Personal Device Bridge
English
Get the preview

Privacy Policy

Effective date:

This Privacy Policy explains how 프로젝트팀포유 (Project Team For You) (“we”, “us”) handles personal data in connection with the Personal Device Bridge software (the “App”) and this website (the “Website”). In short: the App works locally, needs no account and does not send us your content.

1. Who we are

The controller responsible for the processing described in this policy is 프로젝트팀포유 (Project Team For You), represented by 이유상, business registration number 495-25-02209, 1166-68 Yebong-ro, Sangun-myeon, Bonghwa-gun, Gyeongsangbuk-do, Republic of Korea. You can reach us at projectteamforyou@gmail.com.

2. Summary

  • The App works locally on your devices and needs no account. Your content never passes through our servers; only short-lived, end-to-end encrypted connection offers pass through our rendezvous service when you connect over the internet.
  • Optional features — such as photo backup, folder sync, search, notification replies, Find my device and share links — also work directly between devices. If a direct connection is impossible, the still-encrypted traffic can be relayed by Cloudflare’s TURN service, which cannot read it.
  • We do not collect the files, clipboard contents, links or other content you send between your devices.
  • The App sends us no usage analytics (telemetry). On Android, the Google ML Kit components used for QR code scanning, the document scanner and text recognition send Google LLC device and app information, diagnostics and an installation identifier (section 3).
  • The Website uses no cookies, no analytics and no third-party scripts.

3. Data processed by the App

To pair and connect your devices, the App creates and stores the following data only on your devices:

  • a device key pair (the private key never leaves the device and is protected by the operating system where available) and a device ID derived from the public key;
  • the device name you choose;
  • the list of trusted devices and the permissions you granted to each of them;
  • transfer journals, My Drop items and settings needed to resume transfers and to expire items automatically;
  • on the PC, a transfer history (the other device’s name, file name, local path, size, time and result or error). It is on by default, stays only on that PC and is never sent anywhere; entries are deleted automatically after 180 days and at most 1,000 are kept. You can clear the history at any time or turn it off, which deletes it immediately.

To find devices on your local network, the App announces its device ID, device name and connection hints (such as local IP address and port) using mDNS and UDP broadcasts that stay within your local network. Other devices on the same network can see this information; it is not sent to us.

The App also checks for updates automatically: the desktop App contacts personaldevicebridge.com about every 6 hours (you can turn this off in Settings), and the Android App downloaded from the Website checks once a day. Each check sends the App version, operating system, processor (CPU) architecture and installation type, along with the data any request carries (IP address and user agent). We do not store these requests; Cloudflare processes the request data for delivery and security as described below for the Website. Before an update is installed, it is verified by its signature (desktop) or its SHA-256 checksum (Android).

On Android, received photos and videos are saved to the shared Pictures folder and other files to the shared Download folder, where other apps with access to those folders (such as your gallery) can see them.

On Android, QR code scanning (for pairing), the document scanner and Korean text recognition use Google ML Kit, which is built into the App. Images and recognised text are processed on the device and are not sent anywhere. When you use these features, ML Kit itself sends Google LLC device information (manufacturer, model, operating system version), app information (package name and version), performance and error diagnostics and an installation identifier, which Google uses to operate and improve ML Kit under its own privacy policy (policies.google.com/privacy). This data goes to Google directly and never reaches us.

Content you send (files, clipboard text, links, Continue context and My Drop items) travels directly between your devices and is encrypted end to end. We never receive, store or have access to it. Apart from update checks, none of the data in this section reaches us, so you control it yourself and can delete it at any time by removing trusted devices or uninstalling the App and its data.

4. Optional features

The following features are off by default unless stated otherwise. You turn them on per device (on managed devices, your organisation may allow or block them). None of them sends your content to us:

