Privacy

Last updated 23 August 2026.

This describes what the software and the server actually do, taken from the code that runs them. Where something is a limitation rather than a promise, it says so.

What Lilypad cannot see

Your screen and your input never reach Lilypad's server. A session is a direct encrypted connection between your phone and your Mac (WebRTC, DTLS-SRTP). When the two cannot reach each other directly — some mobile networks make that impossible — the media is forwarded by a relay, which passes through encrypted packets it has no key for. Nothing in that path is recorded.

Lilypad does not have your files, your keystrokes, your screen contents, your location, or an advertising identifier. There is no analytics or tracking code in the apps or on this site.

What is stored, and why

• Your account — email address, the name you chose, and a hash of your password (never the password). If you sign in with Apple or Google, the identifier that provider gives us instead.
• Your devices — for each computer and phone: a name, its platform, the app version it last reported, the public half of a keypair it generated, when it was added, and when it last signed in. The private half never leaves the device.
• Which devices are paired — so a phone can reach a laptop without scanning a code every time, plus when that pair last connected.
• A short security log — sign-ins, failed sign-ins, device changes, with the IP address they came from. This is what makes "was that me?" answerable.

How long

The security log is deleted automatically after 2 days. Everything else lasts until you remove it: removing a device deletes it, and deleting your account deletes the account, every device on it, and every pairing between them. Deletion is immediate and cannot be undone.

Encrypted database backups are kept for 7 days and then deleted. A backup taken before you deleted something still contains it until it ages out.

Who else is involved

• Oracle Cloud — runs the server.
• Cloudflare — carries traffic to it, and serves this website.
• Apple and Google — only if you choose to sign in with them, and only to verify that sign-in.

Your data is not sold, and is not shared for advertising.

What you can do

Everything here is in the app rather than behind a support request. "Your devices" on your phone lists every device on your account, renames them, and removes them. The same screen deletes your account outright — it asks you to type your email address first, because it cannot be undone.

Being straight about the stage this is at

Lilypad is new and is run by one person. There is no dedicated security team and no third-party audit. The server is one machine; if it is down, pairing and remote wake-up are down with it. Please weigh that before putting a machine that matters behind it.

Contact

Questions about any of this, or a request to see or delete your data: support@takedia.com. A privacy page that makes you go somewhere else to find the address is not much of one.