Privacy Policy

Reflecto — the private bridge between your devices
Effective Date: August 9, 2026
Last Updated: August 23, 2026
Data Controller: Reflecto, based in New Delhi, India
Contact: privacy@reflecto.dev

1. Introduction

Reflecto is a privacy-first bridge between the devices you already own — an Android app, a Chrome extension, a web app, and a command-line tool — joined by end-to-end encryption. It mirrors your phone's notifications to your computer in real time, lets you dismiss and reply to them without picking up your phone, syncs your clipboard in both directions, and transfers files between your devices. A Signal-style safety number lets you verify in person that your paired devices are talking to each other, not to an impostor. Reflecto also offers a public API and a Model Context Protocol (MCP) server, so you — or an AI agent acting on your behalf, such as Claude or ChatGPT — can send notifications to your own paired devices, and you can share a link or a note back to an assistant from your phone. Those paths are the documented exceptions to the end-to-end encryption described above: an assistant holds no keys, so our server has to compose the message on the way out, and has to be able to read what you share on the way in. Section 2 sets out exactly what that means.

Separately, if you use Reflecto's command-line tool and deliberately turn on agent access, an AI assistant you connect can read the notifications that computer has already received. This is not another exception to the encryption above: the decryption happens on your own machine, and our server continues to hold only ciphertext it cannot read. What changes is who can read it on your side. You turn it on with a command you type yourself, it reaches only notifications that arrive after that moment unless you explicitly ask for older ones, and you can revoke it at any time.

This Privacy Policy explains what data we collect, why we collect it, how we process and protect it, and what rights you have over your data. It applies to the Reflecto Android application, the Reflecto Chrome browser extension, the Reflecto web app, our command-line tool, the Reflecto server infrastructure, and the Reflecto website and landing page at reflecto.dev.

We built Reflecto with a privacy-first architecture: notification, clipboard, and file content that moves between your own devices is end-to-end encrypted (E2E) using X25519 key exchange and XSalsa20-Poly1305 (NaCl secretbox) encryption, and our server cannot read it. Messages that originate from our public API or MCP server work differently, because the server itself has to compose them — see Section 2, "How We Handle Your Content," for the precise distinction. We do not want the general encryption claim above to overstate what happens on that one path.

2. How We Handle Your Content: Two Tiers

Reflecto's core architecture is end-to-end encryption: content is encrypted on one of your devices and decrypted only on another of your devices, with our server relaying opaque ciphertext it cannot read. That is true for every notification mirrored from your phone, every clip synced through the clipboard, and every file transferred device-to-device.

There are two documented exceptions, both involving AI assistants you connect, and both described precisely below.

Device-to-device (end-to-end encrypted — our server cannot read it)

Notifications mirrored from your Android phone, clipboard content synced between your paired devices, and files sent between your paired devices are all encrypted on the sending device before they reach our server, and decrypted only on the receiving device. Our server only ever handles ciphertext on this path — it holds no key that could decrypt it.

Public API and MCP (server-as-sender)

Reflecto's public POST /v1/send API and its remote MCP connector (used by AI agents such as Claude or ChatGPT to message your devices on your behalf) work differently, by necessity: the caller is not one of your paired, key-holding devices, so there is nothing on the sending side to encrypt with beforehand. The server itself has to compose the message. Concretely: the plaintext content you or your agent sends arrives at our server, is held in memory (RAM) only — never written to disk, never logged — while the server encrypts it individually to each of your paired devices, and is discarded immediately afterward. Nothing on this path is persisted; the exposure is a brief, in-memory step, not storage. This is a deliberate, documented design decision, and it does not change or affect the device-to-device path described above in any way.

Sharing something to an agent (inbound)

You can also send in the other direction: tapping Share to Agents on your phone hands a link, a note, or a snippet to an AI assistant you have connected, so it can read it the next time it checks. This path only ever carries what you explicitly shared that way. It does not give a connected assistant access to your notifications, your text messages, or anything else on your phone.

