Beam – Privacy Policy

1. How Beam Works

Beam is an app for macOS, Windows, iOS and Android that moves photos, videos, documents and text between devices on the same Wi-Fi or local network. The apps find each other on that network and the sending device connects straight to the receiving one. Beam does not use the internet to send a file, and there is no RiekApps server in the middle.

There is no Beam account and no sign-up.

2. What Your Network Can See

So that your devices can find each other, each running copy of Beam announces itself on the local network every few seconds, by UDP broadcast and by Bonjour (mDNS). The announcement contains:

• the device name shown in Beam (by default your device’s own name, which you can change in Beam’s Settings),
• the kind of device (Mac, Windows, iPhone, Android),
• a random device ID created when Beam was first opened, a short fingerprint of the device’s public key (see section 5), and the network port Beam listens on.

Anyone else on the same local network can see these announcements. On a shared network such as a café, office or hotel, choose a device name you are comfortable showing there.

3. Transfers

When you send, the receiving device is told the names, sizes and types of the files and any text you are sending, together with the name of the sending device, so it can show you what is arriving. The file bytes then go directly from one device to the other.

Before anything is sent, both devices prove which device they are by signing a fresh challenge with their own keys, and the sending device checks that the device answering is the one you chose. Every file is checked against a SHA-256 hash before it is saved; a file that fails the check is discarded.

Everything after that first exchange — the file names, any text, and the files themselves — is encrypted in transit with AES-256-GCM, using keys the two devices agree for that one transfer and then discard. Others on the same network can see that two devices are exchanging data, and roughly how much, but not what. The device names and key fingerprints used for discovery (section 2) are not encrypted, because they are how your devices find each other.

4. What Is Stored On Your Device

Beam keeps the following in its own app storage on each device:

• Your settings: the device name, the folder received files are saved to, whether to accept from everyone, and (on Windows) whether Beam starts with Windows.
• The devices you chose to trust: their names and key fingerprints.
• A list of your most recent transfers (up to 50): the file or text name, the other device’s name, the time, and where a received file was saved. The files themselves are not copied into this list.
• Parts of files from interrupted transfers, so that sending again can resume. These are deleted when the transfer completes, or after seven days.
• On Windows, a small log file (beam.log) with the times Beam started, the port it used, its firewall status and the text of error messages it showed you, which can include a file name. It never contains file contents and is never sent anywhere.

Files you receive are saved to the folder you chose (Downloads by default). On a Mac and on Windows they are marked as having come from another computer, as a browser does with downloads, so the system can check a received program before it runs.

5. Device Keys And Trust

Each copy of Beam creates its own signing key on the device the first time it runs. The private key is kept in the platform’s protected storage — the Keychain on Apple devices, the Android Keystore on Android, and a file protected by Windows’ data protection (DPAPI) on Windows — and it never leaves the device. Only the public key is shared, with the device you send to. “Always accept from this device” remembers that public key’s fingerprint, locally.

6. Permissions

• Local network (all platforms): to find your other devices and send to them.
• Notifications (Android, Mac, Windows): to tell you when a file arrives or a device asks to send.
• Photos and files: Beam reads only the items you pick or share to it, through the system picker or share sheet, and writes received files to your chosen folder.
• Windows Firewall: if Windows is blocking other devices from reaching Beam, Beam offers to add a single inbound rule for itself. This asks for administrator approval once and changes nothing else.

7. The Website And Downloads

Beam for iPhone comes from the App Store and Beam for Android from Google Play; Apple and Google handle those downloads under their own privacy policies, and RiekApps receives no personal information from them. Beam for Mac and Windows is downloaded from beam.riekapps.com. Like any website, our hosting provider sees the connecting IP address in server logs, which are kept briefly for operational purposes. The site uses no cookies, analytics or trackers.

8. What RiekApps Never Collects

• Your name, email, contacts, or any account information.
• The files, text, file names or device names you send or receive.
• Usage analytics, crash reports, location or advertising identifiers.

9. Your Choices

You can rename your device, forget any trusted device, clear the recent list and turn off accepting from everyone in Beam’s Settings. Quitting Beam stops it announcing itself; uninstalling it removes the app and its stored data.

10. Children

Beam is not directed at children under 13 and collects no personal information from anyone.

11. Changes

If this policy changes, the new version will be published at this address with an updated effective date.

12. Contact

Questions about privacy in Beam: riekapps@gmail.com. Website: beam.riekapps.com.