Privacy Policy

Reflecto — the private bridge between your devices
Effective Date: August 9, 2026
Last Updated: August 9, 2026
Data Controller: Reflecto, based in New Delhi, India
Contact: privacy@reflecto.dev

1. Introduction

Reflecto is a privacy-first bridge between the devices you already own — an Android app, a Chrome extension, a web app, and a command-line tool — joined by end-to-end encryption. It mirrors your phone's notifications to your computer in real time, lets you dismiss and reply to them without picking up your phone, syncs your clipboard in both directions, and transfers files directly between your devices. A Signal-style safety number lets you verify in person that your paired devices are talking to each other, not to an impostor. Reflecto also offers a public API and a Model Context Protocol (MCP) server, so you — or an AI agent acting on your behalf, such as Claude or ChatGPT — can send notifications to your own paired devices.

This Privacy Policy explains what data we collect, why we collect it, how we process and protect it, and what rights you have over your data. It applies to the Reflecto Android application, the Reflecto Chrome browser extension, the Reflecto web app, our command-line tool, the Reflecto server infrastructure, and the Reflecto website and landing page at reflecto.dev.

We built Reflecto with a privacy-first architecture: notification, clipboard, and file content that moves directly between your own devices is end-to-end encrypted (E2E) using X25519 key exchange and XSalsa20-Poly1305 (NaCl secretbox) encryption, and our server cannot read it. Messages that originate from our public API or MCP server work differently, because the server itself has to compose them — see Section 2, "How We Handle Your Content," for the precise distinction. We do not want the general encryption claim above to overstate what happens on that one path.

2. How We Handle Your Content: Two Tiers

Reflecto's core architecture is end-to-end encryption: content is encrypted on one of your devices and decrypted only on another of your devices, with our server relaying opaque ciphertext it cannot read. That is true for every notification mirrored from your phone, every clip synced through the clipboard, and every file transferred device-to-device.

There is one documented exception, described precisely below.

Device-to-device (end-to-end encrypted — our server cannot read it)

Notifications mirrored from your Android phone, clipboard content synced between your paired devices, and files sent directly device-to-device are all encrypted on the sending device before they reach our server, and decrypted only on the receiving device. Our server only ever handles ciphertext on this path — it holds no key that could decrypt it.

Public API and MCP (server-as-sender)

Reflecto's public POST /v1/send API and its remote MCP connector (used by AI agents such as Claude or ChatGPT to message your devices on your behalf) work differently, by necessity: the caller is not one of your paired, key-holding devices, so there is nothing on the sending side to encrypt with beforehand. The server itself has to compose the message. Concretely: the plaintext content you or your agent sends arrives at our server, is held in memory (RAM) only — never written to disk, never logged — while the server encrypts it individually to each of your paired devices, and is discarded immediately afterward. Nothing on this path is persisted; the exposure is a brief, in-memory step, not storage. This is a deliberate, documented design decision, and it does not change or affect the device-to-device path described above in any way.

3. Data We Collect — At a Glance

The table below summarizes all data Reflecto collects or processes. Detailed explanations follow in subsequent sections.

4. Data Collection in Detail

4.1 Data Stored on Our Server

Our server stores the minimum data necessary to route encrypted messages between your paired devices. Specifically:

• Device identifiers (UUIDs): Randomly generated identifiers assigned to each of your devices at pairing time. These are not linked to your personal identity, email, or phone number.
• User identifier (UUID): A randomly generated identifier created on your Android device at first install. This groups your devices together for message routing. It is not linked to any personal information.
• Public encryption keys: Your devices' X25519 public keys, exchanged during pairing. These are cryptographic values used to facilitate the key exchange and to compute the safety-number verification fingerprint on your devices. They cannot be used to decrypt your content.
• FCM registration tokens and Web Push subscriptions: Tokens issued by Google's Firebase Cloud Messaging service (Android) and by your browser's push service (web app), used to deliver push messages to your devices. These are opaque identifiers managed by Google or your browser vendor and rotate periodically.
• Device name: The label you optionally give a device (for example, "Abhishek's Pixel"), stored so it can be shown in your device list.
• Encrypted message blobs: When one of your devices is offline, encrypted messages — notifications, clipboard text, dismiss/reply/action commands — are queued in Redis for up to 24 hours (200 most recent per device; oldest dropped first if exceeded). These blobs are encrypted on the sending device before reaching our server. We cannot read, decrypt, or inspect their contents.
• Encrypted clipboard images: Clips too large for the inline message path (for example, screenshots) are held in a separate transient store for up to 1 hour. Still ciphertext only.
• File-transfer metadata and ciphertext: When you send a file directly to a paired device, our server temporarily coordinates the transfer: it stores routing metadata (sender/recipient device IDs, part count, encrypted size) and the encrypted file data itself in temporary object storage for up to 12 hours during an active transfer. Filenames and file contents are encrypted before they reach us; we cannot read them.
• Public API / MCP message content: When a message is sent through our public API or MCP server — rather than mirrored from one of your own devices — our server briefly holds the plaintext content in memory in order to encrypt it to your devices. See Section 2 above. This plaintext is never written to disk, never logged, and is discarded immediately after encryption.
• Message timestamps: Server-assigned timestamps used for ordering and synchronizing messages, retained for the same window as the message they belong to.