This is the second documented exception, and the more consequential one. Be aware that this path is not end-to-end encrypted, and it differs from the in-memory case above in one way that matters: the item is stored until your assistant reads it. Your phone encrypts it before sending, and it stays encrypted on our servers — but with a key we hold, because the assistant that needs to read it is not one of your key-holding devices. So while an intruder with a copy of our database could not read your shared items, we could. We do not, but the guarantee here is a policy and an architecture, not mathematics, and we would rather say so than let the stronger promise above appear to cover this too.

Only the most recent 50 shared items are kept, and they expire automatically — an item is removed about a day after the last time you shared anything. So if you share often, older items can persist longer than a day; if you stop, everything clears within about one. Nothing you share this way is used for anything other than handing it to the assistant you connected.

3. Data We Collect — At a Glance

The table below summarizes all data Reflecto collects or processes. Detailed explanations follow in subsequent sections.

4. Data Collection in Detail

4.1 Data Stored on Our Server

Our server stores the minimum data necessary to route encrypted messages between your paired devices. Specifically:

• Device identifiers (UUIDs): Randomly generated identifiers assigned to each of your devices at pairing time. These are not linked to your personal identity, email, or phone number.
• User identifier (UUID): A randomly generated identifier created on your Android device at first install. This groups your devices together for message routing. It is not linked to any personal information.
• Public encryption keys: Your devices' X25519 public keys, exchanged during pairing. These are cryptographic values used to facilitate the key exchange and to compute the safety-number verification fingerprint on your devices. They cannot be used to decrypt your content.
• FCM registration tokens and Web Push subscriptions: Tokens issued by Google's Firebase Cloud Messaging service (Android) and by your browser's push service (web app), used to deliver push messages to your devices. These are opaque identifiers managed by Google or your browser vendor and rotate periodically.
• Device name: The label you optionally give a device (for example, "Abhishek's Pixel"), stored so it can be shown in your device list.
• Encrypted message blobs: When one of your devices is offline, encrypted messages — notifications, clipboard text, dismiss/reply/action commands — are queued in Redis for up to 24 hours (200 most recent per device; oldest dropped first if exceeded). These blobs are encrypted on the sending device before reaching our server. We cannot read, decrypt, or inspect their contents.
• Encrypted clipboard images: Clips too large for the inline message path (for example, screenshots) are held in a separate transient store for up to 1 hour. Still ciphertext only.
• File-transfer metadata and ciphertext: When you send a file to a paired device, our server temporarily coordinates the transfer: it stores routing metadata (sender/recipient device IDs, part count, encrypted size) and the encrypted file data itself in temporary object storage for up to 12 hours during an active transfer. Filenames and file contents are encrypted before they reach us; we cannot read them.
• Public API / MCP message content: When a message is sent through our public API or MCP server — rather than mirrored from one of your own devices — our server briefly holds the plaintext content in memory in order to encrypt it to your devices. See Section 2 above. This plaintext is never written to disk, never logged, and is discarded immediately after encryption.
• Message timestamps: Server-assigned timestamps used for ordering and synchronizing messages, retained for the same window as the message they belong to.

4.2 Data That Never Reaches Our Server

The following data is processed exclusively on your local devices and is never transmitted to our server in readable form:

• Notification content (app names, titles, message bodies, sender names)
• Clipboard content — text and image clips you copy or paste
• File contents and filenames transferred between your devices — only encrypted ciphertext transits our infrastructure (see 4.1)
• Your private encryption keys (stored in Android Keystore, in chrome.storage.local on the Chrome extension, and in your browser's local storage on the web app)
• The shared encryption secret computed by your devices
• Your app filtering preferences (which apps are mirrored)
• Your reply text (encrypted on-device before transmission)
• The safety-number verification fingerprint shown in your device settings — computed locally on your device from public keys already exchanged during pairing; never calculated or stored on our server

4.3 On-Device AI (Glance)

Glance, Reflecto's on-demand recap of notifications you may have missed, runs entirely on your device using Chrome's built-in AI model (the Chrome Prompt API / Gemini Nano). Notification content, the prompts sent to the model, and its output never leave your device and are never sent to, seen by, or logged by our server. Using Glance requires a one-time, explicit download of the on-device model; after that it runs automatically, with no separate opt-in toggle and no server-side processing.

