Render Control Privacy Policy

Effective date: August 10, 2026

Render Control ("Render Control," "the app," "we," "us," or "our") lets you monitor, preview, and control your Blender renders from a phone or web browser. This policy explains, plainly and specifically, what Render Control does and does not do with information. We have written it to avoid overclaiming: if something is listed as "not collected," we genuinely do not collect it.

What Render Control does

Render Control has three parts:

• A Blender add-on that runs on your render PC.
• A relay (a Cloudflare Worker with one isolated Durable Object per device) that acts as a blind pass-through between your PC and your phone or browser. Zero network setup is required on your end.
• A mobile and web app (Android, iOS, and a browser-based web app) that shows render progress, previews, and stats, and lets you send control commands back to Blender.

You pair a phone or browser to a render PC using a 6-digit code or a QR code. There are no user accounts. Pairing is per device.

Data we do NOT collect

We want to be explicit about this, because it is unusual:

• No user accounts. There is no login, no sign-up, no username, and no password.
• No email, name, or profile. We never ask for or store personal profile information.
• No analytics. We do not use analytics or telemetry SDKs to study how you use the app.
• No advertising. There are no ads and no advertising identifiers.
• No tracking. We do not track you across apps, websites, or over time, and we do not build user profiles.
• No data sale. We do not sell your information, and we do not share it for cross-context behavioral advertising.
• No third-party SDKs beyond the tooling required to build and deliver the app (Expo/EAS, listed under Sub-processors).

What IS processed, and why

On your device

Render Control requests only the on-device permissions it needs to function. Data tied to these permissions stays on your device and is used only for the stated purpose.

• Camera: used only to scan the pairing QR code. Render Control does not record, store, or transmit video or photos from your camera. Access is used at the moment of scanning and nothing else.
• Photos / media (write-only): used only to save rendered frames that you explicitly choose to export to your device's photo library or storage. Render Control does not read, browse, or upload your existing photos.
• Notifications: used to show render-finished and render-failed alerts. Normally these are generated locally on your device by the app itself. Your phone's operating system can shut the app down while a long render runs, and a closed app cannot notice anything. So there is also an optional push fallback, described below.

On the relay

The relay's job is to pass messages between your PC and your app. It is designed to hold as little as possible, for as short a time as possible.

• Ephemeral pairing and session tokens. For each paired device, its Durable Object stores only short-lived operational values needed to route your session: a device identifier (deviceId), an agent token (agentToken), an app token (appToken), and a short-lived pairing secret. These are session tokens, not identity data: they exist to connect your PC and your app, and they are automatically expired (TTL'd).
• Transient IP address. When your device connects, the relay transiently sees the connecting IP address. It is used only for rate-limiting and abuse prevention and is not retained as part of a user profile.
• Render telemetry (routed, not mined). Render information (progress, GPU/CPU/RAM statistics, and preview frames) flows between your phone and your PC through the relay so you can watch and control renders remotely. The relay routes this traffic; it is not used to profile you, is not sold, and is not shared for advertising.
• Push token, only if you turn notifications on. If notifications are enabled, your app registers a device push token with the relay so a finished render can still reach you when your phone has shut the app down. Storing that token is the opt-in: turn notifications off, or unpair, and it is deleted, after which no push is ever sent to that device.

What a push notification contains

A push is delivered by your phone's operating system, so it necessarily travels through Expo and Google (see Sub-processors) rather than through the encrypted channel your app uses. We treat what it may say accordingly.

• QR-paired (end-to-end encrypted) devices get no render details. The push says only that a render finished or failed. Your PC deliberately does not send the file name or error text to the relay in this case, and the relay would strip them anyway. Your app then reads the real details over its own encrypted channel and shows them locally.
• Devices paired with the 6-digit code use a plaintext session, so the relay can already see the render status. For those, the notification may name the .blend file and the error text, because doing so discloses nothing the relay did not already route.
• Push notifications are never used for marketing. The only thing we ever send is a render alert for your own render.

End-to-end encryption for QR pairing

When you pair using a QR code, the session is end-to-end encrypted using ChaCha20-Poly1305 (an authenticated-encryption AEAD scheme). For QR-paired sessions, the relay only ever sees ciphertext and cannot read the contents of your session. All traffic is additionally protected in transit by standard TLS.

