Privacy policy
Your phone talks to your screen. Your saved connections stay on your device.
Last updated 9 October 2026
- No ob.Pal account needed. Pairing, viewing and controlling need no sign-up. Optional support providers have their own account requirements.
- No analytics or tracking in ob.Pal's own code. ob.Pal adds no ad or analytics scripts or tracking cookies. Optional Ko-fi and payment-provider content follows their own policies.
- Direct and encrypted. Controller input and typing go from your phone to your screen over an encrypted connection and are never stored.
- Your files stay yours. Models you open are read in your browser and never uploaded.
This policy covers ob.Pal at obpal.blackboxes.net: the website, the phone controller that opens in your phone's browser, the 3D viewer, the ob.Pal Link browser extension, and the ob.Pal Desktop helper for Windows.
Pairing and the connection
The QR code holds a one-time pairing secret. It sits in the part of the link that browsers never send to a server, so it stays on your two devices. The ob.Pal signaling service only sees a room identifier derived from it.
To connect, both devices briefly join that room on the signaling service, which runs on Cloudflare. They swap the technical details a WebRTC connection needs, including network addresses. The service passes these messages between the two devices in memory and doesn't store or log them.
After that, your phone and your screen talk over an encrypted WebRTC connection: directly on your own network when they can, otherwise directly over the internet. Only when neither works is it relayed through a TURN server, Cloudflare's. The relay sees the two devices' network addresses and when they're connected, as any relay must, but not what they send: that's encrypted end to end between your phone and your screen, and never stored.
The service keeps no request logs of its own. It logs only its own errors, never with a network address, a code, a secret or a room in them. To stop abuse, it counts how often a network address connects or tries a short code, in memory for a few minutes at most. A short code is kept with the address of the screen showing it while the code is live, ten minutes at most, so no one address can hold too many. Cloudflare, which hosts ob.Pal, handles network details such as IP addresses to deliver and protect the site, under its own privacy policy. None of this holds what your devices send each other.
Share links
Pairing leaves nothing behind on the service, but sharing a scene does. When you turn on a watch or play link in a sim or the Viewer, the signaling service keeps a small record for that room: values derived from the link keys (never the keys themselves), a check value for the screen's owner, and the link's target (which sim, and the screen's certificate fingerprint), encrypted with a key that only the link holds. It holds no name, no network address and nothing your devices send each other. A watch link stops working after an hour with nobody connected, and stopping sharing or making a new link clears that link's values and target. The record itself is not deleted on a timer: today it is kept indefinitely, and there is no automatic deletion yet.
The ob.Pal Link extension
- Only the tab you switch on. It sends your phone's input into the tab you turned on with This tab, and nowhere else. With All sites turned on, a small bridge also loads in other tabs so control can follow the page as it navigates, but it stays idle there.
- Doesn't read your browsing. It doesn't read page content, your browsing history or what you type on the computer. Its only job is to turn your phone's input into input on the controlled page or, with ob.Pal Desktop, on your PC.
- Addresses stay in the browser. The popup shows which site the current tab is on. The extension also checks the sites in the controlled tab against a built-in list, to suggest control settings to your phone (flight controls for a flight game, say). The phone gets the suggestion, never the address.
- Local storage only. It remembers the mode you picked (Controller, 3D, Keys or PC), the look of its pages, and your answer for each phone that asked to control your PC (the phone's name, and allowed or not). Until the browser closes, it also keeps which tab is controlled, whether your phone is connected and, for PC, what ob.Pal Desktop reports (the program in front and your allowed programs). All of this stays in the browser.
- Typing passes straight through. What you type on the phone's keyboard goes over the encrypted connection to the extension and on to ob.Pal Desktop, which types it. Neither keeps it. For a password field, the phone uses a password field too, so nothing is suggested, learned or kept.
- Remembered phones stay on your devices. After you pair a phone online, the extension and the phone each keep a pairing key and the other device's connection certificate fingerprint (the extension also keeps the phone's name and when you paired it), so the phone can connect directly over your local network when the internet is down. None of it leaves the device, and you can forget a phone in the popup or in the phone's settings.
- Talks only to ob.Pal and your phone. Its only network use is the ob.Pal service (for pairing and relay credentials) and the connection to your phone. For PC, it also talks to ob.Pal Desktop, on the same computer. It loads no remote code and has no analytics.