4.4 Crash Reporting (Firebase Crashlytics)

We use Firebase Crashlytics, a service provided by Google LLC, to collect crash reports from the Reflecto Android application. When the app crashes, Crashlytics automatically collects technical diagnostic information including:

• Device model, operating system version, and device orientation
• Amount of free RAM and disk space at the time of crash
• A Crashlytics installation UUID (a random identifier, not linked to your personal identity)
• Stack trace of the crash (technical error information from the application code)

Crashlytics does not collect notification content, app names, message text, or any data from your notifications. Crash reports are retained by Google for 90 days.

Firebase Crashlytics' data processing terms are governed by Google's Firebase Crashlytics terms.

5. How We Use Your Data

We use the data described in Section 4 for the following purposes and no others:

• Routing encrypted messages between your paired devices — notifications, clipboard, files.
• Delivering push notifications to your Android device via Firebase Cloud Messaging, and to browsers via Web Push.
• Queuing encrypted messages when a device is offline, for delivery when it reconnects.
• Coordinating file transfers between your devices (routing metadata and temporary ciphertext storage only — see 4.1).
• Composing and encrypting messages sent to your devices through our public API or MCP server, at your (or your agent's) request.
• Diagnosing and fixing application crashes and bugs (via Firebase Crashlytics).
• Understanding anonymous, aggregate traffic to our marketing website (see Section 13).

We do not use your data for advertising, profiling, behavioural tracking, or selling to third parties. We do not build user profiles. We do not serve ads.

6. Legal Basis for Processing (GDPR)

If you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, we process your data under the following legal bases as defined by the General Data Protection Regulation (GDPR):

• Legitimate interest (Article 6(1)(f)): We process device identifiers, public keys, push tokens, and encrypted message/clip/file blobs because it is necessary for the core functionality of the service (relaying encrypted content between your devices). You cannot use Reflecto without this processing, and we have assessed that this processing does not override your fundamental rights given that the data is either non-personal (random UUIDs, public keys) or encrypted and unreadable by us.
• Legitimate interest (Article 6(1)(f)): We process message content, transiently and in server memory only, when you or an authorized AI agent uses our public API or MCP server to send a message to your own devices — this processing is necessary to perform the action you requested, and no plaintext is retained afterward (see Section 2).
• Legitimate interest (Article 6(1)(f)): We process crash reports via Firebase Crashlytics to maintain and improve the reliability of the application.

7. Third-Party Services

Reflecto uses the following third-party services that may process limited data:

7.1 Firebase Cloud Messaging (Google LLC)

Used to deliver push messages to your Android device. Google processes FCM registration tokens and delivery metadata. Google's privacy policy applies to this processing.

7.2 Firebase Crashlytics (Google LLC)

Used to collect and analyse crash reports from the Android application. Processes technical diagnostic data as described in Section 4.4. Data is processed and stored by Google in the United States.

7.3 PostHog (analytics)

PostHog is the only analytics processor Reflecto uses. It covers three separate surfaces: our marketing website at reflecto.dev (page views and store-button clicks only, cookieless — no cookies, no persistent identifiers, no personal data), anonymous product analytics in the Android app, Chrome extension, and web app — which PostHog tags with an approximate, network-derived location (Section 13.2) — and aggregate telemetry from our server. See Section 13 for the full technical detail of each. Data is processed by PostHog, Inc. in the United States. See PostHog's privacy policy.

7.4 Hosting Providers

Our server infrastructure (api.reflecto.dev) is hosted by Render. Render processes only the data described in Section 4.1 — device identifiers, public keys, push tokens, and, transiently, encrypted message blobs and public API / MCP message plaintext. See Render's Data Processing Addendum.

Our website (reflecto.dev) is hosted by Cloudflare (Cloudflare Pages). Cloudflare serves only static website files and receives no device or message data. See Cloudflare's Data Processing Addendum.

