Privacy
Privacy policy
Synklink connects one Android phone and one Mac. This page says, in plain words, what the two apps, your account, and this website do with your data.
Summary
- What you copy, the links you share and the controls you send go straight from one of your devices to the other. There is no Synklink server in between, and we cannot see any of it.
- You sign in with Google on the phone after pairing. We store your email address, your name, your Google account id, and your two devices: their names, key fingerprints and app and OS versions.
- Both apps send usage statistics and crash events to PostHog, an analytics service in the United States. They count what happened; they never include what you copied, what you played or your email. You can turn this off in either app.
- Feedback you send (ratings, bug reports, ideas, screenshots) is stored by us, and a rating appears on this website only if you ask for it and we approve it.
- The Android app asks for accessibility access for one reason: to notice when you copy text in another app, so it can send that text to your Mac.
- This website measures how visitors use it with Microsoft Clarity and Mixpanel. The apps send nothing to either.
“We” in this policy means Synklink, the operator of the apps, the account service and this website (see Contact).
What Synklink does
Synklink pairs one Android phone with one Mac over your local Wi-Fi network, with Bluetooth LE as a backup when Wi-Fi drops. Once paired, the two devices can:
- share clipboard text in both directions;
- let the Mac adjust the phone’s volume, brightness and ringer, and let the phone adjust the Mac’s volume, brightness and playback;
- show what one device is playing on the other (title, artist, artwork, playback state) and control it from there;
- ring the phone from the Mac;
- open a link shared from the phone in the Mac’s browser (other shared text becomes a web search);
- relay ⌘‑function‑key shortcuts pressed on the Mac to the phone (volume, brightness, playback).
All of that happens between the two devices. The parts of Synklink that talk to a server are your account, update checks, feedback and usage analytics, and each has its own section below.
Data that stays on your devices
Each app keeps a small amount of data on the device it runs on. None of it is sent to us.
Identity keys
On first launch, each app creates its own key pair and a certificate for it. That certificate is the device’s identity on the link: it is what the other device recognises, and it changes only if you reinstall. The phone keeps the private key sealed by the Android Keystore; the Mac keeps it in a file in its Application Support folder that only your user account can read. Neither key ever leaves the device.
Pairing
The Mac shows a QR code holding its name, a device id, the fingerprint of its key, its current addresses on your local network and the ports it listens on. The phone reads the code with the scanner built into Google Play services, which hands Synklink only the decoded text; the app has no camera permission. Without Play services you can type the code instead. The two devices then connect and both show the same six‑digit confirmation code, computed from both keys, and you confirm it on each side.
From then on each device remembers the other’s name, id and key fingerprint, and the phone also remembers the Mac’s local network addresses so it can find it again. Every later connection is mutual TLS: each side presents its certificate and refuses any other key. Unpairing on either device deletes what that device remembered.
Clipboard text
Text you copy travels directly from one device to the other, encrypted: over Wi‑Fi inside the mutual‑TLS connection, and over Bluetooth inside an encrypted channel authenticated with the same device keys. It never passes through a server, ours or anyone else’s, and we cannot read it. Only text is sent; files, images and other clipboard types are ignored.
Each app keeps only the most recent clipboard record, so that a copy made while the devices were apart can be delivered when they meet again. There is no clipboard history.
Controls, playback and shared links
Volume, brightness, ringer and playback commands, keyboard shortcuts, the find‑my‑phone ring, what each device is currently playing (title, artist, artwork, position), and links or text you share to the Mac from Android’s share sheet travel the same way, device to device. They are shown and acted on, not stored.
Status
The phone tells the Mac its battery level, whether it is locked, which permissions are granted and how its background setup stands, so the Mac can show them. The Mac tells the phone its model, macOS version and permission states. This is kept in memory and cleared when the link drops.
