Controller

The app collects none of your content

Mellan has no accounts and no cloud sync. Everything below travels directly between your Mac and your phone over an encrypted Bluetooth Low Energy link the two devices establish when you pair them. None of it reaches us, none of it passes through a server of ours or anyone else’s, and none of it is stored anywhere but on your own devices.

Pairing is the one exception, and only while it is happening. When you put your Mac into pairing mode it advertises itself over Bluetooth under its own name — the computer name from your Mac’s settings, shortened to fit the advertisement — so your phone can list it for you to choose. A Bluetooth advertisement carries no encryption, so any device scanning nearby can see that name for as long as pairing mode is open. Your Mac stops broadcasting the name as soon as pairing ends, and the advertisement it uses for everyday connections carries no name at all.

What the two devices send each other, and when:

• Clipboard text. The two directions work differently, and only one of them waits for you. Sending from Android is an explicit action you take — a share, a text selection, or the Quick Settings tile — with two exceptions, and each is a setting you have to change yourself. A share or text selection normally shows you the text and waits for you to tap Send. If you turn off “Ask before sending”, it is sent straight away, and because Android lets any app on your phone open that share target, other apps can then send text to your Mac without your tapping anything. That setting is on until you turn it off. The other exception is automatic clipboard sync. With that on, the Android app reads your clipboard in the background, including text you copy in other apps and while the app is closed, and sends it to your paired Mac. It is off until you turn it on, and you can turn it off at any time. On Android 13 and later, automatic sync drops content the source app marks as sensitive — which is what password managers do — rather than sending it, unless you also turn on “Include sensitive items”. That is off until you turn it on. With it on, such content is sent to your Mac, which puts it on its clipboard marked as concealed. If you have the Mac notify you when text arrives, that notification says sensitive content arrived without showing the text. The Quick Settings tile sends whatever is on your clipboard, and content marked sensitive goes marked the same way whether or not that switch is on, because you chose to send it. A share or text selection is sent as it is. The Mac direction has no such switch. For as long as the Mac app is running it reads its own clipboard twice a second and sends each new piece of text to your paired phone — whatever you copied, in whichever app, without your asking each time. Nothing is sent before you pair a phone, only plain text travels, and only up to 32 KB of it. Text is held back when the app you copied it from marks the item concealed, which is what password managers on the Mac do — but macOS has no system-level flag for sensitive clipboard content, so that rests on the app you copied from and protects you less than the Android default above does.
• Notifications. If you grant notification access, the Android app reads the notifications your phone receives and mirrors them to your paired Mac, in the background and while the app is closed. Each one carries the app it came from — its name, its package name and its icon — the title, the message text, the time the notification is stamped with, the sender picture where the notification has one, and the identifier Android gave the notification, which is how the Mac replaces and withdraws the right banner. That identifier goes over again when the notification leaves your phone. The phone also sends the Mac a fresh picture of what it is mirroring, and that is more than identifiers: the identifier of every notification that is showing at that moment and eligible to be mirrored, so the Mac can clear the ones that have gone, and for the twenty most recent of those the same content a newly arrived notification carries — the app, the title, the message text and the time — including notifications that arrived while the two devices were apart. That is not your whole shade. The same rules decide it as decide a live notification: nothing travels from an app you have blocked, from Mellan itself, or — when you have that setting on — from anything your phone filed as silent, and Mellan leaves behind the ongoing ones a running app keeps in place, the summary line that stands in for a group, notifications the app that posted them asked to keep on the phone, and ones with neither a title nor a message. The sender picture is left out for a different reason: it travels with a live notification and not in this picture of the shade. The phone sends it on each reconnect, and again during a session whenever the Mac’s view would otherwise be out of date: when you grant notification access or your phone rebinds Mellan’s listener, when you switch mirroring back on, and when you change which apps are mirrored or whether silent notifications are included. You choose which apps are mirrored, and you can turn mirroring off at any time.
• Your hotspot’s name and password. If you turn on hotspot control in the Android app, your Mac can switch the phone’s Wi-Fi hotspot on and off, and while the hotspot is running, including one you switched on yourself, the phone sends its network name and password to your paired Mac so it can join: when the two devices connect, and again each time the hotspot changes. Hotspot control also needs the system-level access Mellan asks for through Shizuku — the same access automatic clipboard sync needs, not a separate permission. It is off until you turn it on, and turning it off stops both the switching and the sending. The password goes to your Mac and nowhere else.
• Battery level and charging state. The phone reports its battery level and whether it is on external power, so the Mac can show both — once when the two devices connect, and again every time either of them changes.
• Phone network status. The phone reports whether it is offline or its current connection uses Wi-Fi, mobile data or another kind of network, the mobile connection type (such as LTE or 5G), signal strength and whether Android has confirmed internet access. The Mac shows this in the menu, updating when it changes. Mellan does not read network names, IP addresses, carrier names or cell locations for this feature, and does not contact a server to test the connection. To follow the SIM your phone uses for mobile data, it reads the number Android assigns that SIM on the phone; that number stays on the phone and is never sent or stored. These readings go only to your paired Mac over Bluetooth.
• Each device’s name, app version and feature list.As soon as a connection is authenticated, each device tells the other three things about itself: the name it goes by — the device name from your settings, or the phone’s model where you have not set one — the version of Mellan it is running, and which of Mellan’s features it can offer, which is some combination of clipboard, notifications, hotspot control, phone network status and the status channel that carries battery level and connection housekeeping. Each side needs that list to know what it may send and what the other cannot receive, and the Mac uses the name to identify your phone in its menus. The phone sends all three again during a session if what it can offer changes — when you grant it the access hotspot control needs, for example. This is the authenticated name, sent over the encrypted link; it is not the name your Mac broadcasts while pairing, described above.