8. International Data Transfers

Reflecto is operated from India. Our server infrastructure (Render) is located in the United States, and our website (Cloudflare Pages) is served from Cloudflare's global network, operated by a US-based company. If you are located in the European Economic Area (EEA), the United Kingdom, or another jurisdiction with data transfer restrictions, please be aware that your data (as described in Section 4.1) will be transferred to and processed in the United States.

We rely on the following safeguards for these transfers:

• For data processed by Google (FCM, Crashlytics): Google's Data Processing Terms, which incorporate Standard Contractual Clauses (SCCs) approved by the European Commission.
• For data processed on our hosted server: Render's Data Processing Addendum (see Section 7.4), which incorporates SCCs.
• For our website host: Cloudflare's Data Processing Addendum (see Section 7.4).
• For analytics: PostHog processes only anonymous event data — cookieless on the website, and keyed to a random device identifier in the apps, where it also includes an approximate, network-derived location (see Section 13.2). PostHog's own privacy policy governs any residual processing.

Importantly, the substantive content of your device-to-device messages — notifications, clipboard, files — is end-to-end encrypted before it leaves your device. Even though encrypted blobs transit through servers in the United States, the plaintext content is never accessible to us, our hosting provider, or any third party. The two documented exceptions are described in Section 2. First, messages sent through our public API or MCP server pass through our server as plaintext, held in memory only, in the United States, before being encrypted to your devices — never persisted to disk, never transferred onward. Second, items you explicitly share to a connected AI assistant are stored encrypted in the United States with a key we hold, so that the assistant can read them; that path is not end-to-end encrypted.

9. Data Retention

We retain data for the minimum period necessary to provide the service:

• Encrypted message blobs and timestamps: Automatically deleted after 24 hours (200 most recent per device; oldest dropped first if exceeded), or immediately if you dismiss the notification from your phone, whichever comes first.
• Encrypted clipboard images: Automatically deleted after 1 hour.
• Items you share to a connected AI assistant: The 50 most recent are kept (oldest dropped first if exceeded), and they expire about 24 hours after the last time you shared anything — so sharing frequently keeps older items alive longer, and pausing clears them within about a day. Stored encrypted, but with a key we hold; see Section 2.
• File-transfer metadata and ciphertext: Deleted on completion or cancellation of the transfer, and in any case within 12 hours.
• Device identifiers, public keys, and push tokens: Retained for as long as your devices are paired. Deleted when you unpair or delete your data through the Android app.
• User identifier: Retained for as long as you have at least one paired device. Deleted when you unpair or delete your data.
• Crash reports (Crashlytics): Retained by Google for 90 days per their standard retention policy.
• Public API / MCP message content: Not retained at all. Discarded from server memory immediately after encryption (see Section 2).
• Analytics events, including approximate location: Retained by PostHog for as long as the event itself is retained. The IP address the location was derived from is never stored (see Section 13.2).

We do not maintain long-term archives or backups of your message data.

10. Your Rights and How to Exercise Them

10.1 Deleting Your Data (Self-Service)

You can delete all server-side data associated with your account by using the disconnect/delete function in the Reflecto Android app. This will:

• Remove your device record (device identifiers, public keys, push tokens, and any device name you set) from our server.
• Delete any queued encrypted message, clipboard, or file-transfer data for your devices.
• Remove the association between your paired devices.

This action is immediate and irreversible. After deletion, you would need to complete the pairing process again to use Reflecto. For a full walkthrough, see our data deletion page.

10.2 Rights Under GDPR (EEA, UK, and Switzerland Residents)

If you are located in the EEA, UK, or Switzerland, you have the following rights under GDPR:

• Right of access (Article 15): You may request a copy of the personal data we hold about you.
• Right to rectification (Article 16): You may request correction of inaccurate data.
• Right to erasure (Article 17): You may request deletion of your data. You can exercise this immediately through the self-service disconnect/delete function, or by contacting us.
• Right to restriction of processing (Article 18): You may request that we restrict processing of your data in certain circumstances.
• Right to data portability (Article 20): You may request your data in a structured, machine-readable format.
• Right to object (Article 21): You may object to processing based on legitimate interest.

