CrocApp

Privacy

CrocApp has no accounts, no analytics and no tracking. The developer receives no data from the app. This page lists every server the app can talk to and what each one can see.

Applies to CrocApp 1.0. Last updated 15 October 2026.

The short version

There is nothing to sign up for. CrocApp has no analytics, no telemetry, no advertising and no crash-reporting service. The developer runs no server that the app talks to, so there is nowhere for your data to go. The App Store privacy answer is Data Not Collected.

A transfer still needs the internet, and the servers it uses belong to other people. They are listed below, with what each one can see. Files are encrypted on your device before they leave it, so no server sees file contents. The relays and the direct connection servers never see your code phrase. The one exception is the optional browser link, described under getcroc.com below.

Servers CrocApp can contact

All of these are run by someone other than CrocApp. CrocApp cannot see or control what their operators log, so the lists below are what each server can observe by design, not a promise about what it keeps.

croc public relays

When: every transfer with a code phrase, unless you set your own relay or turn on Local network only. The relays are four servers, 1.getcroc.com to 4.getcroc.com (port 9009), run by the croc project. The code phrase decides which of the four both devices use.

What it can see: the IP addresses of both devices, when they connect, how long the transfer takes, and how much data moves. It also sees a room name, which is a hash made from the first word of the code phrase. Everything else is ciphertext: it never sees file contents or the code phrase, and it does not store the files.

getcroc.com, stored transfers

When: only when you use Send as link, or open or revoke such a link. The server is set in Settings and defaults to https://getcroc.com, run by croc's author. A link received from someone else points at the server named in that link.

What it can see: the encrypted files, their size, the lifetime and download count you chose, and the usual details of any web request, such as your IP address and the time. The decryption key sits in the part of the link after the #, which CrocApp and browsers never send to the server, so it cannot read the file contents. CrocApp has not verified whether the server can read file names, so do not rely on names being hidden.

How long it keeps files: you choose how long the link lasts (1 hour, 1 day, which is the default, or 7 days) and how many downloads it allows (1 to 100). Revoking a link asks the server to delete the upload. The server decides what it actually keeps and for how long, and may cap the lifetime. That is set by getcroc.com, not by CrocApp, and CrocApp has not checked it beyond the lifetime it requests. Anyone who has the whole link can download the files until it ends.

getcroc.com, the browser client

When: only if you press Receive in your browser on a crocapp.dev/r/ link page, or open a link to getcroc.com yourself. The button opens https://getcroc.com/?code=<code>. That is croc's own web app, not run by CrocApp.

What it can see: because the code is in a query string there, it reaches the getcroc.com server, which therefore sees the code phrase along with your IP address and the time. getcroc.com also serves the JavaScript that decrypts the file, so this path trusts that site fully. That site's own pages also load third-party analytics and advertising scripts (Umami and Google AdSense when last checked, 2026-10-15), which CrocApp does not control. The CrocApp and croc command line paths have no such dependency. The crocapp.dev/r/ page itself keeps the code after the #, makes no network request and sends no referrer.

Tailcat and DERP servers

When: the Connection setting is Automatic by default. With it, a send of 128 MiB or more also tries a direct device-to-device connection set up through tailcat.dev, with relay servers under ipn.dev when the devices cannot reach each other directly. Whichever path connects first carries the transfer. A receive follows the sender's choice, so receiving a large file from a sender on Automatic, or from the croc command line with its default, can use them too. Choose Relay only in Settings and your sends never contact these servers. Smaller transfers do not contact them at all.

What they can see: the IP addresses of both devices, when they connect, and the size and timing of encrypted packets. The data stays end-to-end encrypted on this path too, so they never see file contents or the code phrase. These servers are not run by CrocApp.

github.com, update checks (Mac direct build only)

When: the Mac disk image downloaded from GitHub includes the Sparkle updater. It reads an update list (appcast.xml) published with this project's GitHub releases when you choose Check for Updates, and after you allow automatic checks when Sparkle asks. If you install an update, it downloads from GitHub too. Sparkle's system profiling is switched off, so the request adds no hardware or system details.

What it can see: GitHub sees the usual details of any web request, such as your IP address and the time. The iPhone, iPad and Mac App Store builds contain no updater and make no such request.

Servers you choose

You can point CrocApp at your own croc relay, your own stored-transfer server, and a SOCKS5 or HTTP proxy under Advanced settings. Those servers see what the matching public server above would see, and their operator decides what they keep. Use only servers you trust.

On your device

Camera. On iPhone and iPad, the camera is used only to scan a QR code when you open the scanner. CrocApp reads the code on the device and stores nothing: no photo and no video are saved or sent anywhere.

Keychain. A custom relay password, proxy credentials and the receipts for your stored uploads (which hold the upload token and the link) are kept in the iOS or macOS Keychain, not in plain settings. A stored-upload receipt is removed when you revoke the link and at the first launch after it expires.

History. Transfer history stays on your device. There is no sync and no export. It records file names (up to 20 per transfer), counts, sizes, dates, status and a short hint of the code phrase (its first word, or only its first two characters for most custom codes), never file contents or the full phrase. For a stored upload it keeps the server's host name, not the link or the upload token. Clear it any time from the history screen.

Local network. To find a nearby device and transfer directly, the two devices look for each other with multicast messages on your local network. That traffic stays on the local network and reaches no server. iOS asks your permission first. Turn on Local network only to use nothing else.

This website

crocapp.dev is hosted on GitHub Pages, so GitHub sees ordinary web server details for each page you load. The pages set no cookies and use no analytics. The home page asks api.github.com for the project's star count, which tells GitHub your IP address and that you loaded the page, and caches the number in your browser's local storage, refreshing it after six hours. This page and the support page load only their own files from crocapp.dev.

Apple

Apple runs the App Store and the operating system. If you share analytics with app developers in your device settings, Apple may pass the developer aggregate reports about the app. CrocApp itself adds nothing to them.

Questions and changes

Ask on the support page. CrocApp is open source, so you can check any claim above in the repository (opens in a new tab), and the security and privacy guide covers the same ground in the documentation. If this page changes, the date at the top changes with it.