TRUST
What is encrypted, and what isn’t
Your mouse, keys, clipboard and files only travel between your own computers, over your network, encrypted. Here is exactly how.
The short version
| WHAT | WHERE IT GOES | ENCRYPTED |
|---|---|---|
| Mouse movement and clicks, key presses | Directly to your other computer, on your network | Yes |
| Clipboard: text, formatted text, images | Directly to your other computer | Yes |
| Files and folders | Directly to your other computer | Yes, and checked on arrival |
| Passwords you copy from a password manager | Nowhere. Crosspoint never reads them | Not sent |
| The computer’s name, id and fingerprint | Announced on your local network so your computers find each other | No, but no secrets |
| Signing in, your account, buying | crosspoint.click | Yes (HTTPS) |
| Update checks, when you click Check for updates | GitHub, where the app is published | Yes (HTTPS) |
No server sits between your computers, ours included. The app has no analytics or tracking.
Between your computers
- Computers talk over QUIC with TLS 1.3, the same encryption as modern HTTPS, on UDP port 24900.
- Each computer makes its own private key (Ed25519) the first time Crosspoint runs. It never leaves that computer. It is stored in the Mac Keychain or the Windows Credential Manager.
- Both sides prove who they are on every connection. A computer you haven’t paired is turned away.
Pairing
The 6-digit code is used with SPAKE2, a protocol that lets two computers agree they typed the same code without ever sending it. Both computers then confirm a fingerprint of both certificates and of the live connection, so someone in the middle of your network can’t sneak in, even if they watch the pairing. Each code lasts 2 minutes and allows 3 tries.
On each computer
- The app and its background service talk over a private channel only your user account can open.
- A license key and the account sign-in are kept in Crosspoint’s data folder, readable only by you on a Mac.
- Logs stay on the computer for 7 days. They record events like “connected” or “control changed” and the names of transferred files, never key presses or clipboard contents. Crash reports stay on the computer too.
- Nothing leaves the computer unless you send it. The debug report from Diagnostics is something you copy and choose to email us.
What this website stores
Your account details, the computers signed in to it and, once you buy, your purchase. Never your input, clipboard or files. The full list is in the Privacy policy.
Found a security problem? Please tell us privately at Contact support before sharing it publicly. We fix security issues first.