4.2 Data That Never Reaches Our Server

The following data is processed exclusively on your local devices and is never transmitted to our server in readable form:

• Notification content (app names, titles, message bodies, sender names)
• Clipboard content — text and image clips you copy or paste
• File contents and filenames transferred directly between your devices — only encrypted ciphertext transits our infrastructure (see 4.1)
• Your private encryption keys (stored in Android Keystore, in chrome.storage.local on the Chrome extension, and in your browser's local storage on the web app)
• The shared encryption secret computed by your devices
• Your app filtering preferences (which apps are mirrored)
• Your reply text (encrypted on-device before transmission)
• The safety-number verification fingerprint shown in your device settings — computed locally on your device from public keys already exchanged during pairing; never calculated or stored on our server

4.3 On-Device AI (Glance)

Glance, Reflecto's on-demand recap of notifications you may have missed, runs entirely on your device using Chrome's built-in AI model (the Chrome Prompt API / Gemini Nano). Notification content, the prompts sent to the model, and its output never leave your device and are never sent to, seen by, or logged by our server. Using Glance requires a one-time, explicit download of the on-device model; after that it runs automatically, with no separate opt-in toggle and no server-side processing.

4.4 Crash Reporting (Firebase Crashlytics)

We use Firebase Crashlytics, a service provided by Google LLC, to collect crash reports from the Reflecto Android application. When the app crashes, Crashlytics automatically collects technical diagnostic information including:

• Device model, operating system version, and device orientation
• Amount of free RAM and disk space at the time of crash
• A Crashlytics installation UUID (a random identifier, not linked to your personal identity)
• Stack trace of the crash (technical error information from the application code)

Crashlytics does not collect notification content, app names, message text, or any data from your notifications. Crash reports are retained by Google for 90 days.

Firebase Crashlytics' data processing terms are governed by Google's Data Processing Terms, available at https://firebase.google.com/terms/crashlytics.

5. How We Use Your Data

We use the data described in Section 4 for the following purposes and no others:

• Routing encrypted messages between your paired devices — notifications, clipboard, files.
• Delivering push notifications to your Android device via Firebase Cloud Messaging, and to browsers via Web Push.
• Queuing encrypted messages when a device is offline, for delivery when it reconnects.
• Coordinating file transfers between your devices (routing metadata and temporary ciphertext storage only — see 4.1).
• Composing and encrypting messages sent to your devices through our public API or MCP server, at your (or your agent's) request.
• Diagnosing and fixing application crashes and bugs (via Firebase Crashlytics).
• Understanding anonymous, aggregate traffic to our marketing website (see Section 13).

We do not use your data for advertising, profiling, behavioural tracking, or selling to third parties. We do not build user profiles. We do not serve ads.

6. Legal Basis for Processing (GDPR)

If you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, we process your data under the following legal bases as defined by the General Data Protection Regulation (GDPR):

• Legitimate interest (Article 6(1)(f)): We process device identifiers, public keys, push tokens, and encrypted message/clip/file blobs because it is necessary for the core functionality of the service (relaying encrypted content between your devices). You cannot use Reflecto without this processing, and we have assessed that this processing does not override your fundamental rights given that the data is either non-personal (random UUIDs, public keys) or encrypted and unreadable by us.
• Legitimate interest (Article 6(1)(f)): We process message content, transiently and in server memory only, when you or an authorized AI agent uses our public API or MCP server to send a message to your own devices — this processing is necessary to perform the action you requested, and no plaintext is retained afterward (see Section 2).
• Legitimate interest (Article 6(1)(f)): We process crash reports via Firebase Crashlytics to maintain and improve the reliability of the application.

7. Third-Party Services

Reflecto uses the following third-party services that may process limited data:

7.1 Firebase Cloud Messaging (Google LLC)

Used to deliver push messages to your Android device. Google processes FCM registration tokens and delivery metadata. Google's privacy policy applies to this processing.

7.2 Firebase Crashlytics (Google LLC)

Used to collect and analyse crash reports from the Android application. Processes technical diagnostic data as described in Section 4.4. Data is processed and stored by Google in the United States.

