Privacy

What MacSway handles, and where your information stays.

1. Who is responsible

The controller of personal data described here is the independent publisher of MacSway. Contact for all privacy questions and requests: [email protected]. A postal address is available on request at the same address.

2. The apps (iPhone and Mac)

The apps work without an account. We do not run a server that receives your content, commands, screen images, files, clipboard text or photos.

• What moves between your devices: pointer and keyboard commands, typed text, clipboard text, photos and files go from your iPhone to your Mac; live screen images go from your Mac to your iPhone. This traffic uses a direct, encrypted connection (TLS 1.3, pinned to the paired device) on your local network, over Tailscale if you set it up yourself, or, if you switch on “Remote access over the internet” in the Mac companion, over a direct peer-to-peer connection between your devices (see the next point). It never passes through a MacSway server.
• Remote access over the internet (optional, Pro, off by default): to set up the direct connection, your two devices exchange two small messages through the public notification service ntfy.sh (open source). The messages are encrypted and authenticated with a key derived from your pairing, so the service cannot read or forge them; it can only see that encrypted messages pass through a random topic name, the IP addresses of the devices that connect to it, and it keeps messages for up to 12 hours. To find a path between the devices, the apps also ask public STUN servers (Google, Cloudflare) for the public address of your connection, which reveals your IP address to them. Once connected, your content flows directly between your devices and never through ntfy.sh or any server of ours. A new device can never be paired over this connection: only devices you already paired on your local network can log in.
• What stays on your devices: preferences, favourites, device names and pairing information. Keys and credentials are stored in the system Keychain; the Mac keeps authorisation records for paired phones (token hashes). Files you send are saved in the Downloads folder of your Mac. MacSway does not intentionally save live screen images.
• Optional setup answers (intended use, how you heard about MacSway) stay in the local iPhone settings and are never sent to us. You can change or delete them in Settings → Setup & profile.
• Permissions: Accessibility lets the Mac companion move the pointer and type; Screen Recording lets it show the screen; Automation may be needed for music-player controls; Local Network lets the apps find each other. You can revoke them in System Settings, revoke a paired phone from the Mac menu, and remove a Mac from the iPhone. Removing a pairing does not delete files already sent to Downloads.
• No analytics, advertising or tracking is included in the iPhone or Mac apps. We do not sell or share personal information, and we do not combine data across apps or websites.

3. This website

• Anonymous visit counter (our own server): a simple count of page views, button clicks, country (from your connection, not your address), language and referring site, with no cookie, no identifier, and no IP address stored. It only increases numbers, and it is switched off if your browser sends Do Not Track or Global Privacy Control.
• Visit counting (Google Analytics 4): only if you click “Accept” in the banner. It counts page views, countries and referrers. It is configured without cookies or other identifiers stored on your device, with IP anonymisation, with advertising features and Google signals off, and data retention set to 14 months. If you decline, or your browser sends Do Not Track or Global Privacy Control, it never loads. You can change your choice at any time with “Cookie settings” in the footer.
• Your choice is stored in your browser (local storage, key macsway-consent) so that we do not ask again. It contains only “granted” or “denied” and stays until you clear your browser data.
• Delivery: the site is delivered through Cloudflare (DNS, TLS, caching and security filtering), which processes visitors' IP addresses to deliver the pages and defend against abuse. It runs on the publisher's own server, which keeps no access logs of visitor IP addresses.
• The site has no forms, no accounts, no advertising and no social-media widgets. The site sets no cookies of its own.

4. If you email us

If you write to [email protected] we process your message and email address to answer you and to improve the app, and delete the conversation when it is no longer needed, normally within 12 months of the last message. The mailbox is provided by our email host.

4a. Launch notification

If you enter your email in the notification form on this website, we store your email address, the page language, which button you pressed and the time, on our own server. We use it only to send you a single message when MacSway is available, and delete it afterwards, at the latest 30 days after that message. We do not share it and do not use it for anything else. The legal basis is your consent, which you can withdraw at any time by writing to [email protected], and we will delete your address on request. The form is protected against abuse without storing IP addresses.

