Security & Privacy
What we do to protect your data — and what our limitations are. We believe in honest, accurate security claims.
WebRTC DTLS encryption
All data transferred via WebRTC DataChannels is encrypted using DTLS (Datagram Transport Layer Security), the IETF standard for secure datagram communication. This is enforced by the browser — we cannot turn it off.
What the signaling server sees
The signaling server handles: (1) Session creation requests — your IP address and requested session duration. (2) WebSocket messages for SDP offer/answer and ICE candidates — these contain network metadata but NOT file content. (3) Session metadata in memory — session ID, pair code, expiry time.
What the signaling server does NOT see
File content, text, code, images, notes, and links you transfer through the DataChannel — once the peer-to-peer connection is established, the signaling server is completely out of the loop. It cannot read your transfers.
Session auto-expiry
Sessions expire after 10, 30, or 60 minutes (your choice). On expiry, the in-memory session record is deleted from the server. No transfer history or content is retained.
Destroy Session
Clicking "Destroy Session" immediately: disconnects all peers, deletes the in-memory session record, and invalidates the session token so it cannot be reused. SessionStorage on the browser is also cleared.
No persistent storage
No database, no S3 bucket, no logs of what was transferred. The server uses an in-memory store only. Process restart or scheduled cleanup removes all session data.
Limitations — what we cannot guarantee
- ⚠If an attacker controls your network and intercepts the initial WebSocket connection before TLS is established, they could potentially interfere with the signaling. Always use HTTPS (the live service does).
- ⚠TURN relay servers (used as fallback when direct P2P is blocked by NAT) forward encrypted packets. We use standard public STUN servers and optional TURN. The TURN server sees packet metadata but not plaintext content (due to DTLS).
- ⚠We do not provide a formal security audit. If you are handling highly sensitive data, use a dedicated encrypted solution.
- ⚠Browser session storage is not a secure vault. On a compromised public computer, malware could read sessionStorage. Always destroy the session when done on a shared computer.