Security

We are asking you to hand us files that matter, so security came first in the design. Here is each protection we actually have in place.

Protecting your files

Encrypted in transit (TLS)

Every request, uploads and downloads included, is encrypted with TLS (HTTPS). Nobody on the network path can read your file contents.

Encrypted at rest (AES-256)

Files are encrypted automatically by the storage layer (Cloudflare R2) when they are written, using AES-256.

Download links that expire

Access to the file itself goes through a signed URL issued per request that expires after 15 minutes. If that URL leaks later, it no longer downloads anything.

Share URLs that cannot be guessed

Share URLs use random strings that are not realistically guessable. Only someone who has the URL can reach the download page.

Password protection, free on every plan

You can set a password on any transfer. Passwords are stored hashed with scrypt and never in plain text. Until the correct password is entered, not even the file names are shown.

Deleted automatically when it expires

Once the retention period ends, the transfer stops downloading immediately and the files are removed from storage. Nothing sits around after you send it.

Delete it yourself at any time

The delete key shown when you upload lets you remove the files completely without waiting for them to expire. Delete keys are stored hashed too.

Privacy

We do not read your files

Except where strictly necessary — investigating an outage, or complying with the law — we do not look inside the files you send. We do not analyse them, train on them, or reuse them.

No tracking cookies

We currently use no third-party trackers or cookies for behavioural targeting. Our analytics work without cookies.

IP addresses are anonymised

The IP addresses we record for download statistics and abuse prevention are anonymised with a salted hash. Raw IP addresses are never stored.

Infrastructure

Built on infrastructure with a track record behind large services worldwide.

File storage: Cloudflare R2 (encrypted at rest, eleven-nines durability design)
Application: Vercel (HTTPS enforced, DDoS protection)
Database and authentication: Supabase (row level security enabled)

Reporting abuse

Sharing illegal files, or anything that infringes someone else's rights, is prohibited (see our Terms). Transfers found in breach are deleted. If you come across a file being misused, report it through Contact and we will look at it first.

Reporting a vulnerability

If you find a security problem, please do not exploit it — tell us through Contact. We will respond honestly as soon as we have confirmed it.