Sub-processors

We rely on a small number of infrastructure providers to operate Render Control. We do not use any third-party advertising, analytics, or tracking services.

• Cloudflare: hosts the relay (Worker + Durable Objects) and hosts our web pages and web app (Cloudflare Pages). Cloudflare processes the routed traffic and transient connection metadata (such as IP) described above.
• Expo / EAS: used to build the app and to deliver over-the-air (OTA) app updates. If you turn notifications on, Expo's push service also relays render alerts to your device, and holds the device push token needed to address them.
• Google (Firebase Cloud Messaging): the delivery channel Android itself requires for push notifications. It carries render alerts to your phone only when notifications are enabled, and it sees the notification text described above. That is why a QR-paired device's alert deliberately carries no render details.
• Stripe: processes payments when you buy Render Control on our website. Stripe handles your payment details under its own privacy policy; we receive only the transaction record and checkout email needed to deliver your purchase.

Each sub-processor handles data under its own terms and security practices, solely to provide the infrastructure above.

Data retention

• Pairing and session tokens on the relay are ephemeral and automatically expire via a time-to-live (TTL). When a session ends or its tokens expire, that state is cleared.
• Transient IP data is used in the moment for rate-limiting and abuse prevention and is not compiled into a user profile.
• Render telemetry is passed through for live viewing and is not retained by us as a stored archive of your activity.
• On-device data (such as exported frames) remains on your device under your control until you delete it.

Because there are no accounts and no user profiles, we do not maintain a long-term store of personal data about you.

Children's privacy

Render Control is a tool for people working with 3D render software and is rated suitable for general audiences (4+ / Everyone). It is not directed at children, and we do not knowingly collect personal information from children. Since Render Control has no accounts and collects no personal profile information, it does not gather the kind of data typically associated with children's privacy concerns. If you believe a child has somehow provided personal information through Render Control, please contact us and we will address it.

Data deletion

Because Render Control has no accounts, there is no personal profile to delete on our side.

• Unpair at any time from the app. Unpairing clears the local tokens on your device and the device's state on the relay.
• Relay pairing and session state also expires automatically via TTL even if you take no action.
• There is no server-side personal data for us to delete, because we do not store user accounts or profiles. Any data on your own device (for example, frames you exported) can be deleted by you directly on the device.

Security

• All communication between your PC, the relay, and your app is protected in transit with TLS.
• QR pairing is end-to-end encrypted with ChaCha20-Poly1305, so the relay sees only ciphertext for those sessions.
• The relay is a blind pass-through with per-device isolation (one Durable Object per device) and stores only short-lived, TTL'd session tokens.

No method of transmission or storage is ever completely secure, but we design Render Control to minimize the data at risk in the first place.

International data transfers

Render Control relies on Cloudflare's and Expo/EAS's global infrastructure, so the routing and processing described above may occur on servers located in countries other than your own. Regardless of where processing happens, the same minimal-data practices in this policy apply. The information handled is limited to the ephemeral, non-identity operational data described above.

Encryption and export compliance

Render Control uses only standard, widely available encryption (AEAD such as ChaCha20-Poly1305, and TLS) to protect your own data in transit and during pairing. It does not implement proprietary or non-standard cryptography. Accordingly, the app is designated as exempt from certain export requirements (ITSAppUsesNonExemptEncryption = false).

Pricing and payments

Render Control is sold on our website by subscription (monthly, 6-month, or yearly) and as a limited-offer lifetime purchase, with checkout handled by Stripe. Payment details (card numbers, billing address) are collected and processed by Stripe on Stripe's own pages. We never see or store your card details. Stripe provides us the information needed to deliver your purchase, handle refunds, and manage subscriptions (such as the email you used at checkout, the transaction record, and subscription status/renewal events, which we use to keep your license active). The app itself contains no in-app purchases; any Play Store listing is a separate free track.

Changes to this policy

We may update this policy as Render Control evolves (for example, when new features are added). When we make material changes, we will update the "Effective date" above and post the revised policy at our published policy location. Continued use of Render Control after an update means you accept the revised policy.

Contact

If you have questions about this policy or your privacy, contact:

[email protected]

Render Control is published by an individual developer. This policy covers the Render Control Blender add-on, relay service, mobile apps, and web app distributed under the package/bundle identifier com.renderconf.app.