Privacy

We cannot read your files because they never reach us. That is a fact about how the service is built, not a promise about how we behave — policies can quietly change, and this cannot, without rebuilding the site.

What we never receive

Your files. Their names, their sizes, their types, their contents. Every byte travels directly between the two browsers over an encrypted connection that the browsers negotiate between themselves.

This matters beyond principle. There is no copy on our side to be read by staff, retained after you would like it gone, exposed in a breach, sold, or produced in response to a demand — because no such copy is ever created. A request for the contents of a transfer is one we could not fulfil no matter who was asking.

What we do receive, and for how long

The connection-setup text does include network addresses for the device, which is unavoidable — it is the information that lets the other browser find yours. It is deleted along with everything else as soon as the pairing succeeds.

No accounts, no tracking

There is nothing to sign up for, so there is no name, email address or password on file, and no profile or history of what you have sent. We do not run advertising or analytics trackers, and we do not build a picture of visitors across sessions or sites.

Cookies

This site sets no cookies at all. Not “only essential ones” — none. It stores nothing in your browser’s local storage, session storage or databases, and loads no fonts, scripts, or images from any other company’s servers. Every file the page uses comes from this domain.

The only things ever written to your device are files in transit. First, a large file you are receiving: Files over 64 MB are written, as they arrive, into your browser’s private storage area for this site on your own device, so a big transfer doesn’t have to fit in memory. It is the file you asked to receive, it never leaves your device, it is not readable by us, and it is deleted when you cancel or leave the page — or, if the browser closed first, the next time you open this site. Smaller files are held in the page’s memory and vanish with it.

The same goes for files you share into xfrit from another app (“Share to xfrit” on a phone, once the app is installed). A small script that runs in your browser — a service worker — catches the share on your device and holds it in the browser’s storage for a moment so the page can pick it up. It is never sent to us: if that script isn’t running, our server turns the share away without opening it or keeping any copy. The held copy is cleared when you leave the page, or on your next visit. The service worker does nothing else — it caches no pages and sees no other traffic.

That is why you are not being shown a cookie banner. Those exist to obtain consent for storing things on your device, and there is nothing here to consent to. You can confirm it in a few seconds: open your browser’s developer tools, look under Application or Storage, and you will find the cookie list for this site empty. (During a large transfer you will also see the incoming file under the site’s storage usage, and see it disappear afterwards.)

If that ever changes — for instance if we add an option to remember your own devices so you do not have to type a code each time — it will be described here, it will be something you switch on rather than something done to you, and it still will not be used to track you.

Third parties

To find a route between two devices, your browser contacts a public STUN server, which reports back what your public network address looks like from the outside. This is a standard part of how direct browser connections work, and no file data passes through it — it answers a question about addressing and nothing else.

We use Google’s public STUN service, at stun.l.google.com:19302 and stun1.l.google.com:19302. To be explicit about what that means: Google necessarily sees the networking information associated with that request, including your IP address, in the same way any server you contact does. It does not see your file, the code, or who you are transferring with. Their handling of it falls under Google’s privacy policy.

The website itself is delivered through Cloudflare, a network that sits in front of our server to keep it fast and protect it from attacks. Every request your browser makes to this site passes through Cloudflare on the way — including your IP address, which pages you load, and the short connection-setup messages the transfer page exchanges with our server (the code and the SDP text described above). Cloudflare handles that under Cloudflare’s privacy policy. It never sees your files: they travel directly between the two devices and never pass through Cloudflare or our server.

We deliberately do not operate or use a relay (TURN) server. This is the single most important thing about the design: when a direct connection cannot be established, the transfer simply fails rather than falling back to routing your file through our infrastructure. No relay service carries the contents of your transfer, because there is no relay. The reasoning, and what it costs you, is on the how it works page.

Security

Transfers are encrypted between the two browsers by default, using keys the browsers agree between themselves. We are not a party to that exchange and hold no key that could decrypt it. The site is served over HTTPS, and the code that signs transfer tokens lives only on the server and is never sent to a browser.

The honest limit: anyone holding a valid code can connect to that transfer while it is live. Codes are random, single-use, short-lived and rate-limited, but they are still the thing to be careful with. Share a code with the person you intend to, and if a transfer does not start, make a new one.

Your rights

Depending on where you live you may have rights to access, correct, export or erase personal data a service holds about you. We have tried to design most of those requests into irrelevance: there is no account, no profile, and nothing about the contents of your transfers at any point.

The honest exception is that ordinary web-server logs, and the short-lived abuse-prevention counter, involve your IP address — which under laws such as the EU and UK GDPR, and several US state privacy laws, can itself count as personal data or personal information. Those records are short-lived and are not linked to any transfer contents, but we would rather name them than claim we hold nothing at all. In practice we also have no reliable way to match a request to a specific person, since there is no account to identify you by; if you contact us we will tell you honestly what, if anything, exists.

Where we operate

This service is operated from the State of Iowa, in the United States, and the small amount of data described above is handled there. If you use it from elsewhere, including the EU or UK, that information is processed in the United States.

US state privacy laws — including Iowa’s own Consumer Data Protection Act, and the equivalents in California, Colorado, Virginia and others — generally apply to businesses above certain size or data-volume thresholds. A service of this size is very unlikely to meet them. We have written this page to the standard those laws describe anyway, because the design makes it cheap to do so: there is almost nothing to disclose.

Children

This site is not directed at children, has no accounts, and asks no one for their name, age, email address or any other personal detail. We do not knowingly collect personal information from children under 13, as that term is used in the US Children’s Online Privacy Protection Act. As noted above, the ordinary server logs that every website receives do involve an IP address, so we avoid claiming that literally nothing personal reaches us. If you believe a child has provided us with personal information, contact us and we will delete whatever exists.

Verifying this yourself

You do not have to trust the above. The connection log on the home page prints everything we send to our server as it happens. For a stronger check, open your browser’s developer tools, switch to the Network tab, and run a large transfer: a few small requests at the start, then nothing, while the file moves between the two machines.

Changes

If this policy changes we will update the date below. The architectural commitment — that files are never uploaded to or stored on our server — is not something we intend to change. If it ever did, that would be stated plainly on the home page, not quietly amended here.

Contact

Privacy questions, or abuse reports: [email protected].

Last updated 2 November 2026.