The short version
- No account is required, and we do not store your files.
- Files are encrypted on your device and sent directly to the other device whenever the network allows it.
- The share code contains the decryption key. We never receive the key or the file contents.
- Signaling and network services process connection metadata, such as IP addresses and random peer IDs, so the devices can find each other.
- We do not sell personal data or use advertising trackers.
- You can clear local settings at any time and contact us about your rights.
Data controller and contact
For any questions, comments or KVKK/GDPR requests about the anonymous data processed by the TunnelTransfer app and web platform, you can contact us through the official channel below:
Publisher / Developer: FreeTrustTech
Email: [email protected]
Web: https://tunneltransfer.net
Scope
This policy applies to tunneltransfer.net, the web app, the Chrome/Brave extension, and the Android, Windows and Linux clients, including support messages you send us.
It does not apply to third-party websites, app stores or services you reach through a link. Those services have their own privacy policies.
Files, share codes and encryption
Files are read and encrypted on your device. Each transfer uses a fresh AES-256-GCM key. The key travels only inside the share code after the # character and is never sent to our servers.
The receiver decrypts the file locally. A completed file may be kept temporarily in browser storage (OPFS or IndexedDB) or in a temporary file on desktop while you choose where to save it. The client removes temporary copies after save, cancellation or its cleanup period; your browser or operating system may keep downloads until you delete them.
We cannot scan, index, retain or decrypt file contents. Anyone with the complete share code can connect and decrypt the file during an active transfer, so share the code only with the intended recipient.
Data we process
Local settings: your language choice and, where available, the anonymous usage data switch. These are stored in your browser or app data and stay on your device.
Connection metadata: to establish a WebRTC connection, the signaling service processes random peer IDs, SDP offers and answers, ICE candidates, IP addresses and connection times. This is necessary to connect the two devices.
Network services: STUN servers see your IP address and port so your device can discover a network path. If a direct path fails and relay (TURN) is enabled in your build, the relay forwards end-to-end encrypted packets and can see network addresses, traffic volume and timing, but not file contents or the key. The app tells you when a relay is used.
Hosting and security: our hosting and content-delivery provider may process standard request data (IP address, user agent, requested URL and time) to deliver the site and protect it from abuse.
Support: if you email us, we receive your address, message and any attachments you send. Please do not send share codes, keys or sensitive files.
Anonymous usage data (where enabled): platform, client version and a fixed event name (app opened, transfer started, completed or failed with a fixed error class). We do not store file names, sizes, share codes, peer IDs, IP addresses or user agents for this purpose. You can turn off anonymous usage data collection in the footer or app settings.
Sharing, service providers and international transfers
We do not sell personal data. We share data only with providers that help us run the service, or when the law requires it.
Some providers may process data outside your country, including in the United States. Where required, we rely on appropriate safeguards such as standard contractual clauses or an adequacy decision. Contact us for more information.
- Signaling: our primary PeerJS signaling server (peer.tunneltransfer.net) coordinates the WebRTC handshake. If it is unreachable, the app falls back to the public PeerJS cloud (0.peerjs.com). Signaling carries only connection metadata such as random peer IDs, SDP offers and answers, ICE candidates, IP addresses and timing; file contents and encryption keys are never sent to either signaling server.
- Cloudflare provides STUN and, where enabled, TURN relay services. Its privacy policy is at https://www.cloudflare.com/privacypolicy/.
- Google provides a public STUN server used for network discovery. Its privacy policy is at https://policies.google.com/privacy
- Our hosting and content-delivery provider processes request data to serve the site and protect it.
- App stores process install, purchase and update data when you use them; their own policies apply.
- We may disclose data if a lawful request requires it, or to protect rights, safety and security.
How long we keep data
Files and keys: we do not retain them. Temporary copies on your device are controlled by the client, your browser and your operating system. Clear site data or delete downloads to remove them.
Signaling metadata is processed only while a connection is established and for the short period needed to operate and secure the service. We do not keep a file archive of transfers.
Hosting logs are kept for a short period for security and troubleshooting, then deleted or aggregated. Support messages are kept only as long as needed to answer and for reasonable record-keeping.
Anonymous usage data, where enabled, is kept as aggregate counts for up to 400 days. Per-day salts and hashes are discarded at the end of each day. We do not keep raw IP addresses for this data.
Security
File contents are encrypted with AES-256-GCM using a fresh key for each transfer. WebRTC transport is protected by DTLS, and protocol v3 checks that the other side possesses the key and binds the check to the connection's DTLS certificates. This protects against network eavesdropping and some active attacks.
No system is perfect. A compromised device, a malicious recipient, someone who obtains the share code, or network metadata visible to providers can still create risk. Use a trusted device and share the code over a channel you trust.
We never ask for your share code or key. If someone does, it is not us.
Your rights and children
Depending on where you live, you may have the right to access, correct, delete, restrict or object to processing, receive your data in a portable form, and withdraw consent. You may also complain to your data protection authority, for example the KVKK in Türkiye or your EU/EEA supervisory authority.
Because we do not require an account and keep little data, we may not be able to identify you from a request alone. We will ask only for the minimum information needed to respond. Contact [email protected].
TunnelTransfer is not directed to children under 13, or the minimum age in your country. Do not use the service below that age. If you believe a child has provided personal data, contact us and we will take appropriate steps.
Changes and contact
We may update this policy to reflect changes in the service or the law. The date at the top shows the current version. Where required, we will announce material changes on the website or in the app before they take effect.
If a translation differs from the English text, the English version prevails. Questions, requests or concerns: [email protected]. We aim to respond within 30 days. For security reports, include enough detail to reproduce the issue, but never send real file contents or keys.