Privacy
Updated October 5, 2026
Fling moves your files between your own devices, and to people you send a link to. It's built so we don't need to know who you are or see what you send. This page says exactly what does reach us.
The short version
- There's no account. We never ask for your name, email address or phone number to use Fling.
- What you send goes from one device to another, encrypted end to end. We can't read it.
- Our server introduces your devices to each other, and holds small sends for a device that's asleep, encrypted so only that device can open them.
- No ads, no tracking, no selling data. This website doesn't use cookies or analytics.
What our server sees
| What | Why | How long |
|---|---|---|
| Each paired device's name (like "Maya's iPhone"), its kind of device, and its public keys | So your devices can find and check each other | Until you unpair the device |
| When each device was last connected | To show "Online" or "Asleep" | Until you unpair the device |
| Shared settings, like the colour you picked for a device | So every device shows the same thing | Until you change or unpair it |
| Sends waiting for a device that's asleep (text, links and files up to 25 MB), encrypted for that device, with their size and which device they're for | To deliver them when it's back | Deleted once collected, or after 7 days |
| For a link: its details, encrypted with a key in the link that we never see, how many people accepted it, and the name each person typed when accepting | To show the sender who has it | Until the link expires (7 days, at most 30) |
| Phones: a push token from Google or Apple | To wake the phone when something is waiting for it, or a device wants to send | Until you unpair the phone, or the token stops working |
| Connection setup messages between devices | To start a direct, encrypted connection | Passed on, not kept |
Files, photos, text and links you send between devices that are both on never touch our server. They travel over a WebRTC connection that your devices encrypt, and each device checks the other's key before anything is sent.
Network addresses
Like any internet service, our server (hosted by Cloudflare) sees the IP address of each device that connects. We don't store IP addresses ourselves. Cloudflare keeps short-lived request logs for running the service.
To connect directly, your devices ask public STUN servers run by Cloudflare and Google for their own public address. Those servers see your device's IP address, and nothing else about what you're doing.
Push notifications
To wake a phone that's asleep, our server sends a push through Google (Firebase Cloud Messaging, on Android) or Apple (on iPhone). A push says only that something is waiting, and for which group of devices: never what it is or who it's from. Your phone then connects to us and fetches it, encrypted. Fling uses Firebase only for pushes, with its analytics turned off.
Early access emails
If you leave your email address on this site, we keep it to tell you once when Fling is ready, then delete it. We don't share it with anyone.
On your devices
Your device's keys stay on the device, in its keychain or keystore. What you receive is saved where you'd expect (Downloads, Photos, or a folder you choose), and your history stays on the device. Fling asks before using the camera (to scan a code), notifications, or your photo library.
Children
Fling isn't directed at children under 13, and we don't knowingly collect anything from them.
Changes
If this changes, we'll update this page and the date at the top. If a change affects what reaches our server, the app will say so first.
Questions
Write to hello@fling.so.