Privacybeleid van Relaypad

Relaypad has no account system and no server of ours between you and your game console. Your gameplay, your console and your sign-in never pass through us.

What we do collect: anonymous usage events through Google Analytics for Firebase. They are on by default and you can switch them off in Settings → Privacy → Usage statistics. They never include your account ID, your IP address or your console's name (§4).
Where else the app connects: your own console, the console manufacturer's sign-in and remote play services if you sign in, public STUN servers for remote connections, your router, Google Play and Firebase, and, only if you set it up yourself, the AI provider whose API key you enter (§10). §2 lists every destination.
What stays on your phone: pairing keys and sign-in tokens, encrypted with a key that cannot leave the device, plus your consoles, settings and layouts (§3).
You can check this yourself: the permissions are visible in Android's Settings → Apps → Relaypad → Permissions and listed in §12, and the app's source code is public (§1).

About this policy

Relaypad is an independent, unofficial Android app that turns your phone into a controller for a game console and streams the console's picture to your device. This policy explains what happens to information when you use it.

It covers the Relaypad app as published on Google Play. It does not cover your console or the services run by its manufacturer, Google Play itself, your router, or any modified build of Relaypad distributed by someone else.

Relaypad is free software licensed under the AGPL-3.0, so the statements in this policy can be checked against its source code: codeberg.org/geektech54/gamec.

Questions, requests or complaints: feedback@dapplebyte.com.

Where your data can go

This is every destination the app sends data to, and what triggers each one. Nothing else leaves your device.

Destination	What it receives, and when
Your console	Discovery and wake-up broadcasts on your local network, pairing requests, controller input, text you type when the console asks for it, microphone audio while the mic is on, and the video and audio stream coming back. This is a direct connection between your device and your console, either on your local network or through the manufacturer's remote play service when you play away from home. We are not part of it and never see it.
The console manufacturer's services	Only if you sign in. You sign in on the manufacturer's own web page, and the app then uses the resulting token with the manufacturer's services. §5 lists exactly what for.
A public account-ID lookup service	Only if you choose "look up by Online ID" during setup: the Online ID you type is sent to `psn.flipscreen.games`, an independent third-party service, which returns the matching account ID. See §6.
Public STUN servers	When you run the connection doctor, connect from outside your home network, or register a console without a pairing code: short packets to public STUN servers so the app can learn how your network translates addresses. These servers see the public IP address your connection comes from, the same thing any website sees. Nothing that identifies you is attached. See §7.
GitHub	Rarely: if the app's built-in STUN server list cannot be used for a remote connection, it downloads a public list of STUN servers from `raw.githubusercontent.com`. The request carries nothing that identifies you.
Your router	UPnP requests on your local network when the connection doctor runs, when a remote or code-free connection is set up (which may add a temporary port mapping), and when you use automatic port mapping. This stays inside your home network.
Google Play	When you buy the app, buy or restore Pro, or rate the app. Google processes the payment; we never see your payment details. See §8 and §9.
Google Analytics for Firebase	Anonymous usage events, while the statistics switch in Settings is on. See §4.
Firebase Remote Config	A request for our current configuration values, made when the app starts, including when statistics are switched off. See §9.
An AI provider you choose (optional)	Only if you turn on the AI copilot and enter your own API key for Anthropic, Google, DeepSeek or an OpenAI-compatible service, and only when you ask for something: the game guide topic you typed, the game name, your follow-up questions with the current guide, a reduced screenshot of the stream if you chose to attach one or asked to have the screen described, and, for the guide search, the provider runs web searches on your behalf using those words. The request goes straight from your device to that provider under your own key and the provider's own terms; it never passes through us, and we keep no copy. Guides come back to your device and are stored there only. See §10.
Apps you choose	Only when you tap to send feedback, share a screenshot or share a connection-doctor report: your email app or the app you pick receives it, and what happens next is up to you and that app. See §10.

What stays on your device

Relaypad keeps what it needs in Android's private storage for the app, which other apps cannot read. Uninstalling the app or using Android's Clear storage deletes all of it. The one exception is stream screenshots, described below the table.

