Privacy

Effective October 20, 2026

syncport moves unfinished work between your own devices. The work itself, meaning your code, diffs, secrets, agent transcripts, session titles and local paths, is encrypted on the sending device for your other devices before it leaves. The syncport service cannot read it. This page explains what the service does see.

What we store

• Your account: the email address, name, profile picture address and account identifier Google shares when you sign in, plus when you signed up and were last active.
• Your devices: the name you give each device, its platform and CPU type, the syncport version, the names and versions of installed coding agents, its public keys and fingerprint, and when it was last online.
• Project routing: project IDs and names, and the Git commit IDs your devices already have, so a handoff only carries missing objects.
• Handoffs: the encrypted package, its size and SHA‑256 hash, the sending and receiving devices, the agent names, the number of sessions, when it was created and when each device picked it up.
• Session index: for each agent session, the agent, the device, the project, the session ID, when it was updated and how many messages it has. Its title, working directory and model are encrypted for your devices.
• Remote requests: which device asked which device for work, and the result.

What we cannot read

Handoff packages and sealed metadata are encrypted with age to the keys of your own devices, whose private halves never leave those devices. We store and forward the ciphertext only. If you lose every device, we cannot recover the contents.

How long we keep it

• Handoffs are deleted after 14 days, and only the newest 10 per project are kept. Unfinished uploads are removed after a day.
• Remote requests expire after ten minutes.
• Removing a device deletes its session index and project state and revokes its access.
• Deleting your account in Settings removes your account, devices, index and every stored package.

Cookies

The dashboard sets one cookie, syncport_session, which keeps you signed in for 30 days. It is HttpOnly and used for nothing else. There is no advertising, tracking or third-party analytics.

Where it runs

The website is hosted on Vercel. The relay and its database run on a virtual private server we operate. Sign-in uses Google. We do not sell or share your data, and we disclose it only when the law requires.

Your choices

You can rename or remove devices, delete handoffs and delete your account on the dashboard at any time. If you prefer that nothing is stored, use direct SSH handoffs, which never touch the relay.

Contact

Questions or requests: peerproblem@gmail.com. We will update this page when our practices change; the date above shows when this version took effect.