Diagnostics
Both apps keep a short rolling log of link events (connected, lost, and why) to help with troubleshooting. A copy is logged as its length and a few characters of a hash, never the text. On Android an uncaught crash adds the exception type and a few stack frames. The log stays on the device unless you attach it to a bug report (see Feedback) or copy it out and send it somewhere yourself.
Account and sign-in
An account is required to use the app. After your first pairing, the phone asks you to sign in with your Google account, and the app waits on that screen until you do. The Mac never signs in; it is shown the phone’s account over the link.
Where you sign in
Signing in uses Google’s own account picker on the phone. Google tells our backend your Google account id, your email address and your name; only verified email addresses are accepted. Synklink never sees your Google password, and we do not ask for your profile picture or any other Google data.
What the phone keeps
Your account id, email address, name and beta status in the app’s private storage; a refresh token sealed by the Android Keystore; and a short‑lived access token in memory only.
What the Mac learns
Only a display: whether the phone is signed in, the email address, the name and the beta status. The phone sends this over the link; the Mac keeps it in memory and never holds a token.
What our backend stores
Our backend is a Cloudflare Worker with a D1 database. Your user record holds an id, your Google account id, your email address, your name, whether you are in the beta (and when you asked, and who approved it), whether developer diagnostics are turned on for you, and when you last signed in.
The phone registers both devices. For each we keep the platform (Android or Mac), the device name, the fingerprint of its public key, which device it is paired with, its app and OS versions, when it was registered and last seen, and, for the phone, a salted hash of Android’s app‑specific device id, so that a reinstall on the same phone is recognised as that phone. We also keep your sign‑in sessions: a hash of each refresh token, never the token itself.
No private key, clipboard content, playback, network address or IP address is stored there.
Admin notifications
The operator runs Synklink from a private Discord server. When an account is created, or you ask to join or leave the beta, a message with your email address, name and the time is posted there. The operator can look up an account by email and see its devices’ names, and changes the operator makes (such as approving the beta) are recorded in an audit log that names the account. A private admin dashboard shows the same records.
Signing out, revoking, deleting
Signing out on the phone removes its tokens; the app then asks you to sign in again. To delete your account, email us from the address you signed in with (see Contact). Deleting removes your user record, devices, sessions, feedback and its screenshots and diagnostics. Two things stay: entries in the admin audit log that name your email, and messages already posted to the admin Discord.
Update checks
Both apps check our backend for new versions. Each check sends the app’s version, the release channel, the OS version and the device’s key fingerprint, so that beta builds reach the right devices. We record the app and OS version and the time against that device. The Mac also reports that it is online, signed with its key, so the phone can see when the Mac was last reachable.
New versions download from our storage on Cloudflare. On Android the app installs its own updates, which is why it asks to install apps.
Feedback
You can send a rating, a bug report, a feature idea or a general comment from either app. Feedback from the Mac is passed to the phone and sent from there.
What a report holds
What you write, the rating, the platform, the app version, your OS version, device model, language and appearance settings, whether we may contact you, and your account. You can attach up to three screenshots; their location and camera metadata is removed before they are stored. A bug report can include the app’s recent log (the last ten minutes); tokens, email addresses, links, file paths and IP addresses are scrubbed from it.
Replies
We can reply to a report and you can answer in the app. The report and each reply are also posted to the operator’s private Discord, with your email address. Screenshots and logs are not.
Reviews on this website
A rating is published here only if you tick the option to share it and we approve it. It shows your rating, your words, the platform, the date and the name you choose: your first name, your initials, or “A Synklink user”. You can edit or withdraw it at any time.
How long it is kept
Logs are deleted after 30 days and screenshots after 90. A closed report is deleted a year after it closed. Ratings, and reports still open, are kept until you delete them or your account.
Usage analytics
Both apps send usage statistics to PostHog, a product‑analytics service, in PostHog’s United States region. We use them to see whether pairing works, whether the link stays up, and which features are used.
Collection is on by default. You can turn it off in Settings on the phone or in the Mac app’s settings; when it is off nothing is recorded and anything waiting to be sent is dropped.