What	Details
Pairing keys	The registration keys your console issues when you pair. Encrypted with AES-256-GCM using a key held in the Android Keystore, which cannot be extracted from the device.
Sign-in tokens and device ID	If you signed in: the access and refresh tokens issued by the manufacturer, encrypted the same way. Also a random device identifier the app generates for remote play (§5). Removing the account in the app deletes the tokens.
Account details	The account ID your console needs before it will pair, your Online ID if known, and which sign-in method you used. Never sent to us, never attached to usage statistics.
Your consoles	For each console: the name you gave it, its local and MAC address, generation and firmware version, the console's own ID from the manufacturer, the console passcode if you entered one, whether Remote Play was enabled, the game or app it last reported running, and when you paired and last connected. This lets the app find, wake and reconnect to it.
Your settings and layouts	Stream, controller, network and display preferences, controller layouts you create, button mappings for physical gamepads (with the gamepad's name), vibration strength, theme, the statistics switch, and small flags such as which tips you have already seen.
Purchase state	Whether Pro is unlocked, with the product ID, order ID and purchase time reported by Google Play, so the app works offline.
Caches	Cookies and cache from the in-app sign-in page; a per-network note of whether your router supports UPnP and what the last address-translation test found, filed under a one-way hash of the network rather than its name or address; and the state of the home-screen widget.
Connection-doctor summary	One line summarising the last run, kept so it can be included if you choose to send feedback.

Screenshots. If you take a screenshot during a stream, it is saved as a picture on your device: on Android 10 and newer in Pictures/Relaypad, where it stays after you uninstall the app; on Android 8 and 9 in the app's own folder, which is removed on uninstall. A temporary copy is kept in the app's cache so it can be shared.

Backup and transfer. The app excludes all of its data from Android backup and from device-to-device transfer, so none of it is copied into your Google account's cloud backup or moved to a new phone when you set it up from an old one.

The cost of keeping keys on the device: pairing keys and sign-in tokens cannot be restored to a new phone or recovered after a factory reset. On a new device you sign in and pair again. We cannot recover them for you, because we never had them.

Anonymous usage statistics

Relaypad uses Google Analytics for Firebase to count how features are used, so we can see which screens fail and which parts are worth improving. Statistics are on by default and can be switched off in Settings → Privacy → Usage statistics. Switching them off stops collection straight away and it stays off.

The events the app sends itself are a fixed set, defined in the source code:

the steps of the setup wizard and how each ended, which of the ways in §6 you used to get your account ID and whether it worked, whether pairing succeeded, and whether you paired with a code or through your account;
the play button on the home screen (which mode, and whether the connection started), switches between streaming, remote and controller modes, and the start of a stream (local or remote);
changes to quality, controller and display settings;
paywall shown, purchase tapped, paywall closed, restore tapped, and the result of a purchase or restore (completed, pending, cancelled or failed);
FAQ opened, and which question was expanded;
remote connection attempts and how they ended;
external display detected, used or released;
the steps of the rating prompt (§9).

Each event carries at most one short label, for example which entry point opened the paywall, which setting changed and its new value, or which failure category a sign-in, pairing or remote connection ended in. These labels never contain your account ID, your IP address, your console's name or the name of an external display, and the app's analytics interface is built to keep it that way.

Google Analytics also records its own standard events, such as first open, app update and time spent in the app. Google attaches an app-instance identifier and standard device information: model, OS version, language, and an approximate country derived from your IP address. Google does not give us the IP address itself. We have removed the advertising-ID permissions that the analytics library would otherwise add, so no advertising identifier is collected. Events are kept for 14 months and then deleted.

Relaypad contains no advertising SDK, no attribution SDK and no crash-reporting SDK. There are no ads anywhere in the app.

