How PG Remote keeps help safe
PG Remote lets someone you trust fix specific phone settings from far away — while the phone's owner sees everything they change.
We built it on three promises.
- Nothing hidden.Every change shows up on the phone the moment it happens, with the helper's name on it — or “Your family” if the phone can't confirm who it was.
- Nothing unlimited.A helper can do a short, fixed list of things — and nothing else.
- Nothing you can't take back.Ringer and Do Not Disturb changes come with a one-tap Undo for 24 hours, and a ringing phone stops with one tap.
This page explains how those promises are kept — in plain language first, and in technical detail further down for anyone who wants it.
What a helper can do — and what they can't
A helper can change four things
- Turn Do Not Disturb off or onSo calls ring through again after an accidental toggle.
- Set the ringer volumeSo an incoming call can actually be heard. It can never be set below 25%.
- Make the phone ring loudlyTo help find it when it's lost in the house. It rings even on silent — and through Do Not Disturb, unless that's set to silence alarms too. Each ring stops after five minutes or when someone taps Stop ringing; a helper can ring again. The helper who rang can stop it early, and is usually told whether it was stopped on the phone.
- Send a note or check inA message on the phone's screen, with optional one-tap “I'm fine” and “I need help” replies.
They can also check the phone's status — battery, ringer, Do Not Disturb and Wi-Fi — and see when its app was last active. The helper's app also checks automatically when it opens, after each change it tries, and whenever the helper taps Refresh. That's the whole list.
A helper cannot
- See the phone's screen
- Read texts or email
- Look at photos
- Install or delete apps
- Make calls or purchases
- Change passwords or accounts
- Find out where the phone is
Help can also start from the other end: the owner's app has its own I need help button, which alerts their helpers.
The short list is the product. There is no hidden "full control" mode, and no way to unlock one. Our servers enforce this: a command outside the approved list is rejected before it ever reaches the phone — the limits aren't just missing buttons in an app.
Getting connected happens in person
Setup is meant to happen with both phones in the same room. It takes two QR scans, phone to phone: the owner's phone shows a code, their family member scans it, then the owner's phone scans the code on theirs. The first code works once and expires in five minutes. No email invitation, link, or code read out over the phone can connect anyone to the phone. The only links in setup are each person's own sign-in link, to their own email, and the app's store page, which a family member can send them from their app — neither one connects anyone.
This is deliberate, and it's our single most important scam defense. Phone scams work at a distance — someone calls, builds urgency, and talks their way into access. Nothing on the phone can be changed until the owner's own phone has scanned the other person's code. So the rule is simple: only scan a code on a phone that's in front of you, and never send a photo or screenshot of yours — or show it on a video call. Whoever scans the owner's code can see the phone's status and activity, and get its alerts, until the owner taps Stop sharing with the phone online — a button that only appears once the phone's setup is finished.
Right after connecting, the phone's owner sees a plain-language list of the changes a helper could be allowed to make. Nothing is allowed until they allow it: the first time a helper connects, every change starts switched off, and they turn on only what they want. (If they reconnect the same helper later, their earlier choices come back — and they can change them on the same screen.) Status checks are always available to a connected helper; each one is listed on their phone, and Stop sharing, with the phone online, ends them.
Nothing changes silently
The moment a helper makes a change, the phone's owner is told in plain words, naming the helper (or "Your family" when the phone can't confirm who it was) — as a notification, or on screen when the app is open. Ringer and Do Not Disturb changes come with a one-tap Undo for 24 hours, on the notification or in the list of changes in the app — and if the phone can't change a setting back, it says so; a ringing phone carries Stop ringing. If the helper stops their own ring, the phone's list says so, and so does the ringing screen if it's open. Once an undo reaches our server, the next change of that kind waits for the owner to confirm it on the phone. (If notifications for PG Remote Home are turned off in Android settings, the change still happens and still appears in their list.)
Jon turned off Do Not Disturb
Your phone will ring when someone calls.
UndoEvery change is also listed on the owner's phone, with times, so it can be reviewed later — with an Undo on ringer and Do Not Disturb changes for 24 hours. (If a helper deletes their account, their changes leave this list; our append-only activity record keeps them.) Status checks don't pop up a notice, but they're listed there too ("Jon checked your phone status."). The phone's "last active" time comes from its own app — while it's open, and whenever it answers a helper — and isn't listed. And whenever the phone is set up, online, and signed in with the email it was set up with, the owner can remove their helpers' access with Stop sharing, no explanation required. If it's tapped offline, or the phone loses its setup, it may not remove anyone — helpers can keep their access until the phone is set up again and Stop sharing is tapped online. Connecting a new helper doesn't disconnect an earlier one — Stop sharing, with the phone online, removes everyone.
Things we will not do
We don't track location.
PG Remote never reports where the phone or its owner is. “Make the phone ring” means exactly that — a loud ring, not a map.
We don't read content.
Messages, email, photos, contacts, and browsing stay on the phone. PG Remote can't see them and doesn't want to. A note a helper sends through PG Remote is erased from our servers once the phone has handled it — for a check-in, once it's answered. Until then it stays stored, including a note that never reaches the phone.
No one watches the screen.
