Privacy

When you mirror your Mac, the video of your screen and the touches you send back travel directly from one device to the other across your local network. The same is true when you browse or preview files: your Mac serves them straight to your phone. That connection is encrypted with a certificate your Mac generates for itself, and it is gated by the pairing code you enter the first time you connect.

None of it passes through a service run by me. Your screen, your keystrokes, your files, and the names of your devices stay on your network.

The Mac app keeps a self-signed certificate and an access token in its application support folder so your phone can recognise the same Mac next time. The iPhone app keeps that access token in the iOS Keychain, along with the list of Macs you have paired with. Files you open in the app are downloaded to a temporary cache so they do not have to transfer twice.

All of this lives on your own devices. Deleting the apps removes it, and the Mac app lets you revoke a paired device at any time, which invalidates its token.

The Mac app asks for Screen Recording so it can capture your display, and Accessibility so it can turn your touches into real clicks and keystrokes. If you want to browse files from your phone, it also asks for Full Disk Access, which macOS requires to read folders like Documents and Downloads. It uses those permissions only to answer requests from a phone you have paired.

The iPhone app asks for Local Network access so it can find your Mac on the Wi-Fi you are both on. It asks for Photos access only at the moment you save an image or video from your Mac to your camera roll.

The site sets no cookies and runs no analytics, tracking scripts, or embedded third-party content. It is hosted on Cloudflare, which handles requests for the page and keeps short-lived operational logs containing things like IP addresses and browser user agents, in the ordinary way any web host does. I use those only to keep the site running. Cloudflare's own practices are described in their privacy policy.

The Mac app is downloaded from this site or from GitHub, and the iPhone app is distributed through Apple's TestFlight while it is in beta. Apple handles those downloads and, for TestFlight, collects crash reports and basic usage data about the beta itself under Apple's privacy policy. I see only the aggregate crash and install information Apple shows developers. The apps themselves contain no analytics or crash reporting of their own.

Mirror is not directed at children under 13, and because it collects nothing, it does not knowingly collect information from them.

If this policy changes, the updated version will appear on this page with a new date at the top. Meaningful changes will also be noted in the app's release notes.

Questions about any of this can go to kena.kwasi@gmail.com, or to an issue on GitHub. The source is public, so everything described here can be checked directly.