5. Purposes and legal bases (GDPR / UK GDPR)

• Counting visits with Google Analytics: your consent (Art. 6(1)(a) GDPR; storage/access rules of the ePrivacy Directive). You can withdraw it at any time; withdrawal does not affect earlier processing.
• Delivering and securing the website: our legitimate interests in a working, safe site (Art. 6(1)(f)).
• Answering your email: steps at your request and our legitimate interests in supporting users (Art. 6(1)(b) and (f)).
• Remembering your consent choice: strictly necessary for honouring your choice (Art. 6(1)(c) and (f)).

We make no automated decisions with legal or similarly significant effects, and we do no profiling.

6. Who receives data

Recipients act as processors or independent providers: Google (analytics, only with consent), Cloudflare (content delivery and security), our email host, and Apple (App Store purchases, which we do not see beyond what Apple reports to us, such as anonymous sales figures). If you switch on remote access over the internet, the ntfy.sh service (encrypted setup messages) and public STUN servers run by Google and Cloudflare (your public IP address) receive the technical data described in section 2. Tailscale only handles traffic you route through your own Tailscale network and has its own terms and privacy policy. Update checks: the Mac companion can ask macsway.com whether a new version exists (a standard web request that carries the app and macOS version, as every web request carries your IP address and is not stored by our server); you can turn automatic checks off in the companion's settings. Apple and your device settings govern system logs and crash reports. We do not sell personal information.

7. International transfers

Google and Cloudflare may process data in the United States and other countries. Where required, transfers rely on the EU–US Data Privacy Framework (and its UK and Swiss extensions) or on Standard Contractual Clauses.

8. How long we keep data

Google Analytics data: 14 months. Email conversations: normally up to 12 months after the last message. Consent choice: until you clear it. Apps: nothing is kept by us; data on your devices stays until you delete it.

9. Your rights

Depending on where you live, you can ask us for access to your data, correction, deletion, restriction, a portable copy, and you can object to processing and withdraw consent. Write to [email protected]; we answer within one month (GDPR), 45 days (California) or the period your law sets. We may need to verify that the request is yours. You will not be treated worse for using your rights.

• EEA, UK and Switzerland: the rights above under GDPR, UK GDPR and the Swiss FADP. You may complain to your supervisory authority (for example in Hungary the NAIH, naih.hu; in the UK the ICO).
• California and other US states (CCPA/CPRA, Virginia, Colorado, Connecticut, Texas, Utah and others): you may ask to know, access, correct and delete personal information, and opt out of sale, sharing and targeted advertising. We do not sell or share personal information and do not use it for targeted advertising, and we honour Global Privacy Control. We collect no sensitive personal information. In the last 12 months the only categories we may have received are identifiers and internet activity (analytics, with consent) and the contents of emails you sent us.
• Canada (PIPEDA, Québec Law 25): you may ask for access and correction and withdraw consent. Our privacy contact is the address above.
• Brazil (LGPD), Australia, Japan, South Korea, South Africa and other countries: you have the access, correction, deletion and objection rights your national law provides; use the address above.

10. Children

MacSway is not directed at children under 13 (or under 16 where your country sets that age) and collects no personal data from anyone through the apps. If you believe a child has emailed us, tell us and we will delete the message.

11. Security

Device-to-device traffic is encrypted with TLS 1.3 and pinned to the paired device, pairing needs a six-digit code confirmed on the Mac, and credentials live in the system Keychain. No system is perfectly secure; please keep your devices and operating systems updated.

12. Changes

If the MacSway apps ever add accounts, a relay that carries your content or analytics, we will update this policy and the in-app controls before any data is collected. We will change the date below whenever this page changes.

Updated October 26, 2026.