Privacy Policy
Last updated: 28 October 2026 · Türkçe
1. Controller
Peerxfer. Contact: privacy@peerxfer.com. This notice applies worldwide and is prepared with the data protection laws that apply where you are in mind, including the EU/UK General Data Protection Regulation (“GDPR”) and the Turkish Personal Data Protection Law No. 6698 (“KVKK”).
2. In short: what we see and what we don’t
- File contents, file names and folder names never reach our server. Files travel directly between the two browsers (WebRTC) and the transfer is encrypted.
- Your password is never sent to our server. It is turned into a key in your browser; only that key is sent to verify the room.
- Our server only relays the small connection messages (“signaling”) the two sides need to find each other. They are processed in memory and not written to a database.
- We have no cookies or analytics tools of our own. The home page may show Google AdSense ads; if so, Google and its partners may use cookies and similar technologies for ad personalisation and measurement, subject to your consent choices. See Google’s advertising policies and the consent prompt for details and your options. Your file contents and password are never shared with advertisers.
3. Data, purposes and retention
| Data | Purpose | Retention |
|---|---|---|
| Room ID from the share link and the room key derived from the password | Pairing the two sides and preventing unauthorized joins | In memory only; deleted when the session ends or the server restarts. Unpaired sessions are deleted after 4 hours. |
| Connection-setup messages (SDP/ICE), which can contain your IP addresses and network details | Establishing the direct connection | Forwarded instantly to the other side; not stored. |
| IP address | Limiting abuse (per-IP connection, session and password-attempt limits) and security | In memory for rate limiting, at most 1 hour. Logs contain a shortened hash instead of the raw IP. The hosting provider’s own access logs are subject to its own retention. |
| Security events (limit hits, wrong-password attempts, closures after abuse reports) | Service security, fighting abuse | In server logs, for the hosting provider’s log retention period. |
| Stored in your browser: your acceptance of responsibility and language choice; on the sender, resume data (link ID, password, file name and size); on the receiver, a resume token | Remembering your acceptance, resuming an interrupted transfer | Only on your device (localStorage); resume data at most 7 days and removed when the transfer finishes. You can clear it by deleting your browser data. |
Legal bases: performance of the service you request and our legitimate interest in running a secure service (KVKK Art. 5/2-f; GDPR Art. 6(1)(b) and (f)); compliance with legal obligations (KVKK Art. 5/2-ç; GDPR Art. 6(1)(c)).
4. Third parties and transfers
- STUN service: By default the browser contacts Google’s public STUN servers (stun.l.google.com) to set up direct connections, which reveals your IP address to them.
- Hosting and domain: The service runs on Render infrastructure; the domain and DNS are with Cloudflare. Contact e-mails reach us through Cloudflare e-mail routing. These providers may be located abroad, in which case the applicable transfer rules apply.
- No TURN relay server for file traffic is currently used; if one is added, this page will be updated.
- We may share the limited data we hold with competent authorities where lawfully required.
5. Your rights
Under KVKK Art. 11 and, where the GDPR applies, GDPR Arts. 15–22, you may ask whether we process your data, request access, correction or deletion, restrict or object to processing, and request portability where applicable. Write to privacy@peerxfer.com. You may also complain to the Turkish Personal Data Protection Authority (KVKK) or, if you are in the EU/UK, to your local data protection authority.
Note: our server holds no account or record that links data to your identity, so for some requests (for example “which records belong to this IP address”) we may be technically unable to identify your data.
6. Changes
We may update this notice; the current version is always on this page.