Who you are to PostHog
Not your name or email. Before pairing, each install has a random install id. Once paired, both devices report under one code derived from the key fingerprints of your two devices. After you sign in, the phone attaches your Synklink account id to that code, so usage is linked to your account.
What is sent
- App opens.
- Pairing outcomes: started (QR or typed code), completed, or failed, with a reason code.
- Link health: connected (Wi‑Fi or Bluetooth, with a coarse bucket for how long the reconnect took), lost (with a reason code), a failover to Bluetooth, and whether a scheduled reconnect while the phone was dozing worked.
- Usage, as hourly counts: clipboard sends per direction, controls used (which kind and which direction), find‑my‑phone rings, and keyboard shortcuts (which chord and action). Seven copies between 8 and 9 arrive as one event: “clipboard sent, phone to Mac, count 7, 08:00”.
- Account, feedback and updates: sign‑in offered, completed or failed (by class), signing out, feedback opened or sent, a review published or withdrawn, and an update offered, installed or failed.
- Permission and setup outcomes: a permission granted or removed (which one), the background‑setup result (manufacturer and outcome), a feature switch turned on or off, the Bluetooth backup’s state, and unpairing.
- Crashes: on the next launch after a crash, the error type and where it happened in the app’s code.
- On every event: platform, app version and build, whether it is a debug or release build, OS version, and the device model (phone: manufacturer and model; Mac: chip and model identifier).
What is never sent
- Clipboard text or shared links.
- Notification or track text: no titles, artists or artwork.
- Wi‑Fi network names.
- Your email address or name.
- Serial numbers or advertising ids.
- The exact time of an individual copy, press or control. Usage is counted by the hour.
Every event tells PostHog not to work out a location from your IP address.
How it travels and how long it stays
Events queue on the device in a small file (at most 500 entries) and go to PostHog over HTTPS in batches. PostHog keeps them for a limited period; the exact retention period is not yet published. We can find and delete the events attached to your account on request.
Permissions on Android
The app asks for each permission when the feature needs it, from its Setup screen, and you can take any of them back in Android’s settings. Here is what each one is for.
Accessibility service
Synklink uses the Android AccessibilityService API to detect when you copy text in other apps, so that it can send that text to your paired Mac. Android 10 and later does not let an app in the background read the clipboard, so this service is the only way copy detection can work while you are using another app.
To recognise a copy, Android delivers the service accessibility events such as clicks, long‑presses, text selections, text changes, window changes and announcements. Synklink uses them only to decide that a copy just happened; it does not keep them, does not build a record of what you type or see, and does not send them anywhere. Once a copy is detected it reads the clipboard, briefly using an invisible overlay window when Android requires one for an app that is not in the foreground, and sends that text to your paired Mac over the encrypted device‑to‑device link. If the clipboard cannot be read, the text you had selected at the moment of the copy is used instead. Nothing it observes is stored beyond the latest clipboard record, and nothing is sent anywhere except your paired Mac.
The service is optional. Without it, copying from the phone to the Mac stays off; copying from the Mac to the phone, controls and everything else keep working. You can turn it off at any time in Settings › Accessibility on the phone.
Notification access
Optional. It lets the Mac see and control what is playing on the phone. Android hands the list of active media players (title, artist, artwork, playback state) only to an app with an enabled notification listener, so Synklink registers one. Synklink does not read, store or forward the content of your notifications; the listener exists only so that Android will share media sessions. What is playing is sent only to your paired Mac. Without this access the Mac keeps a single play/pause control that works through a media key.
Nearby devices (Bluetooth)
For the Bluetooth backup link, asked for in Settings › Bluetooth backup on Android 10 and later. Android’s companion‑device picker is how the phone learns which Mac to dial. The same permission lets the app name your connected earbuds in the Mac’s output picker; without it they read “Bluetooth device”.
