Security & Privacy

Honest about what protects you — and what doesn't.

No AllieMinate-operated server, token-authenticated pairing, App Lock and destructive-action authentication. The real limitations are listed here too, not hidden.

No AllieMinate server

Cloud calls go straight to each provider's own API. Device-to-device traffic stays on your LAN. No project-operated server exists.

Credentials stay local

.env plus a local JSON store, never synced, never leaving your machine.

Token-authenticated pairing

Per-device tokens exchanged at pairing. QR/USB pairing codes expire in 5 minutes and are single-use.

App Lock + destructive-action auth

Touch ID (Mac) / biometric+PIN (Android) / app PIN everywhere — required again for actions like deleting a Sync Pair.

Limitations — flagged, not hidden
  • LAN traffic between paired devices is not TLS-encrypted (token-authenticated, plaintext transport)
  • No Windows Hello yet — falls back to the app PIN
  • No paid code-signing — first-install warnings on every platform
  • Android APK is a debug build, not release-signed
  • 8 tracked dependency vulnerabilities (Electron, Fastify, a googleapis-chain uuid advisory)
Full security model →Vulnerability reporting →