Privacy policy

• There are no accounts. We never ask for your name or a password.
• Live transfers go straight from your browser to the recipient's. Your files never reach our servers, except as encrypted bytes we pass along when a direct connection fails.
• If you pay to keep a link, your browser encrypts the files before they upload, and we can't open them.
• Our analytics don't use cookies and don't follow you to other sites.
• We don't sell personal data or share it with advertisers.

download.fyi runs download.fyi and is responsible for the personal data described here. For anything about your data, email contact@download.fyi.

When you send a file without a pass, it streams from your browser to the recipient's over an encrypted WebRTC connection. Its contents, name, size and type never reach our servers.

If the two browsers can't connect directly, our server relays the transfer. The bytes it passes along are encrypted end to end with a key only the two browsers have, so we can't read them, and we don't store them.

To introduce two browsers, our connection server handles:

• Your IP address. We hold it in memory only, to limit abuse (for example, how many codes one address can try) and to show devices on the same network to each other in Nearby. It isn't written to disk or to logs.
• The three-word code of the link you're sending or opening, so the right two browsers meet. We don't log codes.
• Connection details your browser offers for finding a route, which include IP addresses.
• How many encrypted bytes it relayed, if a relay was needed.

We also keep one anonymous count per day of how many files were delivered and how many bytes moved. It contains no IP addresses, codes or file details.

To find a route between two browsers, your browser contacts public STUN servers run by Google and Cloudflare. Like any server you connect to, they see your IP address. They learn nothing about your files. Their own privacy policies apply.

If you buy a pass, your browser encrypts your files with a random key before uploading them. That key is locked with your link, which we never receive. We store:

• The encrypted files, with Backblaze B2 in the EU (region eu-central-003).
• An encrypted list of the files. Their names and sizes are inside it, and we can't read it.
• A one-way fingerprint of your link, so we can find the files when someone opens it.
• The pass you bought, its status, the total size, and when it starts and ends.
• The Stripe payment reference, amount and currency.

We don't store your email address or card details. The files are deleted within about an hour after the pass ends. A short record (the link fingerprint, the pass, its status and dates) stays for 30 days after that so we can answer questions about it, and is then deleted.

Stripe handles payments. Stripe collects your payment details and an email address for your receipt, under its own privacy policy. We receive whether the payment went through, a payment reference, and the amount. We never see your card number.

We use Umami to count visits and see which pages are useful. It doesn't use cookies, doesn't build profiles, and doesn't track you across websites. It records the page you viewed, the site that sent you, your browser, operating system, device type and country. Your IP address is used to work out the country and isn't stored.

We set one cookie, NEXT_LOCALE, which remembers the language you're reading in. It's needed for the site to work and holds nothing else. We don't use tracking or advertising cookies.

These companies process data on our behalf, only to run the service:

• Our hosting provider, which runs the website and the connection server.
• Backblaze, which stores encrypted kept files in the EU.
• Stripe, which processes payments.
• Umami, which provides cookie-free analytics.
• Google and Cloudflare, whose STUN servers your browser contacts directly.

We process data to provide the service you ask for (contract), to keep it secure and stop abuse (legitimate interests), to understand which pages are useful without identifying you (legitimate interests), and to keep payment records the law requires (legal obligation).

You can ask to see, correct or delete personal data we hold about you, to restrict or object to how we use it, or to get a copy. Because there are no accounts, we usually can't link data to a person. If your question is about a pass, include your Stripe receipt so we can find it. Email contact@download.fyi.

You can also complain to the data protection authority where you live.

If we change this policy, we'll update this page and the date at the top.