Privacy Policy

AX: Keyboard & Mouse · Effective date: October 7, 2026

This policy covers both halves of AX: Keyboard & Mouse — the app on your phone and the receiver on the computer it controls. The short version: what you type, the files you send and your computer's screen and sound travel only between your own devices, over your own network. They never reach us or anyone else. The app works without an account. Signing in with a Huntbits account on the phone is optional, and is needed only for AX Points and to buy or unlock Premium; section 10 says what that sends. The free phone app shows ads and sends anonymous crash reports and usage statistics to Google, and the receiver sends its own crash reports to us; sections 7, 8 and 11 say exactly what, and what never.

Sections below are marked with the half they apply to: Phone Receiver Both

1. What leaves your devices Both

We keep no copy of what you type, send or see. What does leave your devices, and where it goes:

• Ads Phone — the free app shows ads from Google AdMob (section 7).
• Crash reports and usage statistics Phone — sent to Google Firebase to find crashes and learn which features are used. Never anything you type or send (section 8).
• Update checks Receiver — the receiver asks our website whether a newer version exists (section 11).
• Crash reports Receiver — when the receiver hits an error, it sends our server a short report of where in the program that happened. Never anything you type or send, and it can be turned off (section 11).
• Feedback you choose to send Phone — the messages you write in Settings › Feedback, and our replies (section 9).
• Premium and your Huntbits account Phone — the Device ID, to remember Premium; and, only if you sign in, your account's AX Points activity, purchases, codes and referrals (section 10).

Nothing else. The connection between your phone and your computer is direct, on your own network, and never passes through us.

2. What travels between your devices Both

While a session is running, the phone sends the computer:

• Keystrokes and text you type
• Pointer movement, clicks, and scrolling
• Clipboard text and chat messages you choose to send
• Files you choose to send

And, only when you ask for it, the computer sends the phone:

• Pictures of its screen, while you use Screen mirroring
• The sound it is playing, while you turn on Speaker
• The name of the window in front, and what its media player is playing
• Clipboard text, chat messages and files sent from the computer

All of it goes directly from one device to the other over your local network and is encrypted end to end (section 5). None of it passes through us, and none of it is recorded anywhere except where you can see it: a message appears in the chat panel, a file is written to the receiving device's Downloads folder, a screenshot you take is saved to your phone.

Neither half keeps a log of what you type. Keystrokes are applied as they arrive and are not written to disk.

3. Information stored on your phone Phone

• This device's identity — a per-install pairing identifier, a display name, and a cryptographic key pair generated on the device, used so a computer you have paired with can recognise it again.
• Device ID — a short code (format XXXX-XXXX) derived from your device's Android ID and shown in Settings › About, so you can quote it if you contact us. It is sent to our server to remember Premium on this phone, with feedback you send, and — if you sign in — to Huntbits with your account (sections 9 and 10).
• Paired computers — the name, address and public key of each computer you have paired with, so reconnecting does not ask you to confirm a code every time.
• Chat history — messages and file records for each paired computer, kept so a reconnect does not throw the conversation away.
• Settings — your preferences in the app.

Apart from the Device ID, all of it stays on the phone. There is no sync and no backup to any server of ours. Clearing the app's data or uninstalling it removes all of it.

4. Information stored on the computer Receiver

• This computer's identity — a device identifier and a cryptographic key pair, generated on first run.
• Paired phones — the public key of each paired phone, the display name it reported, and when it last connected, so the app can show you the list and let you revoke any of them.
• Chat history, settings and a diagnostics log of connections and errors — never of what you type.
• Files you sent — written to your Downloads folder, where you can delete them like any other file.

On Windows these live in your own user profile, under %APPDATA%\ax-input. Revoking a pairing in the app's Security tab deletes that phone's key; uninstalling removes the rest.

5. Pairing and encryption Both

The first time a phone and a computer connect, they run a Noise XX handshake and each shows a six-digit code. Confirming that the two codes match is what proves you are connected to the device you think you are, and not to something else on the network. After that, each end has pinned the other's key and reconnects without asking again.

Everything after the handshake is encrypted with keys that exist only on those two devices for that session. Nobody else on your network can read it, and neither can we.

6. Finding each other on your network Both

So that the phone can list nearby computers, the receiver announces itself on your local network using mDNS — the same mechanism printers and speakers use. The announcement carries the computer's name and the port to connect to, and is visible to other devices on that network. It does not leave the network and is not sent to us. Turning off Discovery in the receiver's settings stops the announcement.

