PRIVACY
Privacy policy
Effective in sync with the Chinese version; where texts conflict, the stricter reading applies.
Local data
Pairing and transfer stay on-device by default. We do not run a server that receives your file contents in Local mode.
- Trust store, transfer history, and diagnostics stay local.
- Discovery never uploads a device list.
- There is no account and no cloud contact list on the default path.
Connected data
A relay participates only if you switch on Connected features; payloads remain end-to-end encrypted.
- Relay can see: timing, size, and similar metadata.
- Relay cannot see: file contents or session keys.
- Turning Connected features off returns you to a pure Local path.
What we do not do
These are architecture constraints (ADRs), not marketing promises.
- No ad SDKs (ADR-010).
- We do not sell or analyse transfer contents.
- Private keys never leave the device and are never uploaded.
Your controls
The controls are yours and take effect immediately.
- Stop discovery or revoke a single device at any time.
- Diagnostic export is user-triggered and previewable before you decide.
- Uninstalling removes the app local data.
Retention & deletion
Local data goes away with the app; there is no server-side copy for us to delete.
- Local mode has no server-side copy at all.
- Relay paths keep no content — they only forward.
Changes
Updates are published here; both language versions take effect together.
- Material changes are also noted in the changelog.
Install first, decide later
The client runs Local by default. Read the security model in two minutes if you prefer.