Privacy policy

Last updated: 15 October 2026

This privacy policy explains how … ("we") processes personal data when you use DataTransfer on this website. It is based on the Swiss Federal Act on Data Protection (FADP). Where the EU General Data Protection Regulation (GDPR) applies, section 10 applies in addition.

1. Controller

For questions about data protection, write to ….

2. In short

• Messages and files are encrypted in your browser before they are sent (end to end). We can't read them.
• We don't store messages or files. The server only relays the encrypted data while both browsers are connected.
• There is no account, no tracking, no analytics, no advertising and no content from third parties.
• We use your IP address only briefly, to protect the service against misuse.

3. Data we process

3.1 Visiting the website

When you open the website, your browser transmits technical data that is needed to deliver it: IP address, date and time, the requested address and information about your browser (user agent). Our server records this data in access logs, which are deleted after 14 days.

A technically necessary cookie (.AspNetCore.Antiforgery…) protects against forged requests from other websites. It contains a random value and no information about you, and it is deleted when you close the browser. We don't use any other cookies, local storage or similar technologies.

The page regularly loads the current server load (number of connections). This contains no personal data.

3.2 Creating and joining a connection

To pair two browsers and relay data between them, the server keeps in its memory: a random connection code, random technical identifiers of the two browsers, temporary public keys for the key exchange, the time of the last activity and the amount of data relayed.

To protect the service against misuse, for example someone occupying all connections, the server counts connections and connection attempts per network address. For this purpose it keeps your IP address (for IPv6, its network prefix) in memory while you are connected and for a few minutes afterwards. It isn't written to disk. The only exception: if a request contains proxy headers from an address that isn't a configured proxy, that address may be written to the server log (at most once every ten minutes) so that we can detect configuration errors.

Before a connection is created, your browser solves a small computing task (proof of work) to make it harder for automated programs to create connections in bulk. The task is generated and checked by our server alone; no third-party service is involved and no data about you or your device is collected for it.

3.3 Messages and files

Messages and files are encrypted end to end in your browser (key agreement with ECDH P-256, encryption with AES-256-GCM). The keys never leave the two browsers. The server relays the encrypted data piece by piece to the other browser without storing it and can't decrypt it. It only sees technical metadata such as the time and size of the transmitted data.

Received messages and files are kept in the memory of the recipient's browser until a new connection is started or the page is closed. Save files you want to keep.

Whether you share personal data in messages or files, your own or other people's, is your decision and your responsibility.

4. Purposes

• to provide the service and connect two browsers;
• to keep the service secure and stable and to prevent misuse;
• to comply with legal obligations.

We don't use your data for marketing or profiling, and we don't make automated individual decisions within the meaning of Art. 21 FADP.

5. Retention

• Connection data is deleted from memory when the connection ends: unused codes after 3 min, connections without transfers after 10 min, and every connection after 2 h at the latest.
• The counters per network address are deleted from memory a few minutes after your last connection.
• Access logs are deleted after 14 days.
• Restarting the server deletes everything held in memory.

6. Recipients and processors

We run the server ourselves; no hosting provider processes data on our behalf. Internet providers only transport the encrypted connections. We disclose data to authorities only where we are legally obliged to. We don't sell data.

7. Disclosure abroad

The servers are located in Switzerland. If data is processed outside Switzerland, this happens only in countries the Federal Council recognises as providing adequate data protection (such as the EU and EEA states), or with appropriate safeguards such as standard contractual clauses (Art. 16 FADP).

8. Data security

All connections to the website are encrypted (HTTPS). In addition, messages and files are encrypted end to end, and the server limits connections and connection attempts to prevent misuse. DataTransfer is open source, so anyone can check how the encryption works and that the server can't read your data: git.sithis.ch/Sithis/DataTransfer. No system is completely secure, however. Compare the safety code with the other person over another channel, for example by phone: only if both codes match can you be sure that nobody intercepted the connection.

9. Your rights

Under the FADP you can request information about your personal data (Art. 25 FADP), have incorrect data corrected, have data deleted, object to its processing and receive certain data in a common electronic format (Art. 28 FADP). Send your request to …. Because we don't store data linked to a person and delete connection data after a short time, we usually can't attribute any data to you.

You can lodge a complaint with the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern, www.edoeb.admin.ch.

10. Visitors from the EU and EEA

Where the GDPR applies, we process data to provide the service you request (Art. 6 para. 1 let. b GDPR) and based on our legitimate interest in a secure, stable service without misuse (Art. 6 para. 1 let. f GDPR). You have the rights under Art. 15 to 21 GDPR and can lodge a complaint with the data protection authority in your country.

11. Changes

We may update this privacy policy. The version published on this website applies.