Privacy policy

FlyingFiles is a file manager that runs only on your computer. We don't collect data about you or about how you use the app.

Last updated: 2026-10-06

In one sentence: the app doesn't send us any data — there are no accounts, telemetry, analytics or ads, and the only network connections it makes are to servers you configure yourself, your own computers paired on the local network, and a check for a new version (at startup — you can turn this off — or when you ask for one).

1. Who is responsible for the app

The publisher of FlyingFiles is NCI, ul. Bławatkowa 10, 84-100 Puck, Poland, VAT ID PL586-103-86-56. Contact for privacy matters: kontakt@nci.pl.

2. What the app stores on your computer

All of the data below stays on your device and never reaches us or anyone else — except what you move yourself with an .ffsync file or share with your paired computers (section 3). You can view and delete it at any time — these are ordinary files and entries in the system password store.

Passwords are never saved in the settings file. They go to the operating system's password store, which protects them with its own mechanisms. The app reads them only when you connect to a server, edit a saved connection or synchronize settings (saving an .ffsync file with passwords, sharing passwords with a paired computer).

3. Network connections

The app connects to the network only in these situations:

• FTP, FTPS and SFTP servers that you add yourself. Login details and transferred files go only to that server. We can't see them, and we don't act as an intermediary in the connection.

• Network shares mounted in your system — as in any file manager.

• Update check. Every time the app starts (since version 1.5.0; you turn this off in Settings → Appearance and language → Updates) and when you choose Help → Check for Updates…, the app checks whether there is a new version. The request contains no data about you or your files.

  • macOS: the app downloads the list of releases from the nci.pl server and, with your consent, the package with the new version. The update mechanism (the Velopack library) attaches to the request the installed version number, the CPU architecture and a random installation identifier, which it stores on your computer and uses for staged rollouts of updates.

  • Linux: the app downloads a small file with the number of the latest release from the nci.pl server and installs nothing itself — the new version is installed by the system's package manager. The request gives the app's version number in the User-Agent header (e.g. FlyingFiles/1.5.0). The .rpm package adds a dnf repository on nci.pl to the system, from which the system downloads the list of packages during its own updates.

  As with every visit to a website, the server records the IP address, the date and the request address in its logs. The logs are used solely for server diagnostics and security.

• Your computers on the local network — only if you pair them (Settings → Synchronization → Pair a Computer…). Everything below happens directly between your computers on the local network — not over the internet and not through our servers; we can't see this data.

  • While the pairing window is open, the app announces on the local network (UDP, port 28217) the computer's name, the type of system, the TCP port and the beginning of its key fingerprint, so that the other computer can find it. Outside the pairing window, the app announces nothing about itself; the computer's name goes only to a paired computer, over an encrypted connection.

  • When you have paired computers and share your settings (yes by default) or files with them, the app listens on one TCP port in the 28217–28220 range (the first free one), answers address queries on UDP port 28217 and exchanges data only with paired computers: the connection is encrypted (TLS), and both sides check the keys remembered when pairing. The certificate with the public key (without the computer's name) is part of every TLS connection; in TLS 1.2 — always used when a Mac is the server — it is sent unencrypted. On every connection to a paired computer, the app also sends a query for its address on the local network, which contains neither the name nor the key.

  • Synchronize Now fetches from the other computer the settings from the groups selected on both computers. Server passwords are transferred only if, on the computer that sends them, you turn on Share server passwords with it for this computer (off by default).

  • If you turn on Share this computer’s files with paired computers (off by default), paired computers can browse, copy, write, rename and delete this computer's files within the permissions of your account.

Synchronization with a file doesn't connect to the network: you save and move the .ffsync file yourself, and without the password it can't be read.

The Microsoft Store version checks for and installs updates through the Store, not through our server — Microsoft's privacy policy applies to that part. During installation, this version adds rules for the local network synchronization ports to Windows Firewall.

Features that use other programs work locally: opening files in system applications, SSH/Telnet terminals in the Terminal app or Windows Terminal, and video frames from the system's Quick Look.

4. What we don't do

• We don't collect telemetry or usage statistics.

• There are no user accounts and no logging in.

• There are no ads, no tracking and no profiling.

• We don't read, upload or index your files. The app works on them locally, just like Finder or File Explorer.

• We don't pass on any data to anyone.

5. Contact and public reports

Submit problems and ideas using the support form or email kontakt@nci.pl.

Data supplied with a report is used only to handle that report: to discuss it, respond, resolve the problem or consider the idea. It is not used for marketing or mailing lists.

• Public: the report number, app version, nickname, title, description, status, dates and times (Europe/Warsaw), and published replies. Anyone can read them. Do not include information you do not want to share in the description.
• Private: the optional email address for contacting you and browser information (the User-Agent header) for handling the report and assessing spam. Only console administrators can access them.
• Notifications: if you provide an email address, a published NCI reply triggers a message from kontakt@nci.pl with a link to the reply. You can reply to that email; it reaches our mailbox and an administrator manually adds your contribution to the public discussion. Your email address and email headers are not published. The notification is in the language you used for the report.
• Storage and moderation: reports and discussions are stored in the support database. Administrators can edit, hide or delete entries. Hiding an entry does not delete its data; it remains available in the console. To request removal of your data, email kontakt@nci.pl and quote your report number.

Send confidential matters and security issues directly by email. Do not send passwords or private keys.

6. The website

The nci.pl/flyingfiles website:

• does not load scripts, fonts or other resources from external servers. The report form uses a technical session cookie to protect and process submissions, not for tracking. A short-lived private technical identifier derived from the network address limits spam (an hourly limit; expired entries are removed on subsequent submissions);

• records downloads and visits to Microsoft Store: each counted click has its own database record with its date and time, version, channel, event type and browser information (User-Agent, up to 1024 characters). These details help assess automated traffic; User-Agent can be spoofed. Only console administrators can access individual records. Daily totals are also retained. These records do not contain IP addresses, referrers or visitor identifiers, and counting clicks does not use cookies;

• like every web server, keeps access logs (including the IP address, the date, the page address and information about the browser). The logs are kept by the hosting provider for security and diagnostic purposes, and how long they are retained depends on the hosting settings. The legal basis is the legitimate interest in maintaining a secure website (Article 6(1)(f) GDPR).

The Get it from Microsoft Store button leads to Microsoft's website, where Microsoft's privacy policy applies.

7. Your rights

The GDPR gives you the right of access to your data and the rights to rectification, erasure, restriction of processing, objection and data portability.

The app's data consists of files on your disk and entries in the system password store — you exercise these rights yourself, immediately. Deleting the settings folder (on Windows also %LOCALAPPDATA%\FlyingFiles) and the FlyingFiles FTP and FlyingFiles Sync entries from the password store erases everything the app “knows” about you.

For matters concerning correspondence and data related to the website, write to kontakt@nci.pl. You also have the right to lodge a complaint with the President of the Personal Data Protection Office (UODO), the Polish supervisory authority.

8. Children

The app is a general-purpose tool and isn't directed at children. It doesn't collect data from anyone, and therefore not from children either.

9. Changes

If we ever add a feature that requires sending anything outside your computer, we will describe it here before it is added to the app, and we will change the update date at the top.