- The connection seal stays between your devices. The three symbols Link and your phone show are worked out on each device from the encrypted connection itself. They're a way to check you paired the right phone. They aren't sent anywhere, and Link keeps them only with the connection status, until the browser closes.
| Permission | Why |
|---|---|
| Offscreen document | Keeps the connection to your phone open (extension service workers can't hold one). |
| Storage | Remembers your chosen mode and your answer for each phone that asked to control your PC and, until the browser closes, the controlled tab and the connection status. |
| Active tab, scripting | When you click the extension on a page, it can control that page, and only that page. |
| obpal.blackboxes.net | Pairing and relay credentials. On ob.Pal's Desktop install page only, it tells the page whether ob.Pal Desktop is connected and its version, nothing else. |
| All sites (optional, off by default) | Only if you turn it on: reaches game frames served from other domains and keeps control across navigation. You can turn it off again in the popup. |
| Native messaging (optional, off by default) | Only if you pick the PC target, or turn on PC control in its options: talks to ob.Pal Desktop on your computer. |
| Notifications (optional, off by default) | Only if you turn on Notify me in its options: when a phone asks to control your PC while the popup is closed, a notification asks you, with Allow and Deny. It shows nothing else. |
The ob.Pal Desktop helper
ob.Pal Desktop is an optional Windows program that lets your phone move the mouse, click, scroll and type on your PC. The extension talks to it on your computer only; it has no network access of its own. It does nothing until you pick PC. With Whole PC on, your phone's input goes to whichever window is in front, the browser included; otherwise only to the programs you have allowed, one by one, while they are in front. It can't reach programs running as administrator, and Ctrl+Alt+Backspace stops it at once.
So that your phone can offer its keyboard when you click into a text field, the helper checks about four times a second whether the control with the keyboard focus is a text or password field. It reads only what kind of control it is, never what's in it. Text you type on the phone is typed, not kept.
Your allowed programs, the Whole PC setting and a short activity log (start and stop times and counts, never what was typed) are kept in your Windows profile (%APPDATA%\obpal). You can remove programs in the extension's options, and its uninstall.cmd removes all of it.
The viewer and your files
Models you open, drop in or add from a connected folder are read and displayed in your browser and never uploaded. When you connect a folder, the browser remembers your permission on this device until you disconnect the folder.
What's stored on your device
Your theme is kept in a bb_theme cookie that all Blackboxes sites share, so every site opens in the same look. Your accent, viewer and remote preferences, and your last scene stay in your browser's local storage. None of this is used for tracking, and clearing your browser data removes it.
On your phone, the controller keeps the screens you've connected to, so you can switch between them. For each one it keeps the screen's name, your name for it, when you last used it, and a reconnect key your browser can't export. All of it stays on the phone until you forget the connection or clear your browser data. The in-app scanner uses the camera only while it's open. It reads the frames on the phone and never sends or keeps them.
Hand and Body camera tracking also process frames on the capturing device and never send or store the images. Phone capture sends landmark coordinates to your paired screen over the encrypted connection. The optional webcam in the Viewer and sims keeps both images and landmarks on that computer, in memory only. It starts only when you tap Body camera and stops when you close it, leave the tab or hide the page. It does not remember an enabled state. Only the tracking models and their runtime files may be cached for reuse. The humanoid sim can remember your derived joint ranges and segment lengths on this device, separately for each paired device. It never saves calibration images or landmarks; Reset calibration removes those measurements.
Sponsoring and donations
Optional support uses Ko-fi. The support pages load Ko-fi content only when you choose Open payment options, or follow the hosted Ko-fi link. Ko-fi and the connected PayPal or Stripe provider receive connection information and any details you enter, under their own privacy policies. Payment details are entered in their content, not in ob.Pal card fields. Authentication or payment completion may open another page.
Historical settled Stripe contributions remain in the shared BlackBoxes ledger. These records include the amount, time, provider receipt and supporter identifiers, and a donor label determined by the receipt metadata. Ko-fi payments are not imported into this ledger. A loaded panel or return link does not confirm a payment.
Who else is involved
Services involved include:
- Cloudflare: hosting, signaling, relays, and email to the address below.
- Ko-fi: optional support content, loaded on request.
- PayPal and Stripe: payment handling. Historical Stripe settlement records are retained as described above.
ob.Pal doesn't sell data or use these records for advertising. Optional external services handle data under their own policies.
Changes and contact
If this policy changes, this page and its date will be updated. For questions or requests, email hello@obpal.blackboxes.net.