7. Advertising (Google AdMob) Phone

The free phone app shows ads served by Google AdMob. AdMob is operated by Google and may collect device information such as your advertising ID to show and measure ads, in accordance with Google's Privacy Policy and Google's advertising policies. The receiver contains no advertising.

Your choices:

• On any device — Android's own settings let you reset your advertising ID or turn off ad personalisation, at Settings → Privacy → Ads. The app honours that choice.
• In the European Economic Area, the United Kingdom and Switzerland — your consent is asked before an advertising identifier is used, and can be changed or withdrawn later. Without it, ads are chosen from context alone.
• In US states with privacy laws — the same message lets you opt out of the sale or sharing of your information for advertising.

Google's own handling of this data is described in How Google uses information from sites or apps that use our services.

8. Crash reports and usage statistics (Google Firebase) Phone

To find and fix crashes and to learn which features are used, the phone app uses Google Firebase Crashlytics and Google Analytics for Firebase. They receive:

• Crash reports — what went wrong in the app's code, the app version, device model and Android version, and where in the app it happened (which screen, whether a computer was connected, which features it offered).
• Usage events — which screens and features are opened, whether a connection or pairing succeeded or why it failed (as a category, such as "timed out"), how long a session lasted, how many keys, clicks and text sends it carried, and which settings you change.
• General information — device model, Android version, app version, country, and identifiers Firebase creates for this installation of the app.

Never collected: anything you type or the keys you press, clipboard or chat contents, file names, web addresses you open, your computers' names or network addresses, window titles, or pairing codes. Typing is counted, never recorded.

Analytics does not use your advertising ID. Where consent is required (section 7), usage data is not stored with an identifier until you give it. This data is processed by Google under Google's Privacy Policy. The receiver contains no analytics and sends nothing to Google or Firebase; its own crash reports go to us, as described in section 11.

9. Ratings and feedback Phone

• Ratings — the app may show Google Play's own rating card. It is handled entirely by Google Play; the app is not told whether you rated or what you wrote.
• Feedback — Settings › Feedback sends your message to our server, so we can answer it back inside the app. With it go the category you picked (bug, idea or other), the Device ID from section 3, the app version, your Android version and your phone model — enough to reproduce a problem and to deliver the reply to the right device. Nothing is sent until you press Send, and nothing you type anywhere else in the app goes with it. The same backend serves our other AX apps; each message is labelled with the app it came from.
• If the message cannot be sent — for example with no internet — the app offers to open your own email app instead, with the same text. That one goes only to us, as email.

We keep feedback conversations so a later message has its history. Ask us to delete yours at any time, quoting the Device ID shown in Settings › About.

10. Premium, purchases and your Huntbits account Phone

Premium status. So that Premium unlocked on this phone is remembered, the app sends the Device ID from section 3 to our server (mapp.huntbits.com) and is told what is unlocked.

Purchases. Payment for Premium is processed entirely by Google Play. We never see or store your name, card number or any other payment details. What we do receive is the product ID and the purchase token Google Play issues for the purchase; our server checks that token with Google Play to confirm the purchase is real, to see when a subscription renews or ends, and to learn of a refund.

Huntbits account (optional). The app works without an account. If you choose Sign in with Huntbits, the sign-in page opens in your browser at huntbits.com; the app never sees your password. Huntbits is our own service, and the account itself — your email address, display name and sign-in details — is covered by the Huntbits Privacy Policy. Once you are signed in, the app sends the following to Huntbits (api.huntbits.com) over HTTPS, and Huntbits keeps it with your account:

• A sign-in token — stored on the phone so you stay signed in. The app receives your Huntbits Player ID and display name; it does not receive your email address or password.
• Your Device ID — so Premium that is locked to one phone stays on that phone.
• AX Points activity — that an action which earns AX Points happened, for example that you opened the app, connected to a computer or used a feature. Only that it happened and when; never what you typed or sent, and never your computer's name or address.
• Purchases — the product ID and purchase token described above, kept as a purchase record with your account.
• Codes and AX Points you use — a Premium code you redeem, and AX Points you spend on Premium days.
• Referrals — if you installed the app from a friend's invite link, the invite code in that link, so both of you receive the reward; and your own invite code when you share it.
• App integrity check — the app asks Google Play (the Play Integrity API) for a signed statement that this is the genuine app, installed from Google Play, on a real device, and passes it to Huntbits. It is used only to stop fake or modified copies from collecting rewards. It contains no personal information.

