Privacy policy

Who we are

Ferry is made by Nightdrive, sponsored by Feature Design Oy. The controller of the personal data this policy describes is Feature Design Oy (VAT ID FI27211393), Finland. Questions and requests: hello@nightdrive.sh.

This policy covers the Ferry apps for iPhone, Mac and Linux, the push relay at push.nightdrive.sh and the Ferry pages on nightdrive.sh.

What stays on your devices

Everything you send with Ferry: texts, links, photos, files and the clipboard. It goes from one of your devices straight to another over Tailscale, and waits in the box of the computer running Ferry until you pick it up or clear it. We have no copy, no account of yours and no list of your devices.

Ferry has no analytics, no advertising and no crash reporting of its own. It reads the clipboard only when you press Send Clipboard.

The push relay

For the iPhone to be told when something arrives, the computer sends the notification through our relay at push.nightdrive.sh, which hands it to Apple's push service. The relay runs on our server in Finland, in the EU (Hetzner); Apple's push service is Apple's own. The relay keeps, for each phone and computer pair:

• the phone's push token from Apple, and whether it is a development or a release build,
• a random address the phone made for that computer, the computer's public key that signs its notifications, and a hash of the secret that lets the phone remove the address,
• when the address was made and when it was last used.

The notification itself is encrypted on your computer for your phone, and the relay can't read it. It doesn't know the computer's name, its address on your network or what was sent.

The relay sees the IP address of the phone when it registers, and of the computer when it sends. It uses it only to limit how often one address can call it: an IP address is kept as a salted hash in a counter, which is deleted within about an hour. The relay keeps no log of the requests it answers. If a request fails, the web server's error log keeps the time and the error, without the IP address; it is used to find what went wrong, and deleted after about five weeks.

An address is deleted when you remove the computer in the app, when the app moves the computer to another relay, or when Apple says the token is no longer valid (for example, after the app was deleted).

Apple's push service delivers the notification to the phone. Apple's own privacy policy applies to it.

Updates

Ferry for Mac checks for updates at nightdrive.sh/ferry/appcast.xml, and Ferry for Linux at GitHub. The downloads themselves come from GitHub. A check tells the server only your IP address and which file was asked for; Ferry sends nothing about your computer with it. GitHub's privacy statement applies to what it receives. You can turn the Mac's automatic checks off in its settings.

This website

The website is on the same server in Finland. The web server keeps a standard access log: the IP address, the time and the page or file asked for. It is used to keep the site running and safe, and deleted after about five weeks. There are no cookies and no analytics. The pages load their fonts from Google Fonts, so your browser asks Google for them.

The add-a-phone page (/ferry/add) reads the computer's address from the part of the link after #, in your browser. Browsers don't send that part to the server, so the address never reaches us.

Tailscale and the app stores

Ferry needs Tailscale, a separate service you sign up for yourself. Ferry doesn't send Tailscale anything of its own; Tailscale's privacy policy covers what Tailscale handles. TestFlight, the App Store and GitHub, where you get Ferry, have their own policies too.

Why we may handle this

The push token and the relay's addresses are needed to deliver the notifications you turned on (to provide the service you asked for). The hashed IP counters and the web server's logs keep the services working and protect them from abuse (our legitimate interest).

Your rights

You can ask what we hold about you, and ask for it to be corrected or deleted. The relay can't tell who you are from its data, so the quickest way is in the app: remove the computer, or turn notifications off, and its address goes. For anything else, write to hello@nightdrive.sh. You can also complain to the Data Protection Ombudsman in Finland, tietosuoja.fi.

Ferry isn't directed at children, and collects nothing that would tell anyone's age.

Changes

If Ferry starts to handle anything new, this page says so before the version that does it is out, and the date at the top changes.