Voidwire
Menu

// Privacy & security

What's stored, who sees what, and the limits

The short version: what you send is encrypted on your device and decrypted only on the paired device you chose. Servers in between see that traffic happened, not what it was. Below is the long version, including what Voidwire doesn't protect against.

What's stored where

Nothing is kept as history unless you turn it on. Every file the apps write is listed in the data inventory, and CI fails if a new one appears.

On your PC

  • Device keys, paired devices and settings. On Windows: sealed with Windows DPAPI. On Linux: stored in your home folder, readable only by your user account (not encrypted).
  • A replay list of message IDs, kept about 20 minutes. No links, no hosts.

Only if you turn it on: a diagnostics log that never contains links.

On your phone

  • Device keys, paired devices and settings, encrypted with a key in the Android Keystore
  • Excluded from cloud backup

Only if you turn it on: the last 20 sends (host only, never the full link) and the last device you sent to.

On the relay

  • The relay software writes nothing about you to disk
  • Encrypted items for an offline device, in RAM, deleted when fetched or after 60 minutes by default

The public relay, relay.voidwire.app, is run by the Voidwire project with the same relay and mailbox software we publish for self-hosting. To keep the free relay affordable, its offline inbox may be smaller than the default. Its rules are short.

Not stored anywhere: an account (there isn't one), the links you open, or Windows notifications. The desktop app shows none, because Windows keeps notification text in a database on disk.

What the apps fetch on their own: update checks At most once a day, each app downloads a small signed file from GitHub Pages to see if there's a new version. It sends no device ID or anything about your devices; GitHub sees your IP address and the time. Turn it off in Settings → Updates.

The browser extension

The extension for Chrome, Edge, Brave and Firefox talks only to the Voidwire desktop app on the same computer, through the browser's native messaging. It makes no network requests of its own, can't read the pages you visit, and stores nothing. When you click a send action, it hands the desktop app exactly what you chose: the current tab's address, a link or selected text, or a request to send your PC clipboard. The desktop app encrypts it end to end to the device you picked. To list your devices, the extension asks the desktop app for their names and keeps them in memory only. Neither the extension nor the Voidwire project receives what you send.

What the relay can and can't see

This applies to the public relay, a managed relay and any relay you run. Choosing one changes who holds the left column, not what's in it. With a managed relay, that's the Voidwire project, the same as the public relay.

Can see

  • IP addresses of devices that connect through it
  • Device public keys, and which of them are talking
  • When traffic happens and roughly how much (messages are padded to fixed sizes, but a large file still means a lot of traffic)
  • Opaque mailbox IDs, and which IPs read or write them
  • Your access token, if it's your own relay with one

Can't see

  • Links, text, clipboard contents or files
  • File names, types and exact sizes
  • Device names, like "Laptop" or "Office PC"
  • Pairing codes or keys
  • Anything sent directly on your local network: that never touches a relay

Encryption, in plain words

When you pair, both devices create keys and show the same 6-digit number, tied to that exact connection. If the numbers match, nobody sat in between. After that, every message is encrypted to the receiving device's key, signed by the sender, and checked before anything happens. Your PC only opens a link that came from a device you paired, passed every check, and is a normal web address.

The technical version
  • Transport: QUIC with TLS 1.3 (iroh), dialled by device key. Direct on the LAN first, relay otherwise.
  • Messages: HPKE (RFC 9180) base mode, DHKEM(X25519, HKDF-SHA256), HKDF-SHA256, ChaCha20-Poly1305, padded to fixed buckets. Signed with Ed25519 (verify_strict).
  • Files: XChaCha20-Poly1305 in 256 KiB chunks, then a BLAKE3 check of the whole file. Partial files are deleted if a transfer fails.
  • Pairing: single-use QR or VW- code that expires after 5 minutes, plus a 6-digit short authentication string bound to the TLS handshake.
  • Replays: ±10 minute timestamp window and a saved list of seen message IDs.

Spec: PROTOCOL.md. Voidwire hasn't been independently audited yet.

Threat model

Voidwire protects against

  • People on the same Wi-Fi or network reading what you send
  • The relay operator, including us, reading what you send
  • Strangers sending links to your PC: only paired devices are accepted
  • Someone in the middle during pairing, if you compare the 6-digit number
  • Old messages replayed later
  • Links to file:, scripts or other odd schemes: only http and https open

It does not protect against

  • A paired device that's compromised, or stolen and unlocked. It's trusted: by default it can open any web page on your PC. Turn on Ask before opening, and Forget a lost device.
  • Malware on your PC or phone. It can read the app's data or act as you.
  • Metadata. Relays and networks see IP addresses and timing. People on your LAN can see that a Voidwire PC is there.
  • Links into your home network. A paired device can open a router or NAS page (home addresses are allowed).
  • Look-alike devices. If you pair with a hostile PC that copies your PC's name, you'll see two with that name.
  • A compromised release page. A checksum shows your file matches the release page, not that the page is genuine. Neither the installer nor SHA256SUMS is signed yet; updates installed through the apps are signed with keys pinned in the app.

The full list, with residual risks and tests: THREAT-MODEL.md.

This website

  • This site sets no cookies and has no analytics, trackers or ads. Cloudflare (below) may set its own security cookie, but only if it has to check a request it finds suspicious.
  • Nothing loads from other servers: fonts, styles and images are served from voidwire.app. The download page has one small script that reads your platform on your device to highlight the right download; it stores and sends nothing, and the page works without it.
  • The site's web server is set to keep no access logs.
  • Requests pass through Cloudflare, which handles the connection, so it sees your IP address and the pages you ask for, and processes them under Cloudflare's own privacy policy.
  • Download links point to GitHub, which sees your IP address when you download.

Why Cloudflare here, when the self-host guide advises against it for relays? This site is public pages anyone can read. A relay carries your devices' metadata and its access token, so it should keep its own TLS.

Requests and billing

To ask about a managed relay or self-host help, you email sales@voidwire.app. There's no form on this site. We get what you send: your email address, your name if you give it, and whatever you tell us about your devices and plans. We use it only to reply. No newsletter, no mailing list, and it isn't shared or sold.

  • Where it's kept. Your emails arrive in a Proton Mail mailbox for voidwire.app, which stores mail encrypted. Only the person who runs the Voidwire project can read it.
  • How long. We haven't set a fixed retention period yet; we plan to publish one here. Until then, if you ask, we'll delete your emails, except invoices and payment records we have to keep for tax.
  • Billing. If you become a customer, payments go through Stripe, which handles your card and billing details under its own privacy policy. We never see or store your full card number. We keep invoices (your name or company, billing address, what you bought and what you paid) for as long as tax law requires. Invoices are issued under the legal name of the person who runs the Voidwire project.
  • The apps themselves still have no account, and your relay never learns who paid for it. See the terms for paid services.

Reporting a security issue

Found a security problem in Voidwire, a relay or this site? Email security@voidwire.app. Please report it privately first, and give us a chance to fix it before you publish.

The same contact is in /.well-known/security.txt (RFC 9116).