Privacy

Borderless moves your mouse, keyboard and clipboard between your own computers. It is built so that next to nothing has to reach us, and this page is the whole account of what does.

What travels between your computers

Every computer running Borderless makes a key pair the first time it starts. The private half is written to a file on that machine and goes nowhere; the public half is its name on the wire. A connection between two of your computers is a QUIC session bound to both public halves, so each end knows exactly who is on the other, and there is no unencrypted moment for anything to be read out of — not a keystroke, not a mouse movement, not the clipboard, not a screen.

What travels on that connection is what you do with it: pointer movement, keys, the clipboard when you copy, a screen when you ask for one, and — only if you switch it on — another computer's web traffic. All of it goes from one of your computers to another. None of it passes through us: there is no server of ours in the path, and no key of ours that could open it.

How your computers find each other

On one network. Each computer broadcasts a short announcement every second and a half: the name you see in the list, its public key, the port to reach it at, and which version of Borderless it runs. Anyone on that network can tell a computer is running Borderless, and nothing else is in the packet. Two computers pair with a click and an Allow, and nothing about that pairing leaves them — no account, no server, nothing to sign in to.

Anywhere else. To be reachable away from home, a computer publishes one small signed record — its public key and the addresses it currently answers on — to the address lookup service run by n0, who make iroh, the networking library Borderless is built on. Nothing can be browsed out of that directory: a computer is found only by somebody who already holds its key. With the addresses in hand, your two computers punch a path straight through both routers.

When that fails. Some networks refuse to be punched through, and the connection falls back to a public relay, also run by n0. A relay forwards packets it cannot read — the encryption is between your two computers — so all it ever learns is that two keys are exchanging some quantity of bytes, and from which addresses. It drops out of the path the moment a direct one opens. To keep off them altogether, put your own relay's address under Settings → Network on each computer. A screen goes through a relay only if the computer showing it allows that (Also through the meeting point, at lower quality, under Settings → Screen sharing, on unless you switch it off): smaller and slower, at most 1280×720 and 15 frames a second through the public relays, encrypted end to end like everything else, and back to a direct connection the moment one opens. A phone's own screen, and a screen made for another device to be, go over direct connections only.

What an account stores

Signing in with Google is what lets computers that never meet on a network find and trust each other. It stores five things, under your own account and nobody else's:

• Your computers. One entry each: the public key, the name you gave it, which operating system and platform it runs, the relay it can be reached at, its version, its battery level and whether it is charging (where it has a battery), and when it last checked in.
• Your screen layout. The virtual desktop — which screen sits where.
• Your settings. The clipboard, cursor, shortcut and pointer preferences that belong on every computer rather than on one.
• When your trial began. One date, written the first time the app sees your account, so that the 14 days are counted the same on every computer and phone you sign in on. After them, sharing needs a license.
• Computers taken off for good. When you take a computer off the account for good, its public key and the time, so that it cannot sign itself back in under that key. These are kept for as long as the account is, since a note that could be deleted would not stop a stolen computer.

That is the entire list. No input, no clipboard content and no private key ever reaches it. Those stay on the direct connection, which the account is not party to and could not decrypt if it were. A phone signed in to the account writes only its own entry: it has no screens in the layout, and no settings that belong on somebody's Mac.

The list lives in Google Firestore, in the same Firebase project that handles the sign-in, so Google holds it on our behalf. Borderless asks Google for three things about you — that you are signed in, your email address, and your basic profile — and uses the email address to tell one account from another and to attach a purchase to the right one.

What buying a license stores

Stripe sells the license as merchant of record: they take the payment, work out the tax, send the receipt from Link, and handle refunds and disputes. Card details go to Stripe and never through us — we never see a card number, and could not charge one. Their privacy policy covers the checkout itself.

