How your data is protected
What end-to-end encryption means here, where keys are kept, what our servers can and can’t see, and how to report a security issue.
Personal Device Bridge is designed so that your content only ever exists on your own devices. Here is what that means in practice.
Encryption
Every connection is authenticated and encrypted with the Noise protocol, and each transfer gets its own key. The protection is the same on Wi-Fi, over the internet and through a relay.
Keys and trust
- Each device creates its own private key, which never leaves it. Windows protects it with DPAPI and Android with its system keystore.
- Devices trust each other only after QR pairing with a matching 6-digit code.
- Each device decides what the others may do, and removing a device closes its connections immediately.
What our servers see
- There is no account, no default telemetry, and no collection of files, clipboard contents or links.
- For internet connections, the rendezvous service passes short encrypted connection offers and deletes them within 120 seconds.
- The website counts visits and downloads as anonymous daily totals, with no cookies or trackers.
Reporting a vulnerability
Write to projectteamforyou@gmail.com with the subject prefix [PDB SECURITY]. The Security & bug bounty page explains scope, response times and rewards. An external security audit is planned before version 1.0.