Helpers can never view the phone's screen in the background. If a live help session is ever part of PG Remote, it will start only when the owner accepts it, stay visibly on-screen the whole time, and end the moment they hang up.
We don't simulate taps.
PG Remote doesn't use Android accessibility services or any technique that fakes touches on the phone. Every change goes through official, narrowly scoped Android settings interfaces.
We don't sell data.
No ads, no data brokers, no exceptions.
The engineering underneath
For the technically curious
The consumer promises above rest on specific engineering choices:
Every command is cryptographically signed.
Each command is signed on the helper's phone and checked by the owner's phone before it runs. A forged command is refused, and so is one that's more than an hour old.
Signing keys stay on the phone.
Each helper's signing key is created on their phone, stored there encrypted, and never sent to us.
The change log is append-only and hash-chained.
Our apps, our servers and our support tools cannot edit or delete audit-log entries — the database refuses those changes — and each entry is chained to the one before it. Today the chain is checked against our own records only: a database administrator could still override these protections, and publishing the chain's fingerprint outside our systems, so it can be checked independently of us, is on our roadmap.
Permissions are enforced server-side.
Every change is checked on our server against what the owner allowed that helper, before it's sent — the server, not the app UI, is the gatekeeper.
Encrypted in transit and at rest.
Data is encrypted in transit (TLS) and at rest on our servers, and the permissions stored on the owner's phone live in encrypted device storage.
One helper at a time.
The phone accepts changes from one helper at a time: the person whose code the owner's phone scanned most recently — or, if the app restores its setup from a copy saved before that scan (a phone backup, say), the helper in that copy, if they're still connected. Connecting someone new doesn't disconnect anyone before them: apart from that restore, they can no longer change anything, but until the owner taps Stop sharing with the phone online — which removes every helper at once — they keep everything else a connected helper has: the phone's status and when it was last active, its full activity history (including check-in replies and how rings ended), the permissions the owner chose, and its alerts — help requests, check-in replies, and failed and undone changes. Adding more family members — and an optional read-only auditor who can see the history but never send a command — is on our roadmap, and will use the same in-person approval.
Your data
What we collect
Account basics (name, email); the family connection you set up; the phone status shown to the helper (battery and charging, ringer level, Do Not Disturb, Wi-Fi, when it was last active); basic device details (model, Android version, app version, a push-notification token); the change history itself, including status readings, how a "ring the phone" ended and any reply to a check-in; any "I need help" alert the owner sends, with its time; the permissions the owner chose and the policies each person accepted; subscription status; and crash diagnostics and service logs, so we can run the service and fix bugs. A note a helper sends is kept until the phone has handled it (for a check-in, until it's answered).
What we don't collect
Message or call content from the phone, contacts, photos, browsing history, or location.
Payments
Handled entirely by Google Play (and the Apple App Store, once the iPhone app ships). We never see your card number.
Deletion
You can delete your account from inside the app at any time. Your sign-in, device record, policy acceptances and subscription record are removed — and, if you're a helper, the commands you sent and the permissions you were given. When the phone's owner deletes, the household is closed and every helper's access ends, but the helpers' commands and the permissions the owner set stay stored until each helper deletes their own account. The append-only activity record is kept: nothing currently deletes it, so it is kept indefinitely; if we set a retention period, this page and our privacy policy will say so. See Delete your account & data for the details.
Our Google Play Data safety form says the same things this page does. If they ever disagree, tell us — that's a bug.
Who we build on
PG Remote runs on infrastructure from providers who undergo independent security audits. Those audits cover each provider's own systems, not how we build on them:
| Provider | What it does for PG Remote | Security attestation |
|---|---|---|
| Supabase | Database, sign-in, server logic | SOC 2 Type II / ISO 27001 |
| Google (Firebase Cloud Messaging / Google Play) | Push notification delivery; app distribution and billing | SOC 2 / ISO 27001 (Firebase Cloud Messaging) |
| Google Workspace | Our email, including account-deletion requests | SOC 2 / ISO 27001 (Google Workspace) |
| RevenueCat | Subscription status | SOC 2 Type II |
| Sentry | Crash reporting (apps only) | SOC 2 Type II / ISO 27001 |
| Vercel | This website | SOC 2 Type II / ISO 27001 |
| Google Analytics | Website visit statistics — only after you accept cookies | ISO 27001 (Google Analytics) |
| Resend | Delivering the one-time sign-in link emails | SOC 2 Type II |
We add a provider here before it touches your data — for example Apple's push service when the iPhone app ships, or a text-message provider if we ever send texts.
Where we are on formal certification
We're a small team, and we'll be straight with you: PG Remote does not yet hold its own SOC 2 or ISO 27001 certification. Those audits certify a company's internal processes, and we'll pursue SOC 2 when we begin serving care organizations and enterprises. Until then, the providers listed above hold the attestations shown there, and we've published this page — the actual architecture, the actual limits, the actual data practices — instead of hiding behind a badge we don't have.
PG Remote is not a medical device or a healthcare service, and it doesn't handle medical records.
Found a security problem?
Email security@pgremote.app. We'll acknowledge within three business days.
We welcome good-faith security research and won't pursue action against researchers who report responsibly and give us reasonable time to fix issues.
This page changes when our practices do. Last updated: October 8, 2026 · Page version 1.0