7.3 PostHog (landing-page analytics)

Used to measure anonymous, aggregate traffic to our marketing website at reflecto.dev — page views and store-button clicks only. This surface is cookieless: PostHog processes no cookies, no persistent identifiers, and no personal data here. See Section 13 for the full technical detail. Data is processed by PostHog, Inc. in the United States. PostHog's privacy policy is available at https://posthog.com/privacy.

7.4 Hosting Providers

Our server infrastructure (api.reflecto.dev) is hosted by Render. Render processes only the data described in Section 4.1 — device identifiers, public keys, push tokens, and, transiently, encrypted message blobs and public API / MCP message plaintext. Render's Data Processing Addendum is available at https://render.com/dpa.

Our website (reflecto.dev) is hosted by Cloudflare (Cloudflare Pages). Cloudflare serves only static website files and receives no device or message data. Cloudflare's Data Processing Addendum is available at https://www.cloudflare.com/cloudflare-customer-dpa/.

8. International Data Transfers

Reflecto is operated from India. Our server infrastructure (Render) is located in the United States, and our website (Cloudflare Pages) is served from Cloudflare's global network, operated by a US-based company. If you are located in the European Economic Area (EEA), the United Kingdom, or another jurisdiction with data transfer restrictions, please be aware that your data (as described in Section 4.1) will be transferred to and processed in the United States.

We rely on the following safeguards for these transfers:

• For data processed by Google (FCM, Crashlytics): Google's Data Processing Terms, which incorporate Standard Contractual Clauses (SCCs) approved by the European Commission.
• For data processed on our hosted server: Render's Data Processing Addendum (see Section 7.4), which incorporates SCCs.
• For our website host: Cloudflare's Data Processing Addendum (see Section 7.4).
• For landing-page analytics: PostHog processes only anonymous, cookieless event data on this surface (see Section 13) — there is no personal data to transfer. PostHog's own privacy policy governs any residual processing.

Importantly, the substantive content of your device-to-device messages — notifications, clipboard, files — is end-to-end encrypted before it leaves your device. Even though encrypted blobs transit through servers in the United States, the plaintext content is never accessible to us, our hosting provider, or any third party. The one documented exception is described in Section 2: messages sent through our public API or MCP server pass through our server as plaintext, held in memory only, in the United States, before being encrypted to your devices — never persisted to disk, never transferred onward.

9. Data Retention

We retain data for the minimum period necessary to provide the service:

• Encrypted message blobs and timestamps: Automatically deleted after 24 hours (200 most recent per device; oldest dropped first if exceeded), or immediately if you dismiss the notification from your phone, whichever comes first.
• Encrypted clipboard images: Automatically deleted after 1 hour.
• File-transfer metadata and ciphertext: Deleted on completion or cancellation of the transfer, and in any case within 12 hours.
• Device identifiers, public keys, and push tokens: Retained for as long as your devices are paired. Deleted when you unpair or delete your data through the Android app.
• User identifier: Retained for as long as you have at least one paired device. Deleted when you unpair or delete your data.
• Crash reports (Crashlytics): Retained by Google for 90 days per their standard retention policy.
• Public API / MCP message content: Not retained at all. Discarded from server memory immediately after encryption (see Section 2).

We do not maintain long-term archives or backups of your message data.

10. Your Rights and How to Exercise Them

10.1 Deleting Your Data (Self-Service)

You can delete all server-side data associated with your account by using the disconnect/delete function in the Reflecto Android app. This will:

• Remove your device record (device identifiers, public keys, push tokens, and any device name you set) from our server.
• Delete any queued encrypted message, clipboard, or file-transfer data for your devices.
• Remove the association between your paired devices.

This action is immediate and irreversible. After deletion, you would need to complete the pairing process again to use Reflecto. For a full walkthrough, see our data deletion page.

10.2 Rights Under GDPR (EEA, UK, and Switzerland Residents)

If you are located in the EEA, UK, or Switzerland, you have the following rights under GDPR:

• Right of access (Article 15): You may request a copy of the personal data we hold about you.
• Right to rectification (Article 16): You may request correction of inaccurate data.
• Right to erasure (Article 17): You may request deletion of your data. You can exercise this immediately through the self-service disconnect/delete function, or by contacting us.
• Right to restriction of processing (Article 18): You may request that we restrict processing of your data in certain circumstances.
• Right to data portability (Article 20): You may request your data in a structured, machine-readable format.
• Right to object (Article 21): You may object to processing based on legitimate interest.

To exercise any of these rights, contact us at privacy@reflecto.dev. We will respond within 30 days. If you are not satisfied with our response, you have the right to lodge a complaint with your local data protection authority.

