Privacy
What the apps do and do not do with your data.
Experimental project, not security-audited. WFAS is a personal project by an engineering student. Its security features have not had any formal audit, so please do not rely on them for sensitive data or on untrusted networks. Read the full disclaimer
Data Collection and Telemetry
WFAS does not collect, store, or transmit any personal data.
There are no analytics trackers, no crash reporting tools, and no "phoning home". The application does not include any third-party advertising SDKs. The only external request the Desktop app makes is a standard HTTPS call to the GitHub API to check for new releases.
QR Code Invites and Pairing
When generating an invite via QR code, the pairing key is transmitted via a URL fragment (the part after the # symbol). By web standards, browsers do not include the fragment in HTTP requests, so the key should not reach the server hosting the invite page. This does not protect against everything: the invite link can still be exposed through browser history, extensions, screenshots or the messaging app you use to share it. Invites expire after 120 seconds.
Audio Routing
Your audio data is transmitted strictly over your Local Area Network (LAN) directly between the devices you pair. It never passes through a cloud server or an external relay. If you enable encryption, the stream is encrypted with ChaCha20-Poly1305 (an experimental implementation that has not been audited; see the security page).
Android Permissions Explained
Due to Android's security model, capturing system audio requires sensitive permissions. Here is why WFAS requests them:
Screen Recording / Media Projection
Required on Android 10+ to capture the internal audio of other apps (like Spotify or games). WFAS does not record your screen or camera. It only instructs the Android MediaProjection API to extract the audio stream.
Microphone
Requested only if you choose to use your phone as a wireless microphone. The microphone is never accessed in the background without the foreground service notification visible.
Because the project is open source, you can check these statements in the source code on GitHub.