Privacy

Files and credentials

Files, previews, search indexes, transfer history, and saved computer details are stored on your devices. Computer login credentials are saved in your device’s Keychain or protected credential storage. They are not stored by the Toss connection service.

Toss-to-Toss transfers encrypt filenames and file contents between the two phones. The recipient must accept before receiving files. Temporary invitations expire, and the service does not store the files. Keep invitations private: anyone holding a valid invitation can receive that transfer.

Remote file transfers and terminal sessions use encrypted SSH connections between your phone and computer. The connection service forwards that encrypted traffic; it cannot read your files, filenames, terminal commands, or SSH password.

Mac cameras and activity alerts

Mac camera viewing and people or motion monitoring are optional. Detection and clip recording run on your Mac, and recorded clips are stored there. Live video and clips you view travel between your phone and Mac over an encrypted connection; the Toss connection service does not receive unencrypted camera images.

If you enable activity alerts, the service stores your phone’s Apple push-notification token with its pairing and queues computer and event identifiers, the activity type and time, and delivery status. Apple’s Push Notification service receives the device token, computer and event identifiers, and generic notification text, with no camera images, clips, or camera names. In normal operation, event and delivery records are pruned after about an hour. Recovery backups may retain earlier service records as described below. Disabling activity alerts removes the push subscription from the active pairing record; removing the pairing also revokes it.

Connection service

For remote access, Toss stores random account and device identifiers, computer and phone labels, hashed access tokens, pairing dates, last connection times, and relay data-usage counters. Existing beta registrations may also have an invitation name. Phone platform and app version may be included. These records authorize your devices, support revocation, and enforce usage limits. Relay data is shared across an owner’s computers; local and direct internet payloads do not consume that allowance.

When email signup is available, Toss stores your verified email address to sign you in and recover access to account management. Verification codes expire after ten minutes and are stored as keyed hashes. Account session tokens are stored as hashes on the service and in protected storage on your device. We use Resend to deliver verification emails; it receives the recipient address and the sign-in email, but not your computer files or access credentials. Resend's standard Free-plan retention is 30 days for email content and delivery metadata. A sign-in code remains invalid after its ten-minute expiry even if its email is retained. Sign-in emails do not include tracking pixels or tracking links.

When you choose Apple or Google sign-in, the provider verifies your identity in its own protected sign-in flow. Toss does not receive your Apple or Google password, files, photos, or email inbox. Toss stores a keyed, one-way identifier of the provider account, and may store your verified sign-in email. You can explicitly connect another sign-in method to keep the same Toss account and computers.

Provider access and refresh credentials are encrypted on the connection service and used to maintain or revoke the sign-in connection. Short-lived sign-in handoffs cannot be reused and are bound to the initiating device. Verified account-security notifications from Apple or Google can end account-management sessions or prevent delivery to a disabled recovery address. These notifications do not grant access to your files.

Deleting your Toss account removes its provider connections from Toss and requests revocation at the provider. If a provider is unavailable, an encrypted revocation request may be retained for up to seven days. You can also remove Toss in your provider’s connection settings. Keyed provider identifiers may be retained with the existing quota-abuse guard until seven days after month end; encrypted recovery backups follow the existing retention period.

Network addresses establish connections and limit abusive requests. The connection service keeps short-lived request counters in memory. For email sign-in limits, it stores a keyed, one-way identifier of the requesting network address rather than the raw address in its persistent rate counters. These counters are not used for advertising, tracking, or location profiling. Local route hints are held in memory so Toss can use a faster connection on the same network. The service runs on DigitalOcean in the United States.

Service records remain while your access is active. You can revoke paired phones in desktop Toss. Accounts created through Toss sign-in can be deleted in Toss Settings; this removes the account and revokes its computer registrations and paired phones. Files and clips on your devices are not deleted. To prevent repeatedly deleting and recreating an account to reset its relay allowance, we retain a keyed, one-way email or provider identifier and its quota scope until seven days after the end of that month. When email sign-in is used, verification request counters older than the two-day cutoff and email challenges older than one day are pruned. Expired records may remain until that cleanup runs; codes are still invalid after ten minutes. Recovery backups may retain earlier records for up to 30 days. Contact us for help deleting a legacy beta registration.

Browser and local permissions

Toss uses Apple’s WebKit browser. Websites you visit receive normal browser requests and may set their own cookies or collect data under their own policies. Downloads stay in Toss until you move or remove them.

Your phone’s camera permission is used to scan pairing codes. Photos and files are imported when you choose them. Local network access finds and connects to nearby computers. Notifications are optional.

Beta feedback

TestFlight is provided by Apple and may share beta feedback, screenshots, crash reports, and usage information with us. If you email support, we receive the address and information you send. Please do not include passwords, setup keys, or private files.

Toss does not sell personal data or use advertising trackers. On-device performance diagnostics are not automatically uploaded to us.

Contact

Toss is operated by Daniel Davydov. For support, data-access requests, or deletion, email danieldavydov0@gmail.com.

Changes to this policy will appear here with an updated date.