Privacy
The short version: we cannot read what you send, because it is encrypted before it leaves your device and we never hold the key.
Last updated 5 September 2026.
There is no account
The app never asks for an email address, a password, or a phone number, because it has nothing to attach them to. When you first open it, your device makes its own pair of keys and keeps them in the system keychain. That key is your identity. We do not know your name unless you type one in for other people to see, and that name is encrypted along with everything else.
On your own Wi‑Fi, nothing reaches us at all
When your phone and the screen are on the same network, the photo goes directly from one to the other. It does not pass through our relay, our servers, or anyone else's. There is no record of it anywhere but the two devices.
When you send over the internet
Everything is sealed on your device for one specific screen, using that screen's public key. The relay forwards the sealed bytes. It has no key and cannot open them.
What the relay stores
- Which device sent, and which screen it was for — as random identifiers
- How many bytes it was
- When it arrived, and when it was collected
- Whether it was a photo, a text or a PDF
- The sealed bytes themselves, until they are collected
What it cannot see
- The photo, the text, or the document
- Your note, or the name you send under
- The name of a file you send
- The name of the screen it is going to
- Anything at all if you are on the same Wi‑Fi
Photos carry no hidden details
A camera records far more than the picture: where you were, when, which device, and its settings. All of it is removed before a photo leaves your device, on every path, whatever quality you send at.
The one exception is one you make yourself. Include where the photo was taken is off unless you turn it on, and when you do, the coordinates travel encrypted like everything else — the person you sent to gets a button that opens the spot in a map, and we never see it.
How long anything is kept
- A sealed photo or document is deleted the moment the screen collects it. If nobody collects it, it is deleted after seven days.
- The routing record — the identifiers, the size, the timestamps — is deleted after thirty days.
- Delete your device in the app and everything belonging to it goes: the keys we hold for it, every approval in both directions, and anything still queued.
Nothing reaches a screen uninvited
A registered device still cannot send to a screen until that screen's owner has approved it, and approvals can be granted for ten minutes, an hour, a day, or until revoked. The owner can pause or remove any sender at any time.
What we do not do
- No analytics, no tracking pixels, no advertising, and no third-party scripts on any page.
- No cookies. The one page that stores anything in your browser is the web sender, which keeps its own keys on your device so that it can sign its own requests. Clearing site data removes them.
- We do not sell or share anything, because there is nothing to sell or share.
The parts we rely on
The relay sits behind Cloudflare, which terminates the connection and can see the IP address a request came from, as any network provider can. It cannot see inside a message any more than we can. A nightly backup of the routing database is encrypted on our server before it is uploaded to Cloudflare R2; the key to open it is not stored there.
Children
The app is not directed at children under 13 and collects nothing that would identify one.
Changes, and how to reach us
If this policy changes in a way that affects what we can see, the app will say so rather than quietly updating this page. Questions to [email protected].