create a store account or activate a licence, and which is implied for uses obvious in the circumstances (such as sending you the key you just bought).

10. Who we share information with

We do not sell, rent, or trade personal information. We share it only with:

• Stripe — payment processing (United States and Ireland);
• our hosting and email providers — to run the licence server, the store, and our email;
• our accountants and professional advisors — for tax and audit purposes;
• law enforcement or regulators — only where legally required, and only to the extent required; and
• a successor — if SquidSpark is involved in a merger, acquisition, or sale of assets, in which case this policy continues to apply to the transferred information until the successor gives notice of a change.

Service providers are bound by contract to use the information only for the services they provide to us and to protect it appropriately.

11. Where your information is stored, and cross-border transfers

• The licence server is hosted in Canada, and licence and activation records are stored in Canada.
• Stripe processes payment information in the United States and the European Union.
• Some support email and business-administration tools we use may process data in the United States.

While your information is in another country, it may be accessible to the courts, law enforcement, and national-security authorities of that country under its laws. Where information leaves Canada or the European Economic Area, we use providers who commit to comparable protection by contract, including the European Commission's Standard Contractual Clauses where they apply. You can ask us for more detail at privacy@squidspark.com.

12. How long we keep it

Anything on your own device is kept until you delete it. Deleting %AppData%\mrdp removes all locally stored data, including saved passwords.

13. Security

• Saved passwords are encrypted at rest with Windows DPAPI, scoped to your Windows user account.
• Export passwords are sealed with PBKDF2 key derivation and AES-GCM authenticated encryption.
• Traffic to the licence server and the store uses HTTPS/TLS.
• Access to licence and customer records is limited to personnel who need it.
• Card data is handled by Stripe, a PCI-DSS Level 1 service provider; it never touches our servers.

No system is perfectly secure. If a breach of personal information under our control creates a real risk of significant harm, we will report it to the Office of the Privacy Commissioner of Canada and notify affected individuals as PIPEDA requires, and will meet equivalent obligations under other applicable laws.

14. Your rights and choices

Wherever you live, you may ask us to:

• access the personal information we hold about you and be told how it is used and who it has been disclosed to;
• correct information that is inaccurate or incomplete;
• delete information we no longer need to keep;
• withdraw consent, including unsubscribing from product email — noting that withdrawing consent to licence validation means the Software will revert to the free tier;
• receive a copy of the information you gave us in a portable format; or
• complain about how we have handled it.

Practical controls in the product:

• Use the free tier and never contact our servers at all.
• Deactivate a licence from within the Software to remove that device's activation record.
• Delete %AppData%\mrdp to erase all local data.

How to exercise a right: email privacy@squidspark.com. We will verify your identity — usually by confirming the email address on your licence or store account — and respond within 30 days. Our services are free of charge for these requests.

If you are in the EU or UK, you also have the rights to restrict or object to processing, and to lodge a complaint with your local supervisory authority. If you are in California, you have the rights to know, delete, and correct, and the right not to be discriminated against for exercising them; we do not sell or share personal information as those terms are defined under the CCPA/CPRA and have not done so in the preceding 12 months. If you are in Quebec, you have the rights the Act respecting the protection of personal information in the private sector provides, including de-indexation and data portability.

If you are unsatisfied with our response, you may complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca, 1-800-282-1376) or to the regulator in your own jurisdiction.

15. Children

The Software and store are intended for IT professionals and are not directed at children. We do not knowingly collect personal information from anyone under 16. If you believe a child has provided us with personal information, email privacy@squidspark.com and we will delete it.

16. Automated decision-making

We do not make decisions producing legal or similarly significant effects about you by automated means. Licence activation applies a simple device-count limit; if it blocks you incorrectly, contact support@squidspark.com and a person will resolve it.

17. Changes to this policy

We may update this policy. The effective date above always reflects the current version, material changes are noted in the Software's release notes, and if a change materially affects how we handle information you have already given us, we will notify licensed users by email. The current version is always available in the Software and at squidspark.com.

18. Contact us

Questions, requests, or complaints about privacy go to our Privacy Officer:

Privacy Officer — SquidSpark Inc.
7030 Woodbine Avenue, Suite 500
Markham, Ontario, L3R 6G2
Canada

• Privacy: privacy@squidspark.com
• Support: support@squidspark.com
• Legal notices: legal@squidspark.com
• Web: www.squidspark.com — Store: store.squidspark.com