Opening the checkout notes, on your account, Stripe's identifier for it and when it was opened, so that opening another closes the first and one account cannot pay twice. What reaches us afterwards is a signed message from Stripe saying what happened, and it leaves two records behind:

• A ledger entry for the checkout: the email address you gave there, Stripe's own session and payment identifiers, the amount and currency, and whether it is paid, refunded or disputed.
• The entitlement your apps read, on your account: whether the license is active, refunded or disputed, and, copied from the ledger entry, when it was bought, the email address, Stripe's session and payment identifiers, the amount and currency, and whether it was bought on the website or through a payment link.

The ledger is what stops the same message being applied twice, and what a refund is looked up in, so it outlives the purchase.

A report you send

When something goes wrong, Settings → Help → Send a report… on a computer, and Send a report on a phone, put together one file about it. It is sent to us only when you press Send — never by itself, never in the background, and never again after that. You can save it (on a phone, share it) instead, and pass it on yourself or not at all.

A report holds what you wrote and which computer it was about; Borderless's version; the computer's or phone's system, graphics, screens and what it can capture and show; its settings, with the names of the computers it knows; its connections over the last 30 days — when, how, and how each ended; the last test of each link; what the clipboard carried, by kind and how it went, never what it carried; and Borderless's log for this run and the one before (on a phone, its lines in the system log and why the app last stopped). Your email address is in it only if you ask for an answer.

Before it leaves, it is cut: keys are shortened to their first ten characters, an address on the internet loses its last part, your home folder is written as ~, and anything shaped like a sign-in token or an email address is taken out. Passwords, sign-in tokens, private keys, anything copied, typed or on a screen, file names and notification text are not in it at all.

With it we keep the version, the system, the size, what you wrote, a short id that is shown to you (like ABC-123), and, if you are signed in, which account sent it. It is kept in the same Firebase project as the account, where only we can read it; nobody is sent it, and it is read only to fix what went wrong. To keep the service from being used as free storage, the number of reports in a day is counted: from one account, if you are signed in, and otherwise from one network, under a scrambled form of its address that is thrown away the next day. Every report is deleted after 90 days.

A crash report

When Borderless on a computer stops with an error, it writes down, on that computer, where in Borderless it failed and the error's message, cut the way a report is. At the next start it asks whether to send that to us — Send, Always send or Don't send — unless you have turned on Settings → Help → Send crash reports, in which case it is sent without asking. Off is how it starts. A crash report holds Borderless's version, the system, the name of the part of Borderless that failed, where in its code, the message and a trace of the code that led there: not the log, not the settings, and nothing copied, typed or on a screen. It is kept and deleted exactly as a report is, above. On a phone, an error is written down the same way and goes only inside a report you send.

This website

No analytics, no advertising, no trackers, and no cookies of our own. Nothing here follows you between visits or between sites. The sign-in on the account and buy pages is kept in your browser's own storage so you are not asked for it every time; signing out clears it.

The site is served by Firebase Hosting, which keeps the ordinary web-server log every web server keeps: the address a request came from, what was asked for, and when. The download buttons hand you to Google Cloud Storage, in the same Google Cloud project as the rest, where the files themselves live, and its server keeps the same kind of log of the download.

What you can do

• Try it with no account at all. On one network, pair each computer by hand and nothing about your setup leaves the machines it is on. After the 14-day trial, sharing needs the license, which is read from your account.
• Sign out. On any computer under Settings → Account, or in the account console.
• Remove a computer. Take it off in the account console: its entry goes, and your other computers stop trusting its key. That is the quickest way to cut off a computer you no longer have.
• Ask what is held on you, or ask for it to be taken off. Write to privacy@mochi.is. Taking an account off removes the computers, the layout and the settings; the purchase ledger has to stay as long as tax and refund rules say it does, and Stripe keeps their own copy of a sale regardless.
• Have a report deleted sooner. Write to privacy@mochi.is with the id it showed when it was sent, and it goes before its 90 days are up.

Changes

If this changes, the date below changes with it, and anything that matters will be said in the app's release notes rather than only here.

Last updated 28 October 2026. Questions about any of it: privacy@mochi.is.