Privacy policy

The short version

Who we are

Portty is made by Corvux Mindware. Questions about this policy, or about your data: support@meetcorvux.com.

Your sessions stay between your devices

When your phone is paired with your computer, the two talk over an encrypted connection that only they hold the keys to. These travel inside that connection and nowhere else:

• terminal output and everything you type;
• files you upload or download;
• coding-agent conversations and your approvals;
• the pairing code from your computer, and the 6-digit check code;
• the names of your computer and your phone.

Corvux Mindware runs no server that your sessions pass through. Nothing above is copied to, stored on, or read by any server of ours or anyone else's.

Connection servers (relays and lookup)

Your phone and computer connect directly whenever they can. To find each other — and to carry the connection when a direct link isn't possible — both use public relay servers and a lookup service (dns.iroh.link) run by n0, the company behind the open-source iroh networking library. The relays are in the United States, Europe and Asia-Pacific. Corvux Mindware does not run these servers and receives nothing from them.

While Portty is connected or pairing, these servers can see:

• your device's IP address;
• a random device ID that Portty creates on your device. It is not linked to your name, phone number or hardware, and it stays the same until you uninstall the app or clear its data;
• which of your devices connect to each other, and when and how much data passes.

They cannot see the contents of anything listed in the section above: it passes through as sealed, encrypted data.

So the other device can find it, each device also publishes a small signed record to the lookup service: its device ID and the relay it uses. Anyone who knows that ID can look the record up. IP addresses are not published.

n0 offers these public servers free of charge, without service or privacy guarantees, and watches them for abuse. n0, not Corvux Mindware, decides how long connection records are kept: see n0's notes on its public relays and n0's privacy policy. As with any internet service, your network provider can also see that your device connects to these servers.

What is stored on your phone

Portty keeps a little data on the phone itself, so you don't have to pair again every time:

• the keys for each paired computer, protected by the phone's secure key storage;
• the names you give your saved computers, and their default folders;
• your settings, including the approval rules you set for coding agents and a record of your recent approvals;
• recent session content, held for a short time so the screen can be restored after a reconnect.

This data stays on your phone, and is kept until you remove it or uninstall the app. On Android it is left out of cloud backups and is not copied to a new phone. You can delete it at any time (see Your choices). Corvux Mindware keeps no copy of any of it.

Camera

The camera has one job: scanning the pairing QR code that your computer shows. The image is read on the phone as it is scanned. Nothing is saved or uploaded. You can paste the pairing code instead, so you can say no to the camera permission.

App lock and biometrics

On phones with a fingerprint or face unlock, Portty locks itself by default, and you can turn the lock off. To unlock, Portty asks the phone's operating system to check it is you. The check happens inside the operating system: Portty only gets a yes or no, and never sees your fingerprint, face data or passcode.

Notifications

Approval alerts appear on your phone while Portty is open. This version does not send alerts through any push-notification server. On iPhone, iOS gives the app a notification token; it is passed only to your own computer, over the encrypted connection.

What we never do

• No analytics or usage statistics.
• No crash-reporting or tracking tools.
• No ads, and no advertising ID.
• No selling your data, and no sharing it for ads or tracking. The only details that leave your devices are what the connection servers above need to route your connection.
• No account, email address or phone number needed.

Because we never have your session content, we have none to hand over if anyone asks for it.

Your choices

• Remove a saved computer from your phone: on the Connect screen, remove it from the list, or use “Forget all saved hosts”.
• Remove a phone's access from your computer: run portty-host peers, then portty-host revoke <id>.
• Delete everything on the phone: uninstall the app. This also deletes its random device ID; copies of the ID on n0's servers expire on n0's own schedule. There is no account to delete.
• Camera: deny it and paste pairing codes instead.
• Questions or data requests: email support@meetcorvux.com.

Depending on where you live, you may have the right to see, correct or delete personal data held about you. We hold none ourselves. For records kept by n0's servers, contact n0.

Portty is a tool for software developers. It is not meant for children, and we do not knowingly collect data from children.

Changes to this policy

If Portty changes in a way that affects your privacy — for example, if push notifications are added — we will update this page before the change ships, and change the date at the top.