Privacy Policy

Last updated: 21 May 2026

The short version

Toss has no servers, no accounts, and no analytics. We don't see your files, your contacts, or your usage. The app talks directly between your own devices over your own Wi-Fi.

Who we are

Toss is published by AZAI Corp., a Canadian company based in British Columbia. Contact: asoni@kancanada.com.

What Toss does NOT collect

• We don't collect file names, contents, or any metadata about what you transfer.
• We don't collect device IDs, advertising IDs, or location.
• We don't use analytics, crash reporting, or any third-party SDK that phones home.
• We don't run servers. There is no AZAI Corp. database that could hold your data, because no such database exists.

What stays on your device

• A locally-generated cryptographic identity (a key pair) so that other devices can verify it's you. The private key never leaves your device.
• The list of files you have recently received, so the Toss app can show a "Recent" list. Stored only on your phone.
• App settings (your device name, preferences). Stored only on your device.

Nothing in the list above is transmitted to AZAI Corp. or any third party.

What travels between your devices

When you send a file with Toss, the file itself, its name, and its size are sent directly to the receiving device over your local Wi-Fi network, end-to-end encrypted with XChaCha20-Poly1305. We are not in the path. Your internet service provider sees encrypted traffic on your LAN; we see nothing.

Permissions Toss asks for

• Local network access — to discover and connect to nearby devices running Toss.
• Notifications — to tell you when a file lands.
• Media access (Android) — only used when you opt in to the USB-stick browse mode, so the Mac can read your phone's public folders.
• Storage (Android) — to save received files to Downloads / Gallery.

Each permission can be revoked in your system settings.

Payments

Toss has a free tier for transfers up to 1 GB. Larger transfers require a one-time $29 unlock, purchased through Google Play Billing. AZAI Corp. never sees your credit card number. Google's privacy policy applies to that transaction; we receive only a receipt confirming you've paid.

Children

Toss is not directed to children under 13. Because we collect nothing, we do not knowingly collect data from children.

Changes

If this policy changes, the "Last updated" date above will change with it. Material changes will be flagged in the app's release notes.

Your rights

Under PIPEDA (Canada), GDPR (EU/EEA), and similar laws elsewhere, you have the right to access, correct, or delete personal data we hold about you. We do not hold any personal data about you. If you want to verify that, email asoni@kancanada.com and we will confirm in writing.