The files you send
Files are stored in object storage in encrypted form at rest and served over HTTPS. We hold them until the transfer expires (the date you chose when sending), until the download cap you set is reached, or until you delete the transfer — whichever comes first. After that the files are removed from storage; a short-lived copy may remain in storage backups for up to 30 days.
We do not open, index or analyse the contents of your files, with one exception: files may be scanned for malware before they are made available for download.
What we record about a transfer
For each transfer we keep the file names and sizes, the sender’s email address and name (if given), the recipients’ email addresses, the message, and the expiry and password settings. For each download we keep the time, the file, the recipient link used (if any), the browser and device type, and an anonymised form of the IP address that cannot be turned back into the address itself. The sender can see this download record; recipients cannot see each other.
Accounts
An account stores your email address, your name, a hash of your password (never the password), your plan, and the transfers you’ve sent. Delete your account from Settings and everything above is removed, along with every transfer you’ve sent. Billing records required by law are kept by our payment processor, Stripe, for the period they are required to keep them.
We send email to deliver transfer links, download receipts, sign-in and password resets, and billing notices. We do not send marketing email.
Cookies
Two cookies, both strictly necessary: one keeps you signed in, one remembers that you’ve entered the password for a protected transfer. Neither is used for tracking or advertising, and there are no third-party cookies.
Who else sees data
Files are stored with an object-storage provider; email is sent through an email delivery provider; payments are handled by Stripe, which sees your card details — we never do. Each of these processes data on our instructions. We do not sell data to anyone.
Your rights
You can export what we hold about you, correct it, or have it deleted. Deleting your account from Settings does this without needing to ask. For anything else, or to report a transfer that shouldn’t exist, write to theitgroupapps@gmail.com.
Reporting a transfer
Every download page has a Report link. Reports are reviewed by a person; a reported transfer may be blocked while that happens.
This policy is issued by TransferIt. If it changes, the date at the top changes with it.