Remote play, and registering a console without a pairing code, require signing in to the console manufacturer's account. When you do:

the sign-in page is the manufacturer's own web page, opened inside the app or in your browser. We do not see, intercept or store what you type there;
the sign-in request includes a random device identifier that the app generates and keeps on your device, because the manufacturer ties remote play to the device that signed in;
the app exchanges the result for a token with the manufacturer's authentication service over HTTPS, and renews the token there when it expires, using the refresh token stored on your device;
the token is stored encrypted (§3) and used only with the manufacturer's services: to read your account ID, list the consoles on your account, register a console without a pairing code, check whether Remote Play is enabled on your console, and set up remote connections to your own console;
the token is never sent to us, and we have no server that could receive it.

What the manufacturer does with your account activity is governed by its own privacy policy, not this one. If you never sign in, none of this happens: you can still pair and play on your home network using an account ID obtained another way (§6).

Getting your account ID

Your console only pairs with an app that presents your account ID. The app offers four ways to get it:

Sign in inside the app, on the manufacturer's page (§5);
Sign in in your browser and paste the resulting address back into the app (§5);
Type an account ID you already have. This is converted on your device and nothing is sent anywhere;
Look it up by Online ID, offered only for older consoles where it still works. The Online ID you type is sent to psn.flipscreen.games, a third-party service we do not run and are not affiliated with, which returns the account ID. Nothing else is sent, and the request carries nothing that identifies your device.

Network checks and remote connections

The connection doctor, and the app when it sets up a remote connection, examine your network so they can tell you why a connection fails. The analysis runs on your device.

Checks that stay on the device: network type and Wi-Fi band, whether a VPN is active (and, if it hides the underlying network, what that network is), Bluetooth and connected gamepads, whether your phone and console are on the same subnet, whether the console responds and how fast, the system's bandwidth estimate, whether your account is ready for remote play, and external display state.
Checks that use the network: whether Remote Play is enabled on your console, asked of the manufacturer's service if you are signed in; whether your router supports UPnP, and the public address it reports; and STUN tests that show how your network assigns external addresses, which is how the app tells a carrier-grade NAT apart from a normal home router.
STUN servers are public servers run by independent operators, currently Cloudflare, Google, Nextcloud, Xiaomi, Twilio, Syncthing, Bilibili and the Moonlight project. The list is built into the app and may change between versions. They see the public IP address of your connection, as any internet server would. We receive none of it.

Results are shown to you, and a one-line summary is kept on the device for the feedback email. They are not uploaded. If you share or copy the full report yourself (§10), note that it includes your console's name, local addresses and your public IP address.

Purchases

Whether you pay for Relaypad on Google Play or unlock Pro with a one-time in-app purchase, the payment is processed by Google Play. Google handles the payment and tells the app whether you are entitled to Pro; we never receive or store your payment method, card details or billing address. The app caches the entitlement on your device (§3) so it keeps working offline.

Refunds follow Google Play's terms and the refund policy shown in the app. If you email us for a refund, the order number you include is used only to find and refund the purchase.

Remote configuration and the rating prompt

Firebase Remote Config fetches our current configuration, for example the free-tier quality limit, switches that let us turn off a feature if a console update breaks it, lists of hardware video decoders known to misbehave, a compatibility notice, whether the rating prompt is enabled, paywall options and the launch-price deadline. The request carries a Firebase installation identifier and basic app and device information, such as app version and language, so that Google can deliver the right values. It is not linked to your account or your consoles, and because the app needs it to work properly, it is made even when usage statistics are switched off.

The rating prompt is Google Play's official in-app review card. Whether you rate, and what you write, is handled entirely by Google Play, and the app never sees it. Relaypad only keeps a few values on your device to decide whether to ask at all: how many controller sessions you have started, whether a stream has run for 20 minutes, and how many times and when it last asked Google Play to show the card. It asks at most twice in the app's lifetime, with at least 60 days between asks.

Things you choose to send or share

The feedback email

If you tap "Send feedback", the app opens your email app with a message addressed to us and pre-filled with: app version; device model, manufacturer and codename; Android version, API level and ROM build; language; for each paired console, its generation, firmware version and the name you gave it; the one-line summary of your last connection-doctor run; your purchase status, with product ID, order ID and purchase date if you have bought Pro; and whether Google Play Billing is reachable.