To exercise any of these rights, contact us at privacy@reflecto.dev. We will respond within 30 days. If you are not satisfied with our response, you have the right to lodge a complaint with your local data protection authority.

10.3 Rights Under CCPA/CPRA (California Residents)

If you are a California resident, the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA) grants you the following rights:

• Right to know: You may request disclosure of the categories and specific pieces of personal information we have collected about you.
• Right to delete: You may request deletion of your personal information. You can exercise this immediately through the self-service disconnect/delete function, or by contacting us.
• Right to opt-out of sale or sharing: We do not sell or share your personal information as defined by CCPA/CPRA. There is nothing to opt out of.
• Right to non-discrimination: We will not discriminate against you for exercising your CCPA/CPRA rights.

We do not sell personal information. We do not share personal information for cross-context behavioural advertising. We do not use or disclose sensitive personal information for purposes other than those permitted by CCPA/CPRA.

To exercise your rights, contact us at privacy@reflecto.dev. We will verify your identity before processing any request.

10.4 Rights Under India's Digital Personal Data Protection Act (DPDPA), 2023

If you are located in India, you have rights under the Digital Personal Data Protection Act, 2023, including the right to access, correction, and erasure of your personal data. To exercise these rights, contact us at privacy@reflecto.dev.

11. Security

We take the following measures to protect your data:

• End-to-end encryption: Content that moves between your devices is encrypted on the sending device using X25519 key exchange and XSalsa20-Poly1305 (NaCl secretbox) before being transmitted. Our server cannot decrypt it. The one documented exception — messages sent through our public API or MCP server — is described in Section 2.
• Private keys never leave your device: Your encryption private key is stored in Android Keystore (hardware-backed where available) on Android, in chrome.storage.local on the Chrome extension, and in your browser's local storage on the web app.
• Minimal data collection: Our server stores only what is needed for routing (device IDs, public keys, push tokens) and transient encrypted blobs.
• Short retention windows: Encrypted blobs are automatically deleted within hours (see Section 9).
• Rate limiting: Pairing code attempts are rate-limited to prevent brute-force attacks.
• Transport security: All communication between your devices and our server uses HTTPS/TLS encryption in transit, in addition to the E2E encryption of message content.

While we employ strong security measures, no system is completely immune to all threats. We encourage you to keep your devices secure, verify your safety number, and unpair devices you no longer use.

12. Children's Privacy

Reflecto is not directed at children under the age of 13. We do not knowingly collect personal data from children under 13. If you are a parent or guardian and believe your child under 13 has provided us with personal data, please contact us at privacy@reflecto.dev, and we will take steps to delete such data promptly.

In the European Economic Area, where GDPR sets the age of digital consent at 16 in certain member states, we do not knowingly collect personal data from individuals under the applicable age of digital consent without parental authorization.

13. Cookies, Tracking, and Product Analytics

The Reflecto Android app, Chrome extension, and web app do not use cookies or web tracking technologies. They do collect anonymous product analytics, described in Section 13.2.

13.1 The Reflecto website

The Reflecto website at reflecto.dev (this page included) uses a cookieless, anonymous analytics snippet — PostHog, US-hosted, served through a first-party reverse proxy on our own domain rather than PostHog's own domain. Each pageview generates a random identifier held only in memory for that pageload; it is discarded the moment you navigate away or close the tab. No cookies are set, nothing is written to localStorage, and no device fingerprinting is performed. Person profiles are disabled, so PostHog stores anonymous events only — never a profile of you. Server-side IP-based geolocation is disabled on every event, and the event payload explicitly nulls the IP address field; your IP address is never recorded by this analytics system. We record only two kinds of anonymous events on this website — page views and clicks on our Google Play / Chrome Web Store buttons — plus, when present, campaign parameters from the URL you arrived on.

13.2 Product analytics in the apps

The Reflecto Android app, Chrome extension, and web app collect anonymous product analytics through PostHog. This tells us which features are used and where people get stuck. It is separate from the website analytics described above.