Notifications
On Android 13 and later, for the connection notice. The link runs as a foreground service of the connected‑device kind, which is what keeps it reachable while the phone sleeps, and Android shows a persistent notification for it.
Battery and background
An exemption from battery optimisation, exact alarms and starting at boot keep the link alive while the phone dozes and bring it back after a reboot. The Setup screen also points at your manufacturer’s own sleep and auto‑start lists; opening those settings sends nothing anywhere.
Controls from the Mac
Modifying audio settings (volume, mute, ringer), modifying system settings (brightness), vibration, and reading audio files. Find‑my‑phone plays the system’s default alarm tone, which on Android 13 and later an app can only read with the audio‑files permission; the app does not look at your music.
Installing updates
Android asks once, the first time, to let Synklink install its own updates.
Network
Internet, network state and Wi‑Fi state, to find the Mac on your network and talk to it, and to reach our backend and PostHog. The link itself does not need the internet.
Camera
Not requested. QR scanning is done by Google Play services’ code scanner, which runs the camera itself and hands Synklink only the decoded text.
Permissions on macOS
Local Network
To find and reach the phone on your network by Bonjour. Nothing leaves that network.
Bluetooth
For the backup link. The Mac advertises itself over Bluetooth LE so the phone can connect when Wi‑Fi cannot reach it.
Accessibility
Asked for the first time you send play/pause, next or previous from the phone: macOS drops those synthetic media keys from an app without the grant. The same grant lets Synklink watch for ⌘‑function‑key chords to relay them to the phone; to find them it sees key presses, acts only on those chords and records nothing. Volume and brightness set from the phone need no grant.
No permission needed
The Mac app watches its own clipboard for new text to send to the phone, and reads what the Mac is playing (title, artist, artwork) through a small helper to show it on the phone. Neither needs a grant, and neither goes anywhere but the phone.
This website
This website uses two analytics services to learn which parts of the page help people and which do not. Microsoft Clarity records how you scroll, click and move through the page, as heatmaps and session replays; it runs without cookies and masks text you type. Mixpanel counts page views, clicks and the actions you take here, such as opening a chapter of the demo, opening a question or downloading an app, and also keeps session replays of visits, under a random identifier kept in your browser’s local storage. Neither service receives your name or email from us, and Mixpanel is told not to record your IP address.
If you choose a light or dark appearance, that choice is stored in your browser’s local storage as synklink.theme. The site loads no third‑party fonts.
The website is hosted by Vercel. Like every website, the server that delivers it receives your IP address and browser details in order to respond, and the host may keep standard access logs for security. We do not use them to identify you.
Third parties
We do not sell your data and we do not share it with anyone other than the services below, each of which receives only what it needs for the job described.
- Signs you in (Google account id, email address, name), and Google Play services provides the QR code scanner. Privacy policy
- Cloudflare
- Runs our backend and database, stores feedback screenshots and logs, and serves app downloads. Privacy policy
- Discord
- Carries the operator’s admin notifications: new accounts and beta requests (email and name), and feedback reports and replies (text and email). Privacy policy
- Vercel
- Hosts this website and the operator’s admin dashboard. Privacy policy
- PostHog
- Receives and stores the app usage and crash events described under Usage analytics, in its United States region. Privacy policy
- Microsoft Clarity
- Records how visitors use this website, as described under This website. Privacy statement
- Mixpanel
- Counts page views and actions on this website and keeps session replays, as described under This website. Privacy policy
Children
Synklink is not directed at children under 13, and we do not knowingly collect personal data from them. If you believe a child under 13 has created a Synklink account, contact us and we will delete it.
Changes to this policy
When this policy changes, the new version appears here with a new effective date. If a change means new data will leave your device, for instance a new kind of report or a new service, we will describe it here and note it in the apps’ release notes before it starts.
Contact
This pre-release project is published under the Synklink name. The legal operator name and address are not yet published.
A contact address for privacy questions and deletion requests is not yet published.