Privacy

The short version

transferatu is a desktop app for Windows and macOS that sends files, folders and 3D scene selections directly between two computers. The contents of the files you send never reach our servers. They move directly between your computer and your friend's. What we hold is the small amount of account information needed to let two people find each other.

What we store

• Your email address, held by Supabase Auth, with a password if you signed up that way, or with the Google account you used to sign in.
• Your display name and your twelve-character invite code.
• Your profile picture, if you set one or Google supplied one.
• Which accounts you are paired with.
• A recent-activity timestamp, so your friends can see whether you are online.
• A record of each transfer offer: who sent it, who received it, the file name, the file size, and whether it was delivered.

Transfer file names and sizes are stored in plain text in the database. If a file name itself is sensitive, rename it before sending.

Signing in with Google

Signing in with Google is one of two ways to make a transferatu account; an email address and a password is the other. Both produce the same kind of account, and neither is required over the other.

When you choose Sign in with Google, transferatu requests two scopes and no more: your basic profile and your email address. What it receives is your name, your email address, your profile picture, and the Google account ID that identifies you to Google. It is used for exactly two things: creating and signing you into your transferatu account, and showing you to the people you are paired with.

Because no other scope is requested, transferatu has no access to Gmail, Drive, Contacts, Calendar or Photos, cannot read anything else in your Google account, and never posts anywhere on your behalf. Your Google password never passes through us: the sign-in happens on Google's own page, and we receive only the result.

transferatu's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Information received from Google is never sold, never shared with anyone beyond the processors listed below, never used for advertising, and never used to train a model.

You can disconnect transferatu from your Google account whenever you like, from your Google account permissions page. Deleting the transferatu account itself is covered under Your control, below.

What we never store

• The contents of any file. Bytes travel peer to peer and are never uploaded to us.
• Anything about files you open, move, or keep on your machine.
• Anything from your Google account beyond the name, email address, profile picture and account ID described above.

Who can see your information

Every exposed table uses row-level security. You can read profiles and presence for yourself and for the people you are paired with, and nobody else. Invite codes are resolved through a guarded procedure rather than a readable table. The connection ticket for a transfer is visible only to its two participants.

Processors we use

• Supabase: accounts, invites, presence, and transfer signalling. It is also where a Google sign-in is exchanged for a transferatu session.
• iroh: the peer-to-peer transport the files themselves travel over. It is a protocol running on your machines, not a service holding your data.
• Umami: visitor counts for this website only. See below.

This website

The site counts visits with Umami. It sets no cookies, stores no identifier that follows you between visits, and does not track you across other sites, so there is nothing to consent to and no banner asking you to. What it records is the page, the referrer, the country, and the kind of device and browser. Never an IP address, and never anything tied back to a person.

Two actions are counted the same anonymous way: pressing a download button, and joining the notification list. The application itself carries no analytics of any kind.

Your control

You can edit your profile, reset your invite code, remove a friend, archive or delete your own transfer history, and sign out from inside the app. Removing a transfer from your history changes only your view of it; it never deletes your friend's record or a file they already downloaded.

To have your account and everything attached to it deleted, including anything received from Google, write to support@acroqube.com.

This page

If any of this changes, the date at the top changes with it. Material changes will be announced in the app.