What identifies the events. Your device's randomly generated identifier — the same anonymous UUID used to route your encrypted messages. It is not linked to a name, email address, or account, because Reflecto has no accounts. When you pair a computer with your phone, those two devices' analytics identities are merged, so that a pairing is counted once rather than twice.

What is never collected. Notification content is structurally excluded, not merely omitted by convention: notification titles, message bodies, sender names, message text, and the package names of your installed apps are on a forbidden-key list, and every analytics payload is filtered against that list before it can leave your device. Clipboard content, file names, and file contents are never collected.

What is collected. Anonymous counts and timings of product actions — a pairing completing, a file transfer starting, a screen being opened. Every event carries which surface it came from, the app version, and whether it reflects a deliberate action or automatic system behaviour.

Approximate location. Each analytics event is also tagged with an approximate location, so we can see which countries and regions Reflecto is used in and prioritise accordingly. Our analytics provider derives it from the network address your device connects from, and it includes country, region, city, an approximate latitude and longitude for that city, and time zone. This is network-level accuracy, not device location: it identifies roughly where your internet connection is, typically to the nearest city, and Reflecto never requests or uses your device's GPS or location permission for any purpose.

Your IP address itself is not stored. It is used once, at the moment an event is received, to look up that approximate location, and is then discarded — the stored event carries the location but never the address it came from. This location data is anonymous in the same way the rest of these events are: it is keyed to your device's random identifier, not to a name, email, or account.

Location is attached to events sent from your devices. Events our server generates about its own operation carry no location at all.

Turning it off. Each app has an analytics opt-out in its settings. The opt-out is checked before the analytics SDK is created, so an opted-out device never initialises it and sends nothing at all. Your choice persists, and deliberately survives unpairing and local-data wipes, so you never have to make it twice.

13.3 Server telemetry

Our server sends its own operational telemetry to PostHog — how many messages the relay handled, how many deliveries fell back to catch-up sync, error and rate-limit counts. This is aggregate by construction: every server event is recorded against the fixed identifier server, never against your device identifier, pairing, or any account identifier, so it cannot be joined to you or to the app analytics described above. It carries no message content, no tokens, and no keys.

No IP address, no location. Your IP address is never sent with this telemetry, and no location is attached to it. This is the opposite of the app analytics described in Section 13.2, and deliberately so: these events are generated by our server about itself, so the only network address involved is our own server's. Attaching a location would record where our infrastructure is, not where you are. Until August 2026 our server also derived a coarse country, region and city from the client IP for a separate Google Analytics property; that property has been retired, the Google Analytics integration removed, and that server-side lookup deleted from the software entirely.

14. Do Not Track Signals

Reflecto does not track users across third-party websites and does not engage in behavioural tracking. We honour Do Not Track browser signals, though our service does not engage in the type of tracking that such signals are designed to prevent.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will:

• Update the "Last Updated" date at the top of this document.
• Notify users through the Reflecto Android app or Chrome extension for changes that materially affect how we process your data.

We encourage you to review this policy periodically. Your continued use of Reflecto after a material change constitutes acceptance of the updated policy. If you do not agree with any changes, you may unpair your devices and delete your data at any time.

16. Encryption Libraries and What You Can Verify

Reflecto's encryption is built on two established open-source libraries: TweetNaCl in TypeScript and libsodium in Kotlin (through the Lazysodium binding), producing byte-identical output on both sides. TweetNaCl and libsodium have received public third-party audits.

Reflecto's own code is proprietary — the Android app, Chrome extension, web app, CLI and server, including the module that calls those libraries. It has not been independently audited, and neither has the Lazysodium binding. We do not ask you to take that on trust: the protocol and wire format are published so the design can be checked without access to our source, and we document what the design does not defend against. See Protocol and wire format and Threat model.

17. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Email: privacy@reflecto.dev
Location: New Delhi, India

For GDPR-related inquiries, we aim to respond within 30 days. For CCPA/CPRA requests, we aim to respond within 45 days as required by law.

This Privacy Policy was last reviewed and updated on August 9, 2026.