Because it never leaves your two devices, none of this is data we collect, receive or could hand to anyone.

The apps send us no telemetry, no crash reports and no usage analytics. The Mac app talks to our servers for two things only: to activate and check its licence, as described under Payments and licences below, and to check for updates. By default it asks mellan.app about once a day whether a newer version exists and, if so, downloads it from static.wsky.dev (Amazon CloudFront). Those requests carry your IP address, and their user agent names the app and its version; Vercel and Amazon Web Services process them to deliver the update. You can turn automatic checks off in the app’s settings. (Art. 6(1)(f) — legitimate interest in keeping installed apps secure and working.)

This website

Legal basis in brackets, per Art. 6(1) GDPR.

• Hosting (Vercel Inc., USA). Serving this site creates server logs containing your IP address, user agent, requested page and timestamp. Used to deliver the site and keep it secure; deleted on Vercel’s rolling schedule. (Art. 6(1)(f) — legitimate interest in a working, secure website.)
• Analytics (Plausible, self-hosted by us at insights.wsky.dev).We run the analytics server ourselves, so no third party receives your data. Cookieless and privacy-first: no cookies, no cross-site tracking, no personal profiles. IP addresses are not stored; they are only used transiently to generate a daily, salted, non-reversible visitor hash. (Art. 6(1)(f) — legitimate interest in basic visitor statistics.)
• Bot protection (Vercel BotID). Runs on form submissions to block automated abuse, processing request headers and signals about your browser. (Art. 6(1)(f) — legitimate interest in preventing spam.)
• Waitlist (closed). Before sales opened, you could leave your email address to hear when Mellan became available. We keep those addresses, and when each was added, with Upstash (servers in the EU) only to send that one announcement. We use them for nothing else and never sell or share them, and we delete the list once the announcement has gone out, or sooner if you ask us to. (Art. 6(1)(a) — your consent, withdrawable at any time.)
• Fonts. Typefaces are served from this website’s own domain. No request goes to Google Fonts or any other font CDN, so no data is transmitted to a third party when a page loads.

Payments and licences

Our order process is conducted by Paddle.com, who act as Merchant of Record and as an independent controller for your payment data. We never receive your full card number. To issue your licence and handle refunds we read the purchase record from Paddle, which also contains limited payment details (the type of card, its last four digits, expiry date and cardholder name), the order amounts and references to your billing address. We use these only to check the purchase and do not store them. From your customer record we read your email address. See Paddle’s privacy notice.

• Your licence (Upstash, servers in the EU). We store your licence key, the email address and order reference it was bought with, and when it was bought. For each Mac that activates the key we store the identifier and the name the Mac app reports for it, when it was activated and when it last checked its licence. The identifier is a one-way hash of the Mac’s hardware ID, made for Mellan alone: it tells your Macs apart, but the hardware ID itself never leaves the Mac and cannot be recovered from it. When a Mac is removed we keep a record of the removal until a little over 30 days after the most recent one. We use this to deliver your key, to hold each licence to its Mac limit and to let you see and remove the Macs using it. We keep it for as long as the licence exists, or until you ask us to delete it. (Art. 6(1)(b) — performing our contract with you.)
• Licence emails (Amazon Simple Email Service, servers in the EU).Your key is emailed to you after purchase, and again if you request it on the licence page. Amazon Web Services processes your email address and the message to deliver it. (Art. 6(1)(b) — performing our contract with you.)

Download link emails

If you ask us to email you the download links, we send one email with the Mac and Android links through Amazon Simple Email Service (EU servers). We use your address only to send that message; this does not subscribe you to a mailing list. (Art. 6(1)(a) — your consent.)

Vercel BotID checks the submission to reduce automated abuse. To limit repeated sends, we keep SHA-256 hashes of the recipient address and visitor IP address in Upstash Redis, with counters that expire within 24 hours. These hashes can still be personal data. We do not add the address to our licence records or log it. (Art. 6(1)(f) — our legitimate interest in preventing spam and abuse.)

Your rights

Under the GDPR you can request access to your data, correction, deletion, restriction of processing, and data portability; you can object to processing based on legitimate interests; and you can withdraw consent at any time with future effect. Write to help@mellan.app — one person reads that inbox and will answer within 30 days. You also have the right to complain to a supervisory authority, for example the Bayerisches Landesamt für Datenschutzaufsicht.

Transfers outside the EU

Vercel, Paddle and Amazon Web Services may process data in the USA. Those transfers rely on the EU–US Data Privacy Framework and/or Standard Contractual Clauses.

Changes

We update this policy when the site or the product changes. The current version always lives at this address.