Nothing is sent until you press send in your own email app, and you can edit or delete any of it first. If you send it, we receive it at feedback@dapplebyte.com and keep it only as long as needed to help you.

Screenshots and connection-doctor reports

You can share a stream screenshot, or share or copy a connection-doctor report, through Android's share sheet or clipboard. The report includes your console's name, the local addresses of your phone and console, and your public IP address. It goes only where you send it, and from then on the app you picked, not this policy, governs what happens to it.

AI copilot: game guides and screenshots you ask about

The AI copilot is off until you turn it on and enter your own API key for an AI provider (Anthropic, Google, DeepSeek, or any OpenAI-compatible service you name). Nothing is sent to any AI provider before that, and there is no key of ours in the app.

Game guides. When you search for a guide in the panel on the stream screen, the app sends the topic you typed, the game name, and your preferred language directly to the provider you chose, and asks it to search the web and write a step-by-step guide. The web searches are run by that provider (Anthropic, Google or OpenAI run them on their own servers; DeepSeek through its Anthropic-compatible endpoint), using your topic words as search terms, under the provider's own terms; a self-hosted or third-party OpenAI-compatible endpoint gets no web search and answers from the model alone. Follow-up questions send the current guide and your recent follow-ups along with the new question, so the provider has the context. If you tick Attach current screen, one reduced screenshot of the stream taken at that moment is included. Finished guides, your follow-ups and which steps you ticked are stored on your device only (at most 50 guides, deletable one by one or all at once in Settings); nothing is uploaded to us.

Describe the screen. When you ask for the screen to be described, by voice or from the quick panel, the app takes a reduced screenshot of the stream at that moment (up to two frames, so the provider can see what just changed) and sends it, with the name of the running game if your console reported it, directly to the provider you chose. There is no sampling in the background: pictures leave your device only when you ask. The provider processes every request under its own privacy policy and bills your own account; we are not part of that connection, do not receive the pictures, guides or answers, and keep no record of them. The app keeps only a count of requests and searches and an estimated cost for the current month, on your device.

Your API key is encrypted with a key held in the device's hardware key store, is excluded from backups, and is deleted immediately when you clear it. You can turn the whole feature off in Settings → AI copilot.

Microphone and text input

Relaypad can forward your microphone to the console, the same way a headset does, so you can talk in a game. Audio is captured only while you have the microphone turned on during a session, is sent directly to your console, and is never recorded, stored or uploaded. Android asks for the microphone permission the first time you use it, and denying it only disables that feature.

When the console asks for text, such as a search term, a message or a sign-in passcode, what you type in the app is sent directly to the console over the session. The app does not store or log it.

If you use the AI copilot's voice button, your speech is turned into text by Android's own speech recognition service while you hold the button; forwarding to the console pauses for that moment. On most devices the recognizer runs on the device; where it does not, the device's speech service (typically Google's) handles the audio under its own policy. The resulting text is matched against the voice-command list on your device; if it is not a command it goes to the game guide panel: as a topic for you to confirm when no guide is open, or as a follow-up sent, as text, to the AI provider you chose when a guide is open (§10). The app never records or stores the audio. Spoken answers use Android's text-to-speech on the device.

Permissions

These are the permissions in the released app and what each is for. Those marked "from a library" come with Google or Android components the app uses, rather than from a feature we wrote.

