Most sync features ask you to make an account, verify an email, and trust that whatever runs on the other end is well behaved. Droppy Sync asks you to hold your phone up to your Mac. That is not a design flourish. It is the mechanism, and once you see why, the rest of the privacy story falls into place.
Why a code, and not an account
An account-based sync needs the server to know who you are, which means the server is the place where your devices meet. That is fine for a service that wants to read the data. It is the wrong shape for a clipboard, a shelf of files and a notes list, which are exactly the things you would rather nobody else could read.
Droppy inverts it. Your Mac generates the root key and keeps it in its Keychain. When you choose Pair iPhone, the Mac writes that key into the pairing code along with what the phone needs to find the library. The phone scans it, keeps the key in its own secure storage, and from then on both devices can derive the same per-record keys without ever asking anyone for them. The code is single use. If someone photographs your screen after you scanned it, the code has already expired.
The five steps, in order
Open Droppy on your Mac. It lives in the menu bar and in the notch. Open Settings from either.
Settings, General, Droppy Sync. Create a Sync Library if you have not already. This is the moment the Mac makes the root key.
Choose Pair iPhone. Your Mac shows a QR code, with the link written under it in case the camera is inconvenient.
Scan it, or paste it. Install Droppy for iPhone from TestFlight, point it at the code, or paste the link. Camera is the only permission it asks for.
Confirm on the phone. Nothing joins your library without this tap. Once you approve, the first sync starts and the code expires.
About a minute, start to finish. The slowest part is usually installing TestFlight.
What sealed on the device means
Every clipboard entry, file, OCR grab, note and cloud link that syncs is encrypted on the device that produced it before it is uploaded. The key used for that record is derived from the root your Mac made, so the phone can derive the same key and open it. The server holds ciphertext and the metadata it needs to move it around. It cannot read the text you copied, cannot open the file, and cannot see the note.
Two consequences follow. First, I cannot read your library either, which is the point. Second, if you lose every device that holds the root key, the library is unrecoverable by design. Your devices are the vault, and the Your devices store in the app is where you manage them. You can revoke a phone, rotate its credential, or leave the library entirely from there.
| Thing | Where it lives | Who can read it |
|---|---|---|
| Root key | Mac Keychain, and the phone's secure storage after pairing | Your devices only |
| Pairing code | On screen for one scan, then expired | Whoever scans it first, which should be you |
| Synced records | Sealed on the device, stored as ciphertext | Your paired devices |
| Droppy Cloud share links | Normal HTTPS links, a separate path from sync | Anyone you send the link to |
Droppy Cloud is a different path, on purpose
It would be easy to read end to end encrypted and assume everything Droppy touches works that way. It does not, and the exception is deliberate. Droppy Cloud exists to hand a link to someone who does not have Droppy. A link that only your paired devices could open would be useless for that. So a share link is a normal HTTPS link, the files behind it expire after three days, and the app says so on the iPhone page rather than blurring the two together. The cloud links store in the app is a list of those links, with a copy button and a real delete, and the list itself syncs sealed like everything else.
How fast is it, and what does it cost the battery
The first sync publishes in batches, so an interrupted one keeps its progress instead of starting over. After that, changes on either end arrive on the next pass. Since Droppy 15.2 beta 1 and iPhone app 2.0, there are also live encrypted updates and a direct connection on your local network, so a change made on the Mac shows on the phone without waiting for the next poll when both are on the same Wi-Fi.
The phone's own clipboard is only read when you tap Paste. That is an iOS rule and a Droppy rule at the same time: the app does not sit in the background reading whatever you copy on the phone. Everything that reaches the Mac from the phone is something you handed over on purpose, through Paste, the share sheet, or a Siri phrase.
When the license lapses
Sync needs an active Droppy license on the Mac you pair with. It is the same one-time license that covers two Macs, and there is no separate subscription for the phone. If the license lapses, the pairing survives and Droppy tells you, rather than quietly unpairing the phone and making you scan a code again later. The case against subscription creep applies here as much as anywhere in Droppy.