PanePrivacy Policy
The short version: Pane has no account and no server of its own, unless you choose Pane Relay. Your Macs, settings and passwords stay on your device. The app connects directly to your computers. The only data that leaves your device is anonymous usage analytics, and you can see exactly what that includes below.
Who we are
Pane is made by Understudios (Jan Jiráň), Czech Republic. If you have any question about this policy, write to jan.jiran@understudios.org.
No account
Pane does not ask you to sign up or sign in. We do not know who you are, and we have no user database.
What stays on your device
- Saved Macs and settings. The names, addresses, ports, Tailscale addresses, MAC addresses for Wake-on-LAN and per-Mac settings (Quality, Displays, Shared clipboard, Lock Mac on disconnect) are stored only on your iPhone or iPad.
- Usernames and passwords. When Save to Keychain is on, the login for a Mac is stored only in the device Keychain. The password is additionally protected by Face ID or Touch ID: Pane can read it only after you authenticate, there is no passcode fallback, and if your Face ID or Touch ID enrolment changes, iOS invalidates the saved password and Pane asks you to sign in again. With Save to Keychain off, the login is kept in memory for that one connection and discarded afterwards. Credentials never leave the device and are never included in analytics.
- Screen content. What you see on the remote screen is never stored, with one exception: Pane keeps a last-frame thumbnail of each Mac so you recognise it on the home screen. That thumbnail is kept on the device only, excluded from iCloud backup, and deleted when you forget the Mac. A screenshot you take from the iPad session panel is handed to the iOS share sheet and goes only where you send it.
- Clipboard. With Shared clipboard on, text you copy on the iPhone or iPad is sent to the Mac you are connected to, and text copied on the Mac is placed on your device’s clipboard. It travels only inside that VNC session and never to us.
Direct connections by default
Pane connects directly from your device to your Mac using VNC (the protocol behind macOS Screen Sharing), over your local network, a VPN such as Tailscale, or any address you provide. Unless you pair a Mac with Pane Relay (next section), there is no Understudios relay, proxy or cloud service in between, and your session traffic is exchanged only between your device and your Mac.
Pane Relay (optional, paid)
Pane Relay is a separate app for the Mac. When you pair a Mac with it, sessions that cannot reach the Mac directly go through a relay service run by Understudios on Cloudflare’s network (Cloudflare, Inc., servers in the EU and worldwide, chosen by proximity).
- What the relay handles. The relay forwards the session between your device and your Mac. It does not store the session: no screen content, keystrokes, clipboard or passwords are kept. Inside the relay the VNC stream is handled as it is on your own network, where Screen Sharing encrypts your login and not the screen. Both connections to the relay use TLS.
- What the relay keeps. For each paired Mac: a random id, hashed access tokens, the names of paired devices (the device name you gave your iPhone or iPad) and when they paired, the trial end date and the status of the license. Cloudflare’s request logs hold IP addresses and timestamps for a limited time, as for any website.
- Purchases. License keys are sold by Polar (Polar Software Inc.), our merchant of record. Polar handles your email address, payment and receipts under its own privacy policy. We receive the license key and its status, not your payment details.
- Deleting. Unpairing a device in Pane or in Pane Relay removes it from the relay. Removing Pane Relay from the Mac (and its data in Application Support) abandons the host record, which is deleted after a period of inactivity.
What is encrypted on the wire. Pane talks VNC directly to your Mac. Your login is encrypted; the screen, keystrokes and clipboard are not, so use it on your own Wi-Fi or over Tailscale or a VPN when away.
Analytics
To understand which features are used and where connections fail, Pane sends anonymous usage events to PostHog, hosted on servers in the European Union (Frankfurt, Germany). Analytics is off entirely in development builds.
You can turn usage analytics off in the app under About (Home › sliders button). Events already sent are not affected; nothing is sent after the switch is off.
The events Pane sends:
- App opened
- Mac added or forgotten (how it was added: nearby, typed in, link)
- Connection attempted, succeeded or failed (network type LAN / remote, authentication type, a generic error category, latency and time-to-first-frame in coarse buckets, encoding, number of displays)
- Session ended (length in coarse buckets, Trackpad or Touch mode)
- Feature used (for example a modifier key, display switched, Quality changed, Shared clipboard, Wake-on-LAN, hardware keyboard)
Every event also carries these properties, added automatically by the PostHog SDK (posthog-react-native):
- App name, bundle identifier, version and build number
- OS name and version (for example iOS 26.0), device manufacturer and model (for example iPhone 17 Pro), device type (Mobile), whether it runs in a simulator
- Language and region (locale) and time zone
- Screen width and height in points
- SDK name and version, a timestamp, a random session identifier (a new one after 30 minutes of inactivity) and a random installation identifier
What we never collect:
- Hostnames, IP addresses, Tailscale addresses or MAC addresses of your computers
- Usernames or passwords
- Screen content, keystrokes or clipboard content
- The link that opened the app. The SDK’s automatic lifecycle events (“Application Opened” and the like) are turned off, because they would include the launch URL, and a
vnc://link can contain a hostname, user name or password. Pane sends a bare “app opened” event instead. - Your location. Location is never requested for analytics, and PostHog’s GeoIP lookup is disabled for every event.
There is no session replay, no screen recording, no autocapture of taps or screens, and no crash reporting. Your device’s IP address is discarded at ingestion (PostHog’s anonymize IPs project setting is on) and is not stored with events. Events are identified only by a random installation identifier that is not linked to you, has no person profile behind it, and is reset when you delete and reinstall the app. When it starts, the app also fetches its remote configuration (feature flags) from PostHog; that request carries the same random identifier and nothing else. We do not use advertising identifiers, we show no advertising, and we never sell data. Analytics data is retained for 12 months and then deleted.
Permissions Pane asks for
| Permission | Why |
|---|---|
| Local Network | Required to connect to Macs on your Wi-Fi and to discover them. Without it, Pane can only reach Macs over Tailscale or another VPN. |
| Bonjour | Used to find Macs that advertise Screen Sharing (_rfb._tcp) on the local network so you can add them by name. |
| Location (while using) | iOS requires location access to reveal the name of the Wi-Fi network you are on. Pane uses it only to show that name above Macs on this network. Your location is never stored and never sent anywhere. |
| Face ID / Touch ID | Unlocks the password stored in the Keychain. Biometric data never leaves the Secure Enclave and is not available to Pane. |
| Paste from Other Apps | iOS asks before an app reads text you copied elsewhere. Pane reads the clipboard only while Shared clipboard is on in a session, or when you tap the paste button on the New connection screen. The text goes to your Mac, never to us. |
You can change any of these at any time in Settings › Apps › Pane, or under Settings › Privacy & Security.
Children
Pane is not directed at children under 13, and we do not knowingly collect any data from them.
Changes to this policy
If this policy changes, the new version will be published at this address with an updated effective date. Material changes will also be noted in the app’s release notes.
Contact
Understudios · Jan Jiráň · Czech Republic
jan.jiran@understudios.org