Security model
Your file never becomes our file
Lack-of-cloud only helps two browsers find each other. File bytes move over WebRTC DataChannel; the server does not receive uploaded files or store transfer history.
- Encrypted in the browser: ECDH P-256, HKDF and AES-256-GCM protect every chunk before it leaves your device.
- Locked two-person rooms: a link is not enough; the backend checks the password and seals the room after one guest joins.
- Verifiable peer trust: compare the peer fingerprint outside the app to reduce key-substitution risk.
- No account trail: no login, analytics, database file storage or local transfer history; browser-visible cookies are cleared on load.
- Fallback without upload: TURN may relay encrypted packets when direct P2P is blocked, without giving the server file contents.