Nothing to collect, nothing to leak.
Latchway has no accounts, no analytics and no storage. This page explains what the pieces involved can and cannot see, so you can decide for yourself.
The app
Latchway on your phone reads only the file you choose to send and writes only the file you choose to receive. It asks for no storage permission; files come in through Android's picker and share sheet. The only permissions it uses are internet access, the foreground-service notification that keeps a transfer alive, and notifications for "someone wants to download".
Nothing you do in the app is reported anywhere. There are no crash reporters, advertising identifiers or usage statistics. The command-line tools behave the same way.
The rendezvous server
When you share a file, your device keeps a connection open to a small server (latchway.app by default, or one you choose). When your friend opens the link, the server introduces the two devices to each other and relays their connection handshake. That handshake is encrypted with a key that exists only in the link, so the server relays bytes it cannot read.
- It seesthe share identifier from the link, the IP addresses of both devices while they connect, and when that happened.
- It never seesthe file, its name, its size, the key, or any password.
- It keepsnothing. There is no database and no log of transfers. Cloudflare, which hosts the default server, keeps its standard short-lived request logs for operating the service.
The connection between devices
The file travels directly from one device to the other over an encrypted channel (WebRTC, the technology behind video calls, with Latchway's own encryption on top). On a direct connection, each device learns the other's IP address; that is how direct connections work.
When a direct path isn't possible, the encrypted stream passes through a relay (Cloudflare's TURN service for the default server). The relay sees traffic volume and the devices' addresses, not the contents. If you prefer to never reveal your address to the other person, turn on relay only; transfers are then always relayed.
The link
The link carries the key after the #. Anyone who has the complete link can download the file while you are sharing it. Treat it like the file itself: send it over a channel you trust, add a password for anything sensitive, and stop sharing when you're done. Stopping the share makes the link useless immediately.
This website
These pages set no cookies, load nothing from third parties and run no analytics. The page a link opens checks once whether the sender is online; that request contains the share identifier and nothing else.
Children
Latchway is a general-purpose tool and does not knowingly collect any information from anyone, including children, because it collects no information.
Changes and contact
This policy is versioned with the source code at github.com/gabeazar/latchway; the history there is the change log. Questions go to the issue tracker or the contact in SECURITY.md.