Signing out in Settings ends that session on our server and removes the token from the phone. The receiver has no account, no sign-in and no purchases.

11. Update checks and crash reports Receiver

The receiver checks our website (ax.huntbits.com) over HTTPS for a newer version, at most every few hours, by fetching a small version file. The request carries nothing about you, your phone or what you do — but, like any web request, it reveals your computer's IP address to the server, which keeps standard access logs (IP address, time, file requested) to operate and secure the site. The phone app makes no such request.

Crash reports. If the receiver hits an error, it saves a short report on your computer and restarts itself. The report is then sent automatically to our server (mapp.huntbits.com) over HTTPS — at once if the internet is reachable, otherwise the next time it is. A report contains only the receiver's version, your Windows version, the error message, where in the program it happened (a backtrace of the program's own code), and whether a phone was connected at the time. It never contains anything you typed, keys pressed, clipboard or chat contents, file or window names, device or computer names, network addresses or pairing keys. Like the update check, sending one reveals your computer's IP address to the server, which is not stored with the report.

To stop sending them, turn off Send crash reports in the receiver's Security tab. Reports are then kept only on your computer, under %APPDATA%\ax-input\crashes (at most five, oldest removed first), where you can read or delete them. A report is removed from your computer once our server has received it. We keep received reports to fix the problem and delete them when they are no longer needed.

12. Permissions Phone

• Network access — to connect to the computer, and to see Wi-Fi state so the app can tell you when you are not on a network.
• Multicast and nearby Wi-Fi devices — to receive the discovery announcements described in section 6. The app does not use them to determine your location.
• Camera (optional) — only to scan the QR code the receiver shows, while the scanner is open. Camera images are not stored or sent anywhere.
• Foreground service, wake lock and notifications — to keep a session alive and visible while you are using it, so the connection is not dropped when the screen dims.
• Advertising ID — added by the ads service, as described in section 7.

The app does not request contacts, location, microphone, or access to your photos. Files you send are ones you pick yourself.

13. What the receiver does to your computer Receiver

The receiver applies input to the computer it runs on — that is its whole purpose, and it is why it has to be a real installed application rather than a web page. It does this only while a paired, authenticated session is active. Nothing reaching it before that authentication is allowed to touch the operating system. It captures the screen or the sound only while the phone has asked for them in that session.

The first time it opens a network port, Windows will ask whether to allow it. That prompt is yours to answer; the installer does not create a firewall rule on your behalf. The receiver adds one itself only if you click to allow its PC-hotspot mode, and Windows asks you to approve that too.

14. Data retention & deletion Both

Everything either half keeps on your own devices is removed by revoking a pairing, clearing the app's data, or uninstalling.

Premium records and your Huntbits account. A Premium record kept against your Device ID, and what section 10 describes for a Huntbits account, are kept for as long as the Premium or the account exists. You can ask for them to be deleted at any time: email us from the account's email address, or quote your Huntbits Player ID or Device ID. Records we must keep by law — for example of purchases, or of rewards that were paid out — are kept for the period the law requires and then deleted. Signing out, or uninstalling the app, does not by itself delete the account.

The phone app's crash reports and usage statistics are kept by Google Firebase for its standard retention period and then deleted; advertising data is handled by Google as described in section 7. The receiver's crash reports are kept on our server only as long as needed to fix the problem they describe. Feedback emails are kept only as long as needed to reply. To ask us to delete anything we hold, email us from the address you wrote from, or quote the Device ID shown in Settings › About.

15. Children Both

AX: Keyboard & Mouse is a general-audience utility and is not directed at children under 13. We do not knowingly collect personal information from children.

16. Security Both

The link between the two devices is encrypted end to end and mutually authenticated, as described in section 5, and stays on your local network. Update checks, crash reports and everything sent to Huntbits use HTTPS. We hold no copy of what you type, send or see, so there is nothing of that kind for us to lose.

17. Changes to this policy Both

If we make material changes, we will update this page and the effective date above.

18. Contact Both

AX: Keyboard & Mouse is not affiliated with Google, Microsoft, Apple, or any device manufacturer. Android and Google Play are trademarks of Google LLC; Windows and Microsoft Store are trademarks of Microsoft Corporation.