Skip to content
FortSwift
Contact sales

Legal · Privacy

Privacy Policy

Effective: 2026-05-28 · Last updated: 2026-10-19 (corrections to statements that were inaccurate)

These pages were written by the team and have not been reviewed by Singapore counsel. They describe the product as it actually stands. If your procurement needs binding written terms, contact sales@fortswift.com to agree them case by case.

Data Controller

  • Fookstar Tech Pte. Ltd. (UEN 202310441W)
  • 1 North Bridge Road #15-01A High Street Centre, Singapore 179094
  • DPO: Frank Peh, dpo@fortswift.com

1. What we collect

  • Account: email, display name, password (bcrypt-hashed), MFA TOTP secret (encrypted)
  • Device: hostname, OS, OS version, FortSwift client version, and the 9-digit access ID generated for that device
  • Session: session records are not currently enabled, so none are generated or stored. Once enabled they will carry connection timestamps, source and target device IDs, POP region and encrypted byte counters
  • Telemetry: the apps do not send usage statistics or diagnostics on their own. The iPhone and iPad app has a “Send Diagnostic Logs” option in Settings; the app tries to send connection diagnostics to us only when you tap it.
  • Audit: who performed which account, sign-in or authorisation action and when; some entries include the source IP address and browser user agent. Your organisation's administrators can view the audit log in the portal.

2. How we use it

  • Provide remote-desktop SaaS
  • Auth and ACL so only your devices are reachable by your account
  • Service reliability, POP routing, and capacity planning
  • No third-party advertising and no behavioral profiling

3. What we do not do

  • We do not record your screen content
  • We do not transcribe keystrokes
  • We do not read clipboard contents
  • We do not sell or share data with third parties except as required by law

4. Where data lives

  • Account and device data are held on servers operated by Fookstar Tech Pte. Ltd., a Singapore company. We have not yet checked the location of these servers against our hosting contracts, so for now we make no statement about where they are.
  • Remote connections use FortSwift access nodes in several regions to find each other and to check access; when a direct connection is not possible, the connection's traffic is also relayed through a node. Nodes handle device identifiers and network addresses, and record some of them in their local logs.

5. Retention

  • Account data: kept while your organisation's account is open. To close the account or ask for its data to be deleted, write to support@fortswift.com. We will reply in writing, setting out what we can delete at that point, what has to be kept and why. Copies may also remain in our backups for a period after data is deleted from the live systems.
  • Session records: the session-recording feature is not enabled today, so no session records are generated or retained.
  • Audit records: generated for account, sign-in and authorisation actions. Some entries include the source IP address and browser user agent. The service software includes a periodic clean-up job for older audit records; its default retention setting is 365 days.

6. Singapore PDPC obligations

  • Consent: explicit at registration
  • Purpose limitation: only the purposes listed above
  • Notification: this page
  • Access and correction: dpo@fortswift.com
  • Protection: bcrypt, TLS 1.3, and encrypted storage
  • Accountability: DPO Frank Peh

7. Your rights

  • View, export, or delete your data by contacting dpo@fortswift.com
  • File a PDPC complaint at https://www.pdpc.gov.sg/

8. Changes

  • We notify via email and this page when the policy materially changes.