Permission	Why
`INTERNET`	Talk to your console, and reach the destinations listed in §2.
`ACCESS_NETWORK_STATE`	Tell whether you are on Wi-Fi or mobile data, including when a VPN hides the underlying network, and whether a VPN is active. Used by the connection doctor and to lower stream quality on mobile data.
`ACCESS_WIFI_STATE`	Read the Wi-Fi band (2.4 GHz or 5 GHz) for the connection doctor.
`BLUETOOTH` (Android 11 and older)	Read whether Bluetooth is on, because it can interfere with 2.4 GHz Wi-Fi. Not requested on Android 12 and newer.
`RECORD_AUDIO`	Forward your microphone to the console during a session, and, if you use the AI copilot's voice button, let Android's speech recognizer hear you while you hold it (§11). Requested only when you use one of these.
`VIBRATE`	Turn rumble from the console into vibration, and give button presses haptic feedback at the strength you choose.
`com.android.vending.BILLING`	Buy and restore Pro through Google Play.
`WAKE_LOCK`, `BIND_GET_INSTALL_REFERRER_SERVICE`	From a library: added by Google Analytics for Firebase.
`FOREGROUND_SERVICE`, `RECEIVE_BOOT_COMPLETED`	From a library: added by WorkManager, which the home-screen widget library uses. Relaypad runs no foreground service of its own. After a restart the library may briefly reschedule pending widget updates, but the app does not otherwise start itself.
`DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION`	From a library (AndroidX Core): an internal permission, invisible to other apps, that keeps the app's own system-event receivers private.

We explicitly remove three permissions that the analytics library would otherwise add, the advertising ID and two ad-attribution permissions, because Relaypad has no ads and does no ad attribution.

Relaypad requests no location, contacts, calendar, SMS, call-log, photo or file permissions, and does not read the list of apps installed on your device.

Google Play

Separately from anything the app does, Google Play gives every developer aggregate statistics about their app's installs, uninstalls, ratings and crashes (Android vitals). Google produces these figures; the app does not send them to us, and they do not identify you.

Children

Relaypad is a utility for people who own a game console and is not directed to children under 13. We do not knowingly collect personal information from children. The app has no account system of its own, no social features, no user-generated content and no advertising. If you believe a child has sent us personal information through the feedback email, write to us and we will delete it.

Your choices and your rights

Switch off statistics: Settings → Privacy → Usage statistics. Takes effect straight away and stays off.
Remove a console: Settings → Consoles → choose the console → Forget this console. This deletes its pairing keys and record from your device.
Remove an account: Settings → Accounts → Remove. This deletes the stored sign-in tokens and account details from your device.
Delete everything: uninstall the app, or use Android's Clear storage. Nothing of yours is stored on a server of ours, so this removes all of it except screenshots you saved to your Pictures folder, which you can delete like any other photo. There is no account of ours to delete.
Ask us: if you are in the EU/EEA, the UK, California or anywhere with similar law, you may ask what we hold about you, ask for a copy, or ask for deletion. In practice the only thing we can hold is an email you chose to send us. Write to feedback@dapplebyte.com and we will reply within 30 days.
Google's own controls: for the analytics and configuration data Google processes, see Google's privacy policy.

We do not sell or share personal information, and we do not use it for cross-context behavioural advertising. There is no advertising in Relaypad at all.

Legal basis, retention and transfers

Where the GDPR applies, our legal bases are: performance of our agreement with you for the features you ask for (pairing, streaming, remote play, purchases); our legitimate interest in keeping the app working, for Remote Config and the network checks described in §7; and your consent for usage statistics, which you can withdraw at any time with the switch in Settings.

Retention: data on your device stays until you delete it or uninstall the app; usage events are kept by Google for 14 months; emails you send us are kept only as long as needed to help you.

Google processes analytics and configuration data on servers that may be outside your country, under its own data-transfer safeguards. We run no servers of our own.

Security

Pairing keys and sign-in tokens are encrypted with AES-256-GCM under a key held in the Android Keystore. Everything else the app stores is protected by Android's app sandbox. Connections to the manufacturer's services, the lookup service and Google use HTTPS, and the stream between your device and your console is encrypted by the console's remote play protocol. No method of storage or transmission is perfect, but there is no central database of users to breach, because there is no server of ours.

Changes to this policy

If we change what the app does with data, we update this page and the effective date at the top. Material changes are also mentioned in the app's release notes on Google Play. The current version of this policy is always the one at this address.

Contact

Relaypad · feedback@dapplebyte.com

Source code: codeberg.org/geektech54/gamec