What the server can see

Your device encrypts each file before it leaves, using a key agreed from the code. The server passes the bytes along and never holds the key.

It can see

• Both IP addresses, while a transfer runs. They are not logged.
• When a transfer happens, and how big it is.

It can't see

• The file, or its name.
• The code. Only the number at its start reaches the server.

Where this falls short

• A browser runs whatever code the site sends it. If someone changed this site, they could steal what you send from it. The command line tool doesn't load code from here, so use that when it really matters.
• This is a personal project. Nobody has audited its security.
• A direct connection shows each side the other's IP address, and asks a Cloudflare server for your public address. Turn off Direct connections to avoid both.
• If a transfer saves to this browser's private storage, a copy stays until you start another or leave the page.
• Files shared to the installed app stay in this browser's storage until the send ends or you next open the site.
• A transfer can't resume. If either side loses its connection, start again with a new code.

Version 0.1.0, build fef1389, 2026-11-04T17:44:48Z