Licence, terms and privacy

airlift is a personal project, published as free software. This page says what you may do with the software, what using the hosted tower at projects.sujaykumar.dev/airlift means, and — because the tower is built to be ephemeral — exactly what it handles and for how long. Last updated 15 September 2026.

Licence

The software — the airlift binary, its source and this web UI — is released under the MIT Licence, copyright © 2026 Sujay Kumar. You may use, copy, modify, merge, publish, distribute, sublicense and sell copies of it, for any purpose, provided the copyright and permission notice stays with it. It comes without warranty of any kind. The full text is in LICENSE in the repository.

Running your own tower is entirely yours to do under that licence; the terms and privacy notes below apply only to the instance hosted here.

Terms of use

What it is. The hosted tower is run by the author, free of charge, as a convenience for moving files out of an air-gapped machine. It is provided as is: there is no guarantee of availability, capacity, speed or continuity, and it may be changed, paused or shut down at any time without notice.
What you may do. Create a session, share it, scan beams into it and download the results — for content you have the right to transfer and share. Do not use it for anything unlawful, to move content you are not entitled to, or in ways that harm other people or the service itself. Abusive traffic is rate-limited; a session admin or the operator may evict a participant or end a session.
Sessions are shared. Anyone who holds a public session's link, knows a password session's id and password, or is admitted to it by a session admin can see and download every beam in that session. You decide whom you share with; the tower cannot tell a guest from a friend.
Ephemeral by design. Nothing is meant to persist beyond a session. A session and everything in it is removed on the schedule described under Privacy; a restart of the tower only pauses it. Download what you need while the session lives; there is no recovery afterwards.
No liability. To the extent the law allows, the author is not liable for any loss — of data, time, or anything else — arising from using or being unable to use the service. If you need guarantees, run your own tower.
Questions. Open an issue at the GitHub repository.

Privacy

The short version: there are no accounts, so there is nothing about you to keep; what a session holds exists only for the session's short life and is then deleted; nothing is shared with anyone; no tracking of any kind.

No accounts, no login

You never sign up or sign in. A session's optional join password is kept only as a salted hash, for the life of that session — never in the clear, and never logged. The operator's own admin token is the operator's secret, not visitor data.

What a session holds while it lives

A random session id and token.
For each participating device: a random client id and a random resume key (the device's proof that it is that participant, never shown to anyone); a name — generated (like brave badger) or the one you typed; which roles the device is using (viewer, relay); and the network address it last connected from, used for rate limiting and eviction. Addresses are visible only to the operator's admin console, never to other participants.
Requests to send a beam directly from the command line: the requesting participant, the beam's name and size, and the session admin's decision — never an address.
The relayed QR frames from a scanner and the files reassembled from them, and the files sent directly by the command line (up to 5 GiB each), written under the tower's data directory so they can be verified and downloaded, plus a small session receipt. A download link is a random ticket, valid for 15 minutes and held only in memory.
So that a session survives a restart of the tower, all of the above except the download links is also written to the tower's own disk, in a file only the tower's account can read and deleted with the session: the token and every resume key only as one-way hashes, the password as its salted hash (and the token locked with it, so the password can still open the session), the participants with their names and addresses, and the session's requests and timers.

How long

A session lives while anyone is connected, up to 24 hours; a session admin can extend it an hour at a time.
If everyone leaves, it is suspended after 30 minutes and deleted an hour after that (reopening the link within the hour brings it back, timers reset).
End session keeps the downloads for an hour, then removes them. Delete now removes the session and its files immediately.
A restart of the tower does not delete a session or reset its timers: it carries on where it was. Rate-limit counters live in memory and expire on their own.

On your device

The dashboard keeps each session it has opened — the session's id, token, your participant id and name, and a random resume key that proves this device is that participant — in the browser's localStorage, so a reload or a re-scanned link is still you. The scanner keeps the same identity and the last session it joined, so its home-screen shortcut can reopen it. Nothing there identifies you or the device beyond the session. No cookies are set. Clearing the site's data removes it all; the tower forgets the session on its own schedule regardless. The command-line airlift beam --to-session keeps nothing on disk: its participant identity lives only for the run, and it never prints the session's token or a password.

The camera

The scanner reads QR codes on the phone itself; only the decoded text of each frame is sent to the tower. No video or images ever leave the device. The beam page shown on the air-gapped machine is a fully offline file and contacts nothing.

Logs, analytics, third parties

The tower's log records session-level events — a session created, reopened, ended; a beam ready or failed; an eviction — by session id. It never records tokens, passwords, addresses or file contents. The TLS proxy in front of it keeps no access log.
No analytics, no tracking pixels, no advertising. Every script, style, font and image is served by the tower itself; nothing loads from third-party servers.
Session contents are not shared with anyone. The operator can, in principle, see a live session's files on the server and its participants' addresses through the admin console; they are not looked at in the ordinary course of things and are gone with the session.

Your rights

Because nothing is retained beyond a session, deletion is in your hands: Delete now as a session admin, or simply let the session expire. For anything else, open an issue at the GitHub repository.