  • Find my device: when you ring or locate your phone from another of your own devices, the phone determines its location and sends it, end-to-end encrypted, only to that device. Location is used only when you trigger it; it is never sent to us and we do not store it.
  • Notifications and replies: mirrored notifications are shown on your PC. When you reply, the text of your reply goes only from your PC to your phone, which passes it to the messaging app. It does not pass through our servers.
  • Photo backup, folder sync and search: photos, videos and synced files are copied directly between your devices. Earlier versions of synced files are kept for 30 days in a “.pdb-versions” folder on your device. Searches run on each device over its shared folders; only matching file names and short snippets are returned to the device that asked.
  • Public-key certificates (공동인증서): the certificate files are sent end-to-end encrypted between your own devices only after you approve on the receiving device, which shows the holder’s name and expiry date. They are never stored on a server.
  • Clipboard history and snippets: clipboard history is kept only in memory and is off by default; snippets are merged end to end between your devices.
  • Browser extension: the Chrome/Edge extension talks only to the App on the same computer. It sends nothing to us and contains no analytics.
  • Lock and walk-away lock: your PC only checks whether your phone is still connected. No location is used.
  • Organisation policies: if an organisation manages your device, its administrator signs policies that the App verifies and applies locally. We receive neither the policies nor any information about the organisation or its users.
  • Audit logs: when enabled (off by default for personal use; an organisation’s policy can require it), the App keeps a tamper-evident log of metadata such as time, event type, peer device, file names and sizes — never file contents, clipboard text or locations. The log stays on the device and is controlled by the device owner or the organisation; we have no access to it.
  • AI assistant (PC app): works only when you enter an API key yourself or open an AI website. Your questions, the text of files you attach and clipboard content are sent directly from your PC to the AI provider you choose (for example OpenAI, Anthropic, Google, xAI, DeepSeek, Alibaba, Moonshot, Zhipu, ByteDance or Baidu, including providers outside Korea), and that provider's privacy policy and terms apply. We do not receive or store this content; because you choose and use the provider yourself, it is not a disclosure or overseas transfer by us. API keys are stored only in your operating system's credential store (e.g. Windows Credential Manager). "Signed-in AI" opens the provider's own website; the app does not read or control anything on it.

5. Data processed when you visit the Website

The Website is a static site hosted by Cloudflare, Inc. (Cloudflare Pages). When you visit it, your browser necessarily transmits technical data such as your IP address, browser type (user agent), requested URL, referring page and time of the request. Cloudflare processes this data to deliver the Website and to protect it against attacks and abuse. We do not use it to identify you, do not combine it with other data and do not run analytics on it.

The Website sets no cookies. It stores only your language choice in your browser’s local storage and caches files with a service worker so pages also load offline. Both stay on your device, are never sent to us and can be cleared at any time in your browser settings.

Downloads from the Website are counted as totals per day, version and file. The count stores no IP address, browser details, cookie or any other identifier, so it cannot be linked to you; the totals are kept while the service is operated and shown on the Website.

Visits are counted in the same way: once per browser session, the Website adds one to a total per day and language. A marker (“1”) in your browser’s session storage prevents the same visit from being counted twice and is deleted when the tab or browser session ends. No IP address, browser details, cookie or identifier is stored; the totals are kept while the service is operated and shown on the Website.

Share buttons are plain links. No data is sent to a social network unless you click one; you are then taken to that service, whose own privacy policy applies.

6. When you contact us

If you email us at projectteamforyou@gmail.com, we process your email address, your name if you provide it, the content of your message and any attachments in order to answer you. Our mailbox is provided by Google LLC (Gmail).

8. Retention and deletion

  • App data: stored only on your devices until you delete it. My Drop items expire automatically.
  • Website request data: processed by Cloudflare only for as long as needed for delivery and security under its own retention rules; we keep no copies.
  • Update checks: not stored by us.
  • Visit and download totals: anonymous numbers kept while the service is operated.
  • Emails: kept for up to one year after your enquiry has been resolved, unless the law requires a longer period or we need them to establish, exercise or defend legal claims.
  • Rendezvous offers: deleted as soon as they are delivered, at the latest after 120 seconds; IP addresses are not stored.
  • Relayed traffic: forwarded in real time and never stored by us; Cloudflare processes connection metadata for the relay under its own retention rules.
  • Share-link signalling: deleted as soon as it is delivered, at the latest after 120 seconds.
  • Data of optional features (backups, synced files and their 30-day versions, search indexes, snippets, audit logs): stored only on your devices, under your or your organisation’s control.

When a retention period ends, we delete the data without undue delay so that it cannot be restored.

