Every release, and what actually changed.

Generate Key now produces a 6-character security code alongside the 32-character connection key. The key is minted by the relay and travels through it; the code is generated on your machine and never leaves it, so the two are meant to be sent by different routes — the key in chat, the code read out on a phone call. The host checks the code before credentials and before listing a single file, which means a leaked key on its own reaches a host that will not answer. The code expires after five minutes if unused, stops expiring once accepted so a long transfer is safe, belongs to exactly one session, and is destroyed by Stop Sharing.

The P2P Connect dialog has a Connect as a guest (no account) option. A guest who clears the security code sees exactly the files marked Everyone — nothing else is listed, and nothing else can be requested. Signing in with a username and password shows those files plus whatever is shared with that user or their group. Previously an internet transfer meant creating an account on the host for the person on the other end, even for a single handoff.

The internet toggle remains the outer gate, but a file inside it whose access is set to Everyone is now downloadable by anyone who gets that far, with no account on the host. Those files carry a Public badge in File Management, and the Internet P2P panel tells you how many of them exist before you hand out a key — so you know what a guest will see before they see it.

Twenty seconds after launch the app asks royalsoftworks.com whether anything newer has shipped, and never checks again while it is running — a machine left hosting for days should not be interrupted because a release landed that afternoon. If there is something newer you get the version, the release notes and two buttons; nothing downloads until you press one. Settings → Updates → Check now forces a check at any time and always reports the outcome, including that you are already up to date. The check is an ordinary HTTPS request for a small text file: no account, no identifier, no telemetry.

Not every copy of Privatta can replace itself, and pretending otherwise produces a confusing failure halfway through. A portable Windows executable cannot rewrite itself; an unsigned macOS app cannot be swapped by macOS at all; a .deb or .rpm belongs to your package manager. Privatta works out which case it is in before offering anything, and where it cannot install in place the same dialog offers Open download page instead of Download & install.

A change to the LAN protocol or the internet handshake means an old client talking to a new host fails confusingly rather than cleanly — this release is itself an example. Such a release can declare itself required, either for everything older or only for versions below a stated line, and the dialog then drops its Later and Skip buttons. It stays declinable: Continue without updating sits behind a second screen that spells out the trade, and accepting is recorded against that one version, so the next required release still stops you.

Only the local network server used to write to the access log, so an internet session left no trace at all. A P2P session now records the connection itself, every sign-in and every refusal — including a wrong security code — any file the peer was denied, each completed or interrupted transfer, and the disconnect.

A Channel column marks each entry LAN or P2P, so the two are told apart at a glance, and new MAC address and Device ID columns record what the connecting machine reports about itself. Sign-in attempts against the LAN server are logged too — successes, bad credentials and rate-limited attempts alike; previously only file listings and downloads appeared.

Privatta Mobile now sends its device name and a device ID with every request, over both the local network and the internet. The ID is a random identifier generated the first time the app runs and kept from then on, so repeat visits from the same installation are recognisable in the log. Phones send no MAC address, because no mobile operating system has exposed a real one to apps for years — the device ID exists precisely because that identifier does not. Uninstalling produces a new ID that cannot be linked to the old one.

The whole interface, including the in-app help, is available in English, German, Spanish, Russian, Japanese, Chinese, Arabic and Serbian in both Latin and Cyrillic script.

Both the installer and the portable executable now carry an Authenticode signature issued to Royal SoftWorks, so Windows names the publisher instead of reporting an unknown one, and you can check who built the file from its Digital Signatures tab before running it. A file-sharing tool asking for network access is exactly the kind of download that should not have to be taken on faith. macOS builds are not signed yet, which is why macOS gets an update notification and a download link rather than an in-place install; the app checks its own signature when it checks for updates, so that resolves itself the day signed macOS builds ship.

Notes arrive from a server, and text arriving from a server should not be able to put markup into an application window, no matter who is hosting it. Whether a release is required, whether it can be installed in place, and whether you have already declined it are all decided in the app's privileged half rather than in the window that draws the dialog, so a renderer bug cannot unblock a required update by accident.

