Privacy
Last updated 9 November 2026.
The apps
This is worth stating first because it is the part that matters. PhonePad has no account system, no server, and no telemetry. There is nothing to sign up for, nothing to log in to, and no analytics in either the phone app or the Windows companion.
The controller never leaves your network. The phone talks to your PC directly, over your Wi-Fi or the phone's own hotspot or USB tethering. Your input, your layouts and your pairing keys are never sent anywhere else. You can verify this: the entire source code is public.
Two things do reach the internet, and they are what pay for PhonePad.
The ad in the Android app
The official Android app shows one banner ad, supplied by Google AdMob, in a strip at the bottom of its home, layouts and settings screens. Never on the controller. To serve, measure and protect that ad, and to personalise it where you have allowed it, Google's Mobile Ads SDK collects device and app information, your IP address and approximate location derived from it, ad interactions, and identifiers such as the Android advertising ID, under Google's own policy: how Google uses information from sites or apps that use its services. Google acts as an independent controller.
- EEA, UK and Switzerland: Google's consent message asks before any personalisation, and Settings → Ads → Ad privacy choices in the app changes your answer at any time.
- Anywhere: reset or delete your advertising ID in Android's settings (Privacy → Ads on most phones), and manage personalisation at My Ad Center.
- Builds of PhonePad made from the source code, rather than downloaded from the release page, carry no ad unit and never start the ad SDK.
The sponsor strip in the Windows companion
At most twice a day the companion downloads a small file,
https://phonepad.dynshift.com/sponsor.json, which says what
its sponsor strip shows. The request carries no identifier, no cookie
and nothing about you or your PC beyond what any download does: your IP
address and the program's name and version reach GitHub Pages, which
hosts the file (see This website below). Nothing is reported
back: not what was shown, not whether you clicked. Clicking only opens
the link in your browser.
What is stored, and where
- On your phone: your layouts, your settings, and a key for each PC you have paired with, in the app's own storage. Uninstalling removes it.
- On your PC: the same pairing key, the name your phone
reports, and when it last connected, in a JSON file under
%APPDATA%\PhonePad. You can delete it, and "Forget" in the companion removes an individual phone.
Neither is transmitted anywhere.
This website
Who is responsible
PhonePad is by DynShift, an independent software studio based in India, which decides what this website collects and why: the controller under the GDPR, and the Data Fiduciary under India's Digital Personal Data Protection Act 2023. Contact: official@dynshift.com, or the contact and grievance page.
What is collected, and why
| What | Why | Basis | Who handles it |
|---|---|---|---|
| IP address and browser details, in server logs | Delivering the pages and keeping the host secure | Legitimate interest | GitHub Pages, which hosts the site. We do not receive these logs. |
| Your privacy choice, in local storage | Not asking you again | Strictly necessary | Your device only |
| Pages viewed, referrer, device type, approximate country, a random visitor identifier | Counting visits and seeing which guides help | Your consent | Google Analytics, on DynShift's behalf |
| Advertising identifiers in cookies, the page, approximate location | Showing, measuring and protecting advertising; personalising it where allowed | Your consent in the EEA, the UK and Switzerland; elsewhere legitimate interest, with the opt-outs below | Google, as an independent controller |
| Anything you post in issues or discussions | Bug reports and questions | Your choice to post | GitHub; it is public |
| Your email and message, if you write to us | Answering you | Legitimate interest | DynShift |
Analytics
Google Analytics 4 loads only after you allow it: in the EEA, the UK and Switzerland through Google's consent message, elsewhere through a two-button question from this site. Google Analytics does not store your IP address; it uses it to estimate your country and discards it. Google signals and detailed location and device data are off, and event data is kept for two months. See how Google uses information from sites or apps that use its services.
Advertising
The documentation, troubleshooting and guide pages carry one advertisement each from Google AdSense, labelled Advertisement. None on the home page, the setup and download path, or any legal page. Google may set cookies or read similar identifiers to serve, measure and protect those ads, and, where you have allowed it, to personalise them, under its own policy. The cookies are listed on the cookies page.
Your choices
- Privacy settings, in the footer of every page, shows what applies to you and lets you change it at any time. Withdrawing consent is as easy as giving it.
- EEA, UK, Switzerland: Google's consent message asks on your first visit, with "Consent", "Do not consent" and "Manage options". Nothing that needs consent is used before you answer.
- US states with privacy laws: use Do Not Sell or Share My Personal Information in the footer (it appears where it applies).
- Global Privacy Control: if your browser sends it, this site treats it as an opt-out everywhere: no analytics and no personalised advertising.
- Anywhere: turn off personalised ads at My Ad Center, block cookies, or use an ad blocker. Every part of the site works the same.
How long it is kept
- Your privacy choice: up to 12 months in your browser, then you are asked again.
- Analytics event data: 2 months at Google; only totals remain after that.
- Advertising cookies: as listed on the cookies page.
- Emails: deleted within 12 months of the last message unless needed for a legal claim.
Who else receives data
Google (advertising in the Android app, and analytics and advertising on this site) and GitHub (hosting, downloads, issues, and the companion's sponsor file). Both process data in the United States and elsewhere under their own safeguards for international transfers, including the EU Standard Contractual Clauses and the EU-US Data Privacy Framework. Nobody else.
Your rights
Wherever you are, you can ask what DynShift holds about you and have it corrected or deleted: write to official@dynshift.com, and you will have an answer within 30 days. In practice there is very little: the apps hold nothing of yours on our side (Google holds what its ad SDK collected, and answers for it), and this site holds only what is described above.
India (DPDP Act 2023)
You may ask for a summary of your personal data and its processing, and for its correction, completion, updating or erasure; withdraw consent at any time, as easily as you gave it; nominate someone to exercise your rights if you die or become unable to; and have a grievance answered. Raise it first through the contact and grievance page; if you are not satisfied, you may complain to the Data Protection Board of India. This notice is available in English or any language in the Eighth Schedule to the Constitution on request.
EEA, UK and Switzerland
Access, rectification, erasure, restriction, portability, objection, and withdrawal of consent at any time. You may complain to your data protection authority.
United States, Brazil, Canada and elsewhere
DynShift does not sell personal data for money. Opt out of advertising "sharing" as described above. The same access, correction and deletion rights apply to you.
Children
PhonePad is not directed at children, and neither the apps nor this site knowingly collect data from anyone under 18. The ads in the app are not requested as child-directed.
Changes
If this policy changes the date above changes with it. The history is in the repository, so you can see exactly what changed and when.