9. Recipients and processors

We do not sell personal data or share it with third parties for their own purposes, except the Google ML Kit diagnostics described in section 3, which Google receives directly from the Android App. We use the following service providers, who process data on our behalf:

  • Cloudflare, Inc. (USA): Website hosting, content delivery and security, and the STUN and TURN relay service for connections (encrypted traffic only; no access to content).
  • Google LLC (USA): email (Gmail) for answering enquiries.
  • Railway Corporation (USA): hosting of the rendezvous service and its database (encrypted connection offers only).

Google LLC (USA) also receives the ML Kit diagnostics described in section 3 as an independent controller under its own privacy policy, not as our processor.

We may disclose data if we are legally required to do so, for example by a binding order of a competent authority.

10. International transfers

We are based in the Republic of Korea, which the European Commission recognises as providing an adequate level of data protection. Our service providers may process data in other countries, including the United States. Where the GDPR applies, such transfers are based on an adequacy decision (for example the EU–U.S. Data Privacy Framework, where the provider is certified) or on Standard Contractual Clauses included in the providers’ data processing terms.

11. Your rights

Depending on the law that applies to you, you have the right to access your personal data, to have it corrected or erased, to restrict or object to its processing, to data portability, and to withdraw any consent at any time with effect for the future. You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the country where you live or work.

To exercise your rights, email projectteamforyou@gmail.com. We respond within one month, which may be extended where the law allows, and may ask you to verify your identity. Because App data never reaches us, you manage it directly on your devices.

Step-by-step instructions for deleting your data and for requesting deletion are on our data deletion page (personaldevicebridge.com/en/data-deletion/).

12. Children

The App and the Website are not directed at children. We do not knowingly collect personal data from children under 14, or under the higher age that applies in your country. If you believe a child has sent us personal data, please contact us and we will delete it.

13. Security

Devices authenticate each other using the Noise protocol framework, and all traffic between them is encrypted end to end with a separate key for each stream. Private keys are stored locally and protected by the operating system where available. The Website is served only over HTTPS with strict security headers. No system is perfectly secure; please report vulnerabilities to projectteamforyou@gmail.com.

14. Connecting over the internet (rendezvous)

When your devices are not on the same local network, the App can connect them over the internet. To set up the connection, the two devices exchange a short connection offer through our rendezvous service, hosted by Railway Corporation (USA) with a PostgreSQL database. To learn its public network address, the App also contacts public STUN servers run by Cloudflare, Inc. and Google LLC, which see only the device’s IP address and port.

Each offer is encrypted end to end with a key that only your two paired devices can compute, and it is stored under a random-looking mailbox ID. The service cannot read offers and never learns device IDs, names or keys; the network addresses inside an offer can be read only by your other device.

Like any internet service, the rendezvous service receives the IP address of the connecting device. It uses it only in memory to limit abuse and neither stores nor logs it. Offers are deleted as soon as they are delivered, and at the latest after 120 seconds. Your content then travels directly between your devices and never through the rendezvous service.

If your devices cannot reach each other directly (for example behind strict firewalls), the connection can be relayed through the TURN service of Cloudflare, Inc. (USA). The relay only forwards traffic that remains end-to-end encrypted: Cloudflare cannot read the content and processes only the IP addresses and ports involved, the time and the amount of data in order to provide the relay. We do not store relayed traffic.

You can turn internet connections off by setting the environment variable PDB_RENDEZVOUS to “off”; the App then works only on your local network.

16. Korean Personal Information Protection Act

As we are established in the Republic of Korea, we also comply with the Personal Information Protection Act (PIPA). Our privacy officer is 이유상, who can be reached at projectteamforyou@gmail.com. The Korean version of this policy contains the additional disclosures required by the PIPA.

17. Changes to this policy

We may update this policy when our software or the law changes. We will publish the new version on this page with a new effective date and announce material changes on the Website in advance. This policy is effective from October 5, 2026.

What changed in this version: we added Find my device, notification replies, photo backup, folder sync, search, public-key certificate transfer, the browser extension, organisation policies and audit logs, share links and the TURN relay provided by Cloudflare. 26 September 2026: added the optional AI assistant in the PC app (section 4). 28 September 2026: added the PC transfer history, automatic update checks, where received files are saved on Android and the Website visit counter. 5 October 2026: added the Google ML Kit diagnostics sent by the Android App’s QR scanner, document scanner and text recognition (sections 2, 3 and 9).

Terms of Service Back to home