Is AirDroid safe to use, and what does it send through its servers?

We are not going to answer "safe" or "unsafe" for you, because we have not audited AirDroid and a verdict would be a guess. What we can do is set out what its maker, Sand Studio of Singapore, says on its own pages: what it collects, what goes through its servers when you use it away from home, which permissions its features ask for, and what the public vulnerability database lists. Then you can judge it against what you plan to do with it. The short version is that on your own Wi-Fi it works differently from how it does in remote mode, and that is where the questions sit.

Publisher note: The Relay publishes this guide and is one of the products discussed. Details about other products come from each maker's own pages, checked on 2 October 2026. Prices and features change, so confirm before you buy.

Who makes AirDroid, and which accounts are involved?

The footer of AirDroid's pages says it is developed by Sand Studio, Singapore. Its privacy policy names the company as Sand Studio Pte. Ltd.

You need an AirDroid account for most things. The product page lists setup as installing it on both devices, then "Sign up and log in to the same account on PC/web and mobile". The privacy policy says account set-up collects a username, a password, an email address and an IP address. AirDroid's user guide also describes using it without an account in two ways: "Lite Mode", by visiting the address the phone app shows on your network, or by scanning a QR code from web.airdroid.com. Its Google Play listing says that without an account you can use it on the same Wi-Fi "with limited features".

What does AirDroid say it collects?

The privacy policy page carries two versions. One says "last changed on 21 July 2023". The other says "Effective Date: 29 December 2025", and that is the one summarised here. For the Services, it lists:

• Account data: username, password, email address, IP address.
• Usage data: login timestamps, IP address, coarse location (country, region and city derived from IP), account settings and preferences, and device information including device model and identifiers such as IMEI, IMSI, MAC address, Android ID, operating system version, language, CPU model, memory and storage use.
• "Tap" behaviour: which buttons you tap, such as File Transferring or Backup, for statistics and improvement.
• Transactions: order identifiers and invoicing details, and limited payment method information from its payment providers. The policy says it does not receive or store full card numbers.
• Device location only when you use Find Phone on web.airdroid.com.

On sharing, it says it does not sell, lease, rent or give away personal data, and then lists exceptions: group companies, contractors and service providers (the policy names database providers, advertising agencies and customer relation management providers as examples), sale or reorganisation of the business, legal requests, and consent. It says it stores data on "cloud servers located across the world". It names dpo@airdroid.com for requests and says you can delete your account yourself at web.airdroid.com.

What goes through its servers?

AirDroid has two connection modes, described in its user guide. Local Connection Mode is when the phone and the computer are on the same Wi-Fi. Remote Connection Mode is when they are on different networks. The pricing page's FAQ answers "Can I trust AirDroid Personal? How safe is it?" this way: "in Remote Connection Mode, your account credentials, SMS, contacts, call logs and other private information are all securely transmitted via HTTPS and we never store them (except your AirDroid account information, the latest location of your Android device if the Find Phone feature is activated) without your explicit consent." It adds that data and file transfers are "secured with the highest level of SSL encryption".

AirDroid's Security Center gives more detail:

• It says AirDroid is hosted on Amazon Web Services, and that "all servers storing sensitive data are located in Silicon Valley and Germany".
• It says sessions use RSA keys and AES 256-bit encryption, and that because "the private key never leaves the client computer", the routing server cannot decrypt the data stream, so "even AirDroid as the server owner, cannot read the encrypted data".
• It invites reports of security issues at an address it gives, Security@airdroid.com.

We cannot check these claims. They are statements, not audit results, and we found no independent audit report in the pages we read. For how that differs from a local-only tool, see local network vs cloud sync.

What does the Google Play listing say?

The AirDroid listing, published by SAND STUDIO and showing an update on 13 Aug 2026, is labelled "Contains ads" and "In-app purchases". Its Data safety page is filled in by the developer. It says "No data shared with third parties", and that data is encrypted in transit and you can request deletion. It lists data the app "may collect": files and docs, photos and videos, SMS or MMS, contacts, installed apps, email address, precise location, device or other IDs, and crash logs and diagnostics. Several are marked Optional. Google notes that the information is provided by the developer and may vary by use, region and age.

Which permissions does it ask for?

We found nothing in the Play listing text we read that lists the Android permissions. AirDroid's user guide describes asking per feature, and its pricing page says "we ask for your permission each time while you enable the features". From the guide:

Each of these is a broad permission. Notification access, for example, lets an app read notifications; see what notification access is. Grant only the features you will use, under Security & Remote Features in the app.

What do public vulnerability records show?

A keyword search for "airdroid" on the US National Vulnerability Database's API on 2 October 2026 returned eight entries, all published between 2012 and 2019. Two examples:

• CVE-2012-3887, published 26 July 2012: AirDroid before 1.0.7 beta used a "cleartext base64 format for data transfer that is documented as an 'Encrypted Transmission' feature".
• CVE-2019-9599, published 6 March 2019, scored 7.5 (high): the Android app through 4.2.1.6 could be crashed by many simultaneous requests.

These are old and name old versions. We found no entry for the current version, and absence from a keyword search is not proof of anything. Check nvd.nist.gov yourself and search again before you decide.

What checklist can I use to judge it?

1. Decide which mode you need. If the phone and the Mac are always on the same Wi-Fi, you may not need remote mode at all. Leave the remote features off under Security & Remote Features.
2. Read the two paragraphs that matter: the Remote Connection Mode answer on the pricing page and the data table in the privacy policy.
3. Create the account with a password you use nowhere else.
4. Grant permissions one feature at a time, and check what you granted in Android's Settings under Apps.
5. Check the Data safety page against what you plan to send. If you do not want SMS, contacts or location to be involved, do not enable those features.
6. Know how to leave. The policy says you can delete your account at web.airdroid.com.

Where does The Relay fit?

The Relay is a different design, which is not the same as a verdict. It works over your own Wi-Fi network, with Bluetooth as a fallback, and the connection between the two devices is encrypted. Your clipboard, files, texts, and notifications travel directly between your phone and your Mac over your local network. They are not uploaded to The Relay's servers. It is one subscription through Google Play that covers your phone and your Mac, with a 7-day free trial, for Android 8.0 or later and macOS 13 Ventura or later.

There is no account or sign-up with The Relay: the subscription is bought through Google Play, and we do not store payment details. The website uses analytics. The privacy policy has the detail, and you should read it as you would AirDroid's. It cannot reach a phone across the internet, mirror the screen or send texts, all of which AirDroid lists. See The Relay vs AirDroid.

Questions people ask

Is AirDroid free?

There is a free plan with limits, and a paid plan at $3.99 a month or $29.99 a year on 2 October 2026. See AirDroid free vs premium.

Does AirDroid store my texts and contacts?

Its pricing page says that in Remote Connection Mode such private information is transmitted over HTTPS and never stored, except account information and the phone's latest location if Find Phone is on. The privacy policy and Data safety page list other data it collects.

Does AirDroid work without an account?

Its guide describes a Lite Mode and a QR-code route. Its Play listing says that without an account you get limited features on the same Wi-Fi.