Privacy

The short version

transferatu is a desktop app for Windows and macOS. Each friend you pair with gets a conversation, and your messages, files, folders, 3D scene selections and calls all travel directly between the two computers in it. None of it reaches our servers at all, in any form. What we hold is the small amount of account information needed to let two paired people find each other, and nothing else.

This is a shorter list than it was in August 2026. A message written to a friend who was switched off used to wait with us, sealed. That was removed from the product on 31 August 2026 and nothing replaced it: such a message now waits on your own machine instead, and goes the first moment you are both online.

What we store

• Your email address, held by Supabase Auth, with a password if you signed up that way, or with the Google account you used to sign in.
• Your username and your twelve-character invite code.
• Your profile picture, if you set one or Google supplied one.
• Which accounts you are paired with, who has asked to pair with you, and anyone you have blocked.
• A network address for each machine you sign in on, so a friend's app knows where to dial. It says a machine exists, never that anybody is sitting at it. Whether a friend is online is worked out between your two machines and is not stored here.
• A name and a timestamp for each of your own machines, readable only by you, so your device list can tell them apart.
• A bug report, if you send one from the app. It holds what you typed, the category you picked, the app version and your operating system, and nothing else: no log, no file, no screenshot. Your account is recorded under a code rather than by name or email. It is kept for 90 days.
• Daily usage totals, only if you said yes when the app asked. Once a day, two numbers: how many bytes your machine sent directly and how many went through a relay, with the app version and your operating system. Your account and machine are recorded under codes, so the totals are not anonymous, but they say nothing about what was sent or to whom. Each machine's daily totals are kept for 32 days, and the combined totals for everyone for 400 days. You can see exactly what will be sent, or turn this off, in Settings, Connection. Turning it off deletes anything not yet sent.

That is the entire list. There is no record of any file: not its name, not its size, not that it was sent. There is no record of any message, conversation, or key. The tables that once held transfer records were deleted on 2 September 2026.

Signing in with Google

Signing in with Google is one of two ways to make a transferatu account; an email address and a password is the other. Both produce the same kind of account, and neither is required over the other.

When you choose Sign in with Google, transferatu requests two scopes and no more: your basic profile and your email address. What it receives is your name, your email address, your profile picture, and the Google account ID that identifies you to Google. It is used for exactly two things: creating and signing you into your transferatu account, and showing you to the people you are paired with.

Because no other scope is requested, transferatu has no access to Gmail, Drive, Contacts, Calendar or Photos, cannot read anything else in your Google account, and never posts anywhere on your behalf. Your Google password never passes through us: the sign-in happens on Google's own page, and we receive only the result.

transferatu's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Information received from Google is never sold, never shared with anyone beyond the processors listed below, never used for advertising, and never used to train a model.

You can disconnect transferatu from your Google account whenever you like, from your Google account permissions page. Deleting the transferatu account itself is covered under Your control, below.

What we never store

• Anything you type. A message travels straight between the two machines in the conversation, so we hold no transcript and cannot produce one. We are not even told that a conversation exists, or that anything was said in it. The only readable copies are on the two machines that were in it.
• Anything you send. Bytes travel peer to peer and never come to us, and neither does the name, the size, or the offer itself. Your copy stays on your machine until your friend accepts it.
• Any call. The sound, the picture, a shared screen and any lines drawn on it go straight between the two machines in the call, and nothing about a call is written down, by us or by the app: not that it happened, not who rang, not how long it lasted. Your camera and microphone are opened only in a call, or for a moment in Settings when the app reads their names. Your screen is captured only while you pick one to share, and while you share it.
• Anything about files you open, move, or keep on your machine, and anything you copy to your clipboard. Mirroring your clipboard between your own machines is off until you switch it on, and what it mirrors goes machine to machine and is dropped after ten minutes.
• Any usage measurement of the app beyond the two daily totals above, and those only if you said yes. There is no crash reporting, no tracking of what you click, and nothing sent without asking.
• Anything from your Google account beyond the name, email address, profile picture and account ID described above.

Who can see your information

Every exposed table uses row-level security. You can read the profile and the machine addresses of yourself and of the people you are paired with, and nobody else. Your own device names are readable only by you, so a friend never learns which of your computers a message came from. Invite codes are resolved through a guarded procedure rather than a readable table.

Processors we use

• Supabase: accounts, invites, friendships, and the address of each of your machines, plus any bug report you send and, if you agreed, your daily usage totals. It is also where a Google sign-in is exchanged for a transferatu session. It holds no message, no file, no call and no record of any of them.
• iroh: the open source peer-to-peer transport the messages, the files and the calls travel over. It runs on your machines rather than on ours, and holds nothing. Where a network will not allow a direct connection, a stateless iroh relay forwards the encrypted bytes without being able to read them and without storing them.
• Umami: visitor counts for this website only. See below.

This website

The site counts visits with Umami. It sets no cookies, stores no identifier that follows you between visits, and does not track you across other sites, so there is nothing to consent to and no banner asking you to. What it records is the page, the referrer, the country, and the kind of device and browser. Never an IP address, and never anything tied back to a person.

Two actions are counted the same anonymous way: pressing a download button, and joining the notification list. The application itself sends only the daily totals described above, and only if you agree.

Your control

You can edit your profile, reset your invite code, remove or block a friend, archive or delete your own history, and sign out from inside the app. Removing something from your history changes only your view of it; it never deletes your friend's copy or a file they already downloaded, and it never deletes a file from your own disk.

Your conversation history lives on your own computer, which means it is yours to delete and also that it does not follow you to another machine. Unpairing a machine empties its history and its keys. Be clear about what that does not do: a machine it was paired with keeps every key it was already handed. Forgetting is not revoking, and we would rather say so than let the button imply otherwise.

To have your account and everything attached to it deleted, including anything received from Google, write to support@acroqube.com.

This page

If any of this changes, the date at the top changes with it. Material changes will be announced in the app.