Legal · Effective October 24, 2026

Security and data handling

Security information is based on the current public source and may change between releases. Review the current release notes for version-specific changes.

Report a vulnerability privately

Use GitHub Security Advisories to report a vulnerability. Include the affected version, reproduction steps, and impact. Do not disclose the issue publicly before the maintainer has had a chance to investigate.

Do not attach private keys, personal files, credentials, or live pairing codes. If GitHub’s private reporting flow is unavailable, contact Arslan Basharat and request a private channel; do not post exploit details in a public issue.

Transfer safety

Wireless transfers use a reachable local network and an encrypted Quick Share session; the app does not relay files through a Nearby Drop server. USB MTP communicates over the connected cable. Review incoming requests before accepting them, and use automatic acceptance only for devices you trust. Device trust does not verify a Google account.

Transfer history and trusted-device settings are stored locally by the app. A history entry may include a file name, size, peer name, direction, timestamp, and local file URL. Pairing codes and QR data can authorize a nearby connection; do not publish them. See the privacy page for data details and the repository’s security policy for the current reporting guidance.

Updates

Security fixes target the latest release. Download the app only from the official GitHub Releases page, and check its published verification details before installing.