No cloud, no account, no relay.

Finding each other

Your phone advertises itself on the local network over mDNS, and the Mac listens for it. Because home and office networks break multicast in a dozen different ways — client isolation, mesh gaps, segmented corporate Wi-Fi — there are three fallbacks behind it: the last address that worked, a UDP broadcast probe, and finally typing the phone's address in by hand.

Discovery only ever finds a candidate. It never grants access. A device that hasn't been paired cannot do anything but attempt a handshake.

Pairing

The first time two devices meet, they perform an ECDH key exchange and each derives the same short numeric code from the result. You compare that code on both screens and confirm. If someone were sitting between the two devices, the numbers would not match.

After you confirm, each device stores the other's public key — on the Mac, in the system Keychain. Reconnecting is automatic from then on, and it is the stored public key that is checked, not a device name, so renaming a machine changes nothing and spoofing a name gains nothing.

The connection itself

Everything after pairing rides a single encrypted TCP connection. Frames are encrypted with AES-256-GCM.

• Fresh keys every session.The session key is derived from both the long-term identity keys and a throwaway keypair generated for that one connection. Traffic captured today can't be decrypted by someone who steals a device key tomorrow.
• No silent downgrade. If a peer omits its ephemeral key, both sides refuse the connection rather than falling back to weaker material — that fallback is precisely what an attacker would try to force.
• Replay protection. Every frame carries a counter that is authenticated but never transmitted. A frame replayed from earlier in the conversation fails its authentication tag, and a tag failure tears the whole session down rather than resynchronising.

What leaves your network

Nothing. There is no Synced account, no Synced server, and no relay. Your messages, notifications, files and clipboard travel from one of your devices to the other and stop there.

The one place Synced touches the internet is checking for updates and fetching this site's download. The daily notification digest is generated on your Mac using Apple's on-device models — the notification text is not sent to Apple or to us.

What Synced deliberately doesn't do

These are real limits, not features that are coming. They are listed here because a product that overstates what it does is worse than one that does less.

• Call audio stays on your phone. Synced controls calls — answer, decline, mute, redial — but the audio never routes to your Mac. That would require a full VoIP bridge, which is out of scope.
• Contacts are read-only. They sync to the Mac so you can search and dial. Editing a contact on the Mac does not write back to the phone.
• It only works on the same network.There is no out-of-LAN mode, because there is no relay server. Away from your network, the devices simply don't connect.
• Notification dismissal is one-way.Dismissing on the phone clears the Mac. macOS gives no signal when a banner is dismissed without being clicked, so the reverse isn't possible.

Permissions

Synced asks for a lot on Android, because mirroring a phone means reading the things a phone does. Every permission and its exact purpose is enumerated on the privacy policy.