10.3 Rights Under CCPA/CPRA (California Residents)

If you are a California resident, the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA) grants you the following rights:

• Right to know: You may request disclosure of the categories and specific pieces of personal information we have collected about you.
• Right to delete: You may request deletion of your personal information. You can exercise this immediately through the self-service disconnect/delete function, or by contacting us.
• Right to opt-out of sale or sharing: We do not sell or share your personal information as defined by CCPA/CPRA. There is nothing to opt out of.
• Right to non-discrimination: We will not discriminate against you for exercising your CCPA/CPRA rights.

We do not sell personal information. We do not share personal information for cross-context behavioural advertising. We do not use or disclose sensitive personal information for purposes other than those permitted by CCPA/CPRA.

To exercise your rights, contact us at privacy@reflecto.dev. We will verify your identity before processing any request.

10.4 Rights Under India's Digital Personal Data Protection Act (DPDPA), 2023

If you are located in India, you have rights under the Digital Personal Data Protection Act, 2023, including the right to access, correction, and erasure of your personal data. To exercise these rights, contact us at privacy@reflecto.dev.

11. Security

We take the following measures to protect your data:

• End-to-end encryption: Content that moves directly between your devices is encrypted on the sending device using X25519 key exchange and XSalsa20-Poly1305 (NaCl secretbox) before being transmitted. Our server cannot decrypt it. The one documented exception — messages sent through our public API or MCP server — is described in Section 2.
• Private keys never leave your device: Your encryption private key is stored in Android Keystore (hardware-backed where available) on Android, in chrome.storage.local on the Chrome extension, and in your browser's local storage on the web app.
• Minimal data collection: Our server stores only what is needed for routing (device IDs, public keys, push tokens) and transient encrypted blobs.
• Short retention windows: Encrypted blobs are automatically deleted within hours (see Section 9).
• Rate limiting: Pairing code attempts are rate-limited to prevent brute-force attacks.
• Transport security: All communication between your devices and our server uses HTTPS/TLS encryption in transit, in addition to the E2E encryption of message content.

While we employ strong security measures, no system is completely immune to all threats. We encourage you to keep your devices secure, verify your safety number, and unpair devices you no longer use.

12. Children's Privacy

Reflecto is not directed at children under the age of 13. We do not knowingly collect personal data from children under 13. If you are a parent or guardian and believe your child under 13 has provided us with personal data, please contact us at privacy@reflecto.dev, and we will take steps to delete such data promptly.

In the European Economic Area, where GDPR sets the age of digital consent at 16 in certain member states, we do not knowingly collect personal data from individuals under the applicable age of digital consent without parental authorization.

13. Cookies and Tracking Technologies

The Reflecto Android app, Chrome extension, and web app do not use cookies or web tracking technologies.

The Reflecto website at reflecto.dev (this page included) uses a cookieless, anonymous analytics snippet — PostHog, US-hosted, served through a first-party reverse proxy on our own domain rather than PostHog's own domain. Each pageview generates a random identifier held only in memory for that pageload; it is discarded the moment you navigate away or close the tab. No cookies are set, nothing is written to localStorage, and no device fingerprinting is performed. Person profiles are disabled, so PostHog stores anonymous events only — never a profile of you. Server-side IP-based geolocation is disabled on every event, and the event payload explicitly nulls the IP address field; your IP address is never recorded by this analytics system. We record only two kinds of anonymous events on this website — page views and clicks on our Google Play / Chrome Web Store buttons — plus, when present, campaign parameters from the URL you arrived on.

14. Do Not Track Signals

Reflecto does not track users across third-party websites and does not engage in behavioural tracking. We honour Do Not Track browser signals, though our service does not engage in the type of tracking that such signals are designed to prevent.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will:

• Update the "Last Updated" date at the top of this document.
• Notify users through the Reflecto Android app or Chrome extension for changes that materially affect how we process your data.

We encourage you to review this policy periodically. Your continued use of Reflecto after a material change constitutes acceptance of the updated policy. If you do not agree with any changes, you may unpair your devices and delete your data at any time.

16. Open-Source Encryption Library

The encryption module used by Reflecto (X25519 + NaCl wrappers) is published as an open-source library under the MIT licence. This allows anyone to audit and verify our end-to-end encryption implementation independently. It is implemented in TypeScript using TweetNaCl and, byte-for-byte compatible, in Kotlin using libsodium. The remainder of the Reflecto codebase (Android app, Chrome extension, web app, and server) is proprietary.

17. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Email: privacy@reflecto.dev
Location: New Delhi, India

For GDPR-related inquiries, we aim to respond within 30 days. For CCPA/CPRA requests, we aim to respond within 45 days as required by law.

This Privacy Policy was last reviewed and updated on August 9, 2026.