Documentation / Security

What the desktop app contacts

This page lists every address the desktop app connects to, and what each one sees. The short version: your own devices, the relays you added, and, only if you switch it on, one small file on easysync.me that holds a version number. The app has no account, no advertising, no analytics and no tracking service, and it contacts no other service.

Without any setting #

  • Your own devices. The app connects to your paired devices directly when it can and through a relay when it cannot. On your local network it also announces itself and looks for your own devices; Limits and open items lists what that shows.
  • Relays you added. A relay passes encrypted data between your devices and sees IP addresses, timing and volume: What the relay sees lists everything. The official relay at relay.easysync.me is contacted only after you have added it, or after you pressed Connect on a pairing link that names it. The app then asks it for an access key with one HTTPS request that has no content.
  • Nothing else. Without the update check below, the app contacts no address that you did not add yourself.

The update check #

The check is off by default. You switch it on in Settings, card "Updates", with the switch "Check for new versions". After you have installed a newer version, the app asks once, in a line on the main screen, whether you want that; it sends nothing before you answer, and nothing if you choose "Not now". The button "Check now" sends one request when you click it, also while the switch is off. It does not switch the check on.

What the app asks for #

One file, at one address that is fixed in the program: https://easysync.me/updates/desktop/notice.json. No setting, file, argument or environment variable can change it. With the switch on, the app asks about once a day, and once a few minutes after it has started or after you have switched the check on, never in the first minute. That check at the start is skipped if the last attempt was less than an hour ago.

What the request contains #

The request has no query string, no version number, no operating system, no device name, no data from your devices, no relay key and no cookie. It is the same for every user, and it names the program as easysync-desktop. It uses HTTPS and checks the certificate. It does not follow a redirect, and it does not use a system or environment proxy: behind a proxy that you must use, the check fails and changes nothing.

What easysync.me sees #

Like any request on the internet, it shows the server your IP address and the time, that an easysync desktop app is asking, and the path of the file. It does not show the version you run, because the request does not contain it. What the server stores is written in the privacy policy of the desktop app. The app does not hide the lookup of the name easysync.me, which goes to the resolver of your network. Your network provider sees that your computer connects to easysync.me, not which file it asks for.

What the app does with the answer #

The file holds one version number, for example {"schema":1,"version":"0.4.1"}. The app reads at most 4 KiB, uses that number and nothing else, and ignores everything else in the file, links included. If the number is greater than the version you run, the app says that this version "may be available", with a button that opens the download page of easysync.me in your browser when you click it. The address of that page is fixed in the program and also shown as text. If the number is equal or lower, or the file is missing or malformed, the app shows no notice. The app keeps a small settings file on your computer and sends it nowhere. It holds: the switch itself; the time of its last attempt, which it also stores after "Check now" while the switch is off (that stores no number and switches nothing on); the newest number it saw; the number you dismissed with "Not now" on a notice; the version of the app that ran last; whether you have answered the one-time offer; and, only until a version is recorded, a note that the offer is still owed. Switching the check off makes the app forget the newest number it saw, so a notice goes away; the other items stay. The check never downloads or installs anything; you download a new version yourself, from the download page, and install it as the first time.

The file is not signed #

Nothing in the file proves that it comes from the project. Whoever controls easysync.me, or has a valid certificate for it, can name a higher number, which shows you a notice that is not true, or serve an old file or none, which hides a real one. Neither can make the app download or run anything, because it has no such code: the effect of a false notice is one click on a link that leads to the download page. A notice therefore means only that a greater number was announced, and the app never calls a version important, recommended or safe, and never calls the one you run insecure or outdated.

The downloads are not signed either, and they come from the same site as the notice. A matching .sha256 file shows that a file arrived intact. It does not show who made it, because someone who controls the site could change the file and its checksum together. This is the same as for a download without the notice.

Switch it off #

Settings, card "Updates", switch "Check for new versions". The app then makes no automatic request of this kind and starts no timer for it.