This matches how the local network server has always behaved. Previously the internet path listed only the files granted to that user directly or through a group, so a file meant for everyone was invisible to exactly the people who had accounts.

Permissions with no stored access value — entries from early builds — always displayed as Everyone in the interface, but toggling anything else on such a file silently made it private. The stored value now matches what was on screen all along.

Every entry stored the host's own computer name instead of the visiting one, because the client sent back the name of the machine it was connecting to. Entries now identify the peer: the address the request came from, plus the computer name and MAC address that machine reports about itself. Entries written before this release cannot be corrected — the name they hold was never the visitor's.

Update feeds are split by channel: a pre-release build reads the beta feed and a stable build reads the stable one, which is what keeps beta testers from being dragged onto stable releases and the other way round. A machine still running 1.0.0 beta 2 therefore will not see 1.1.0 under Settings → Updates — install it once from the download page, and automatic updates take over from there.

The log's tamper-evident hash chain is versioned, so entries written by earlier versions continue to verify and still read as untampered after upgrading, even though the fields recorded either side of the upgrade differ.

1.1.0 is published for Windows, as a signed installer and a signed portable executable. The macOS and Linux builds of this release are not on the download page yet — Linux is still offered as the 1.0.0 beta 2 AppImage until it is.

Each entry is SHA-256 hash-chained to the one before it, with the running checkpoint also kept outside the log table. Reopening the Access Log dialog replays the chain and raises an Access Log Tampered alert if an entry was edited, deleted, reordered, or the table truncated. Entries from before the upgrade are treated as unverifiable by design rather than as evidence of tampering.

Two settings — start the local server when Privatta opens, and launch Privatta at login — turn a machine into an always-on host that comes back on its own after a reboot with no one at the keyboard.

Scripts that build the AppImage, deb and rpm targets inside the official builder image, since the packaging tooling and the native database module cannot be built for Linux from a Windows host.

Internet transfers no longer run over a libp2p node with Noise-protocol encryption and Ed25519 peer identities. Two machines now connect directly over WebRTC, introduced by a lightweight relay that carries only the handshake and never sees file data or credentials. The entire libp2p service and its dependencies were removed.

Instead of registering a peer's cryptographic identity in advance, the host generates a single-use connection key that expires after five minutes and hands it to the person connecting. The same username and password used on the local network authorised the internet session, and five failed attempts locked the connection until a new key was issued.

User accounts previously required a MAC address as a mandatory third factor. It became an optional per-user check on the local network only, with Privatta detecting and presenting the connecting machine's own MAC automatically, so there is nothing to type on the client side.

Device discovery assumed every local network was a /24 and quietly missed machines on anything wider. It now uses the subnet the operating system reports, so /16, /20 and /23 networks are scanned correctly.

The in-app help briefly claimed virtual folders were available on every tier, and the backend had no entitlement check on the commands that create or modify them to settle it either way. The help text was corrected and those commands now require an Enterprise licence, matching how group management is gated.

Machines running Privatta find each other on a shared network through mDNS and an active scan, with no router configuration. Files travel straight from one machine to the other; no server, relay or cloud service holds a copy at any point.

The recipient always requests a specific file before any bytes move. The host process exposes no operation that pushes a file to a peer, on any transport — so nothing arrives unsolicited, and that is a property of the protocol rather than a setting.

Every file is shared with everyone, with named users, or with a user group, and related files can be bundled into a virtual folder that carries one policy for the whole set. Requests for anything outside a caller's scope return a uniform denial that does not reveal whether the file exists.

The desktop app shows a code encoding its address and connection details; the phone scans it and the two are paired, with no account and nothing typed by hand.

Free for local shares with a daily cap, Pro for private sharing and internet transfers, Enterprise for groups and the access log. Pro and Enterprise licences can be activated with no internet at all, from a signed licence file bound to one machine.