Privacy policy

Updated October 23, 2026

This policy covers the Phantom Share Android app, its locally served join page, and phantomshare.app. Phantom Share is developed by TheAstrocreeper. For privacy questions or deletion requests, email [email protected].

Files and people you connect to

Phantom Share lets you transfer files between connected devices without creating an account. File contents travel over encrypted WebRTC peer connections. They are not uploaded to the developer's file storage or carried by the Nostr signaling relays. File names, types, sizes and transfer information are exchanged with connected devices as part of sharing. Recipients receive the files you select for them and may keep their own copies. The developer cannot retrieve or delete those copies.

The app uses a display name you choose and generates cryptographic keys and identifiers for connections. A display name can be a nickname; do not use sensitive information as your name. Keep invitation links, PINs and fallback codes private, and connect only to devices you trust.

Internet connections and third parties

Internet pairing uses independent public Nostr relays for discovery and signaling. Relay traffic is sent over encrypted WebSocket connections, but that transport encryption does not hide all metadata from the relay. Signed discovery and signaling events can expose public identifiers, session identifiers, display names, connection timing, membership information and WebRTC connection information. Relays and other parties able to receive these public events may read or retain them. Pairing payloads have additional encryption; that does not make all discovery metadata private.

Phantom Share also keeps a developer-operated Cloudflare switchboard reachable as an alternative internet pairing and signaling path at switchboard.primer187.workers.dev. Both discovery paths can be connected so devices can find each other when Nostr fails on one side. The switchboard receives public identifiers, display names, session and membership proofs, connection timing and signaling metadata, but not transferred file contents. It authenticates transport identities; your session authority and connected peers enforce membership. Peer discovery records are kept while an endpoint is live or within its replacement grace period, then removed when that endpoint is retired. Cloudflare request/operational logs may be retained according to the account configuration and Cloudflare policies. Contact the developer with questions about data on this switchboard.

The configured Nostr relays are relay.damus.io, nostr.mom, relay.snort.social and relay.primal.net. Internet WebRTC also uses Google's STUN service at stun.l.google.com to discover network connectivity. These services can observe your source IP address and request timing. Connected peers can learn network addresses needed for the connection. Phantom Share does not use GPS or infer your physical location.

The developer does not operate these public relays or Google's STUN service and cannot set or guarantee their retention or deletion practices. Protocol expiry and leaving a session do not guarantee deletion of data already received by third parties.

Offline Connect

Offline Connect uses the local network and the host's local join page instead of remote signaling relays or STUN/TURN services. Local pairing and signaling use TLS 1.2/1.3, with additional PAKE authentication and encrypted signaling, and files still travel over encrypted WebRTC connections. The host serves HTTPS using an app-generated local certificate; browsers may require you to verify and accept it. Opening an external website, a privacy link or an email app uses that service separately.

Information stored on your device

The app stores your display name, generated identity keys and membership administration records in app-private WebView storage. The local host stores its TLS key and certificate in the Android app's private, non-backup storage. Identity and membership records may remain after you leave a session. Android app backup is disabled.

Transfer data and history are held for the current session. In Android, received files are saved to Downloads; in a browser you choose Save. Saved files and exported logs remain until you delete them using your device's file tools, even after you clear app data or uninstall the app. Incomplete saves are cleaned up where possible; process termination or a document provider can prevent immediate cleanup.

Permissions

• Camera: optional QR scanning. Frames are processed on your device, are not uploaded, and are not recorded by Phantom Share.
• Local network / nearby devices: allows connections to devices on your LAN where Android requires permission.
• Notifications and foreground service: shows an ongoing device session and supports connections while the app is in the background. A wake lock helps keep the session running and can use battery.
• Files: the system picker provides access to files you select. Received files use Android's Downloads APIs. The app does not request broad access to all storage, contacts, microphone, SMS or GPS.

Diagnostics and support

Technical diagnostics are recorded locally. They can include app/browser versions, platform capabilities, timestamps, connection states, file types and sizes, performance measurements and technical error categories. Logs are bounded and exclude file contents, file names, display names, raw network addresses and invitation secrets. Some identifiers are replaced with report-local references.

There is no automatic diagnostic upload or advertising SDK in the Android app. Downloading logs saves a local file; it does not send it to the developer. If you separately email a report, the developer receives your email address, message and attachments through email providers. Do not include passwords, invitation secrets or sensitive files in a report. Support correspondence is used to respond and investigate the issue and is retained only as needed for that purpose or legal obligations. You can request deletion using the contact above.

The public website

phantomshare.app is hosted by Cloudflare and uses Cloudflare website analytics. Cloudflare processes website request information and provides traffic statistics to the site operator. Those website services are separate from the Android app's bundled interface and local file-transfer path. See Cloudflare's privacy policy for its handling of website information. Opening third-party links is also subject to those services' policies.

Your choices and deletion

Use Offline Connect to avoid remote relay and STUN traffic for that connection. You can deny camera permission and enter a code manually, leave a session, or revoke permissions in Android settings. Clearing Phantom Share's app storage removes its local identities, settings and membership records; clearing browser site data does the equivalent for the web app. Delete downloaded files and exported logs separately.

There is no Phantom Share account to delete. For support data held by the developer, email a deletion request from the address used to contact support. Copies held by recipients, independent relay operators, hosting providers or email providers are subject to their own controls and retention rules.

Changes

This page will be updated when the app's data practices change. Check the date above for the current version.