Privacy Policy
Effective November 8, 2026. This version adds the tunnel, devices on the same network, the daily count of browsers and what we keep about a license’s relay use. PairOnce has no accounts, cannot read what you send, shows no ads and sells no data. This policy says what little we do process, why, for how long, and what you can ask of us. The technical details are in the data and privacy notice. If a translation of this policy differs from the English version, the English version applies.
1. Who is responsible
Yiheng Han, United States, is responsible for the personal data described here. Contact: support@paironce.com.
2. What we never get
Files, file names, messages, links, clipboard items, scans and live pictures are encrypted on your devices and travel only between them. We cannot read them, and we do not store them. There is no tracking cookie, no advertising and no profiling. They go directly when they can, otherwise through the encrypted relay or our own tunnel, which pass them on and cannot read them.
3. What we process, why and for how long
- Connecting. When a page connects to our service: IP address, timing and request details, to set up connections, limit request rates and stop abuse (legitimate interest in running a safe service). Connection rooms expire when the connection ends; we keep no request log.
- Codes and rooms. The public part of a connection code or room (device name, device ID, public key), so the other device can find yours (providing the service). Kept while the code (at most 10 minutes) or the room is open.
- The relay. For relayed connections: which device ID and network (a keyed digest of the IP address, not the address) each relay credential went to, and the bytes Cloudflare reports for it, to apply each device’s and network’s monthly allowance (providing the service; legitimate interest in limiting cost and abuse). Credential records about 90 minutes; byte counts for the current calendar month, then deleted.
- The tunnel. When neither a direct path nor the relay gets through, the two pages pass their encrypted data through our own service, which keeps none of it. It sees the two IP addresses, each file’s size and the timing, and counts the bytes against the same monthly allowance (providing the service). Byte counts for the current calendar month, then deleted.
- Devices on the same network. While a page shows a pairing code and has not hidden itself, its generated device name (such as “Windows · Chrome”, never a name you typed) and its code wait under a keyed digest of its public address, so other devices at that address can list it and connect (providing the service). About 40 seconds unless the page renews it.
- Daily totals. Counts such as how many pairings or files were sent, with no IP address or identifier, to see how PairOnce is used (legitimate interest). About 13 months. One of these counts the browsers that opened PairOnce that day: each browser adds one at most once a day, and nothing identifies it.
- Visit statistics. Cloudflare Web Analytics receives the page address, referring page, browser and device type, country and load time; we see only totals (legitimate interest). It sets no cookie and never loads on a page opened from a pairing invitation. Kept under Cloudflare’s policy.
- PairOnce Pro. License code, Stripe order, customer and subscription IDs, the IDs and public device keys of the devices using the license, and which message led to the Pro page, to sell, renew, cancel and refund Pro and keep records (contract; legal obligations). Kept while the license is active, then as long as the applicable law requires for tax and accounting records. Payment card details go to Stripe and never reach us. We also keep how much the license has relayed in total and this month, which customer each payment belongs to, and whether a payment is under dispute, for refunds, allowances and disputes, for the same time.
- Emails you send us. To answer you (your request). Kept until resolved, then 12 months.
4. What stays on your device
Your device keys, paired devices and the names you choose are kept in your browser (IndexedDB). Received files wait in the page or in that browser’s private storage until you save or remove them. Items shared to the installed app wait at most 15 minutes. None of this is uploaded; clearing site data removes it.
5. Who processes data for us
- Cloudflare hosts the site, runs the connection service and the encrypted relay, provides Web Analytics, and forwards mail sent to our addresses (Email Routing).
- Google (Gmail) holds the mailbox those addresses forward to.
- Stripe processes Pro payments.
They act under their own terms and privacy policies, and may process data outside your country with the safeguards those terms provide (such as standard contractual clauses).
6. Your rights
Depending on where you live, you can ask to see, correct, delete or receive a copy of your data, object to its use, or complain to your data protection authority. Write to support@paironce.com. We hold almost nothing that names you, so for Pro records include your license code or receipt. We answer within one month.
7. Children
PairOnce is not aimed at children under 13. Someone under 16 needs a parent or guardian to buy Pro.
8. Security
Transfers are encrypted end to end between the two browsers, and both screens show a safety code to confirm nobody is in between. The encryption and pairing library is open source at github.com/paironce. No independent security audit has been done yet.
9. Changes
When this policy changes, the date at the top changes, and material changes are noted here before they take effect. See also the Terms of Service.