This page is written to be read, not to satisfy a lawyer. If you want to know
what this site collects about you, the short answer is
almost nothing. But there are a few things worth knowing before you use
it — particularly the last one.
Your files
- Your files never pass through our server. They travel straight from one browser to the other.
- They are encrypted before they leave your device with AES-256-GCM, and can only be decrypted at the other end.
- Filenames are encrypted too, not just the contents.
- We keep no copy. There is nowhere to keep one — the files never reach us.
- We could not open your files even if we wanted to. The decryption key is never sent to any server.
So what does the server actually do?
One job: it introduces the two devices to each other, like someone
passing on a phone number. Once the two are connected it is out of the loop entirely, and
the files move on their own.
What is actually stored
On the matchmaking server
- The 6-digit room code, held while the room is open and deleted when it closes.
- A short hash of your IP address, used only to limit how many requests can arrive per second so nobody can hammer the service. It is not written to any database.
- No accounts, no email, no name, no tracking cookies, no Google Analytics.
On your own device
- Your language choice (Thai/English) and light or dark theme, in the browser's localStorage.
- Files you receive, written to the browser's temporary storage (OPFS) until you save them or start a new transfer.
- All of it stays on your machine and is never sent anywhere. Clearing the site's data in your browser removes it.
The part we have to say plainly — the other person sees your IP
Sending directly means the two devices genuinely have to know how to
reach each other. So the person you send files to will see your IP address,
and you will see theirs.
This is not a flaw; it is how every peer-to-peer technology works, including the voice
and video calls in ordinary chat apps. It is the price of the files not sitting on
anyone's server.
What that means in practice: an IP address roughly indicates which
internet provider you use and which region you are in. It does not reveal your name or
your home address. But if you would rather strangers did not see it,
do not use this to send to people you do not know — it is built for sending things
to people you do.
Third parties involved
- Cloudflare hosts the site and the matchmaking server, so it sees the IP addresses of visitors, as any hosting provider does.
- Google's STUN servers are used when a connection starts, so each device can learn how it appears from the outside. That step reveals your IP to Google, but not your files — no file data travels that path.
- Fonts, icons and every image are hosted on this site itself. Nothing is pulled from anyone's CDN, so opening this site makes no requests to any third party at all.
What this protects against, and what it does not
- Protects against anyone in the middle reading your files — provided the 6-digit code matches on both screens.
- Protects against any provider, ourselves included, opening your files.
- Does not protect a device that is already compromised, on either end.
- Does not hide your IP address from the person you are sending to (see above).
- Does not guarantee what the recipient does with the files afterwards — the same as handing someone anything else.
Children and general users
There is no sign-up, so no personal data is collected from anyone, and the service is not
aimed at any particular age group.
Contact
This is a personal project, built to be used and shared with friends, with no charge.
If you hit a problem or want to ask something about privacy, reach out through whichever
channel this link came to you from.
When this page changes
If anything changes that genuinely affects your privacy — say a relay server is
switched on one day, or usage statistics start being counted — this page will be
updated along with the date at the top, and it will state plainly what changed.