Skip to content
TRANSFERITSign in

Privacy · effective 11 October 2026

Privacy Policy

This page says what TransferIt keeps about you, why, who else handles it, and how to get it deleted. It’s written to be read, not skimmed past.

Who is responsible for your data (the “data controller”): Iam The Protagonist Ltd, trading as TransferIt and The It Group, a private limited company registered in England and Wales, company number 16842280, registered office 60 Hay Lane, London, NW9 0NB, United Kingdom. Registered with the Information Commissioner’s Office, registration number ZC272634. Email: theitgroupapps@gmail.com.

1. What we collect, and why

  • Your account: your email address, your name, a scrambled form of your password (never the password itself) or the identifier Apple or Google gives us when you sign in with them, your plan, and your phone’s language. If you add them, your sender logo and a saved signature. Why: to create your account and sign you in. Basis: contract.
  • What you send: the files themselves, their names and sizes, the recipients’ email addresses, your message, and the transfer’s settings (expiry, download cap, price). Why: that’s what the app is for. Basis: contract.
  • Downloads of your transfers: the time, the file, the browser and device type, the approximate city, and a scrambled form of the downloader’s internet address that can’t be turned back into the address. The city and scrambled address are wiped after 30 days. The sender sees this record; recipients can’t see each other. Why: to show senders when their files were collected and to stop abuse. Basis: legitimate interests.
  • Signing: each signer’s name, email address, signature, the time they opened, consented to and signed the document, their browser, and a scrambled form of their internet address. Why: a signed document is only worth something if it records who signed and when. Basis: contract with the sender, and legitimate interests for the signer.
  • Payments: for a plan bought by card, or a paid download, Stripe takes the card — we never see the full number. We keep the buyer’s email, the amount, and Stripe’s reference. If you sell downloads, we keep your Stripe account’s id and whether it’s ready to be paid; your bank details stay with Stripe. Purchases made in the app are handled by the app store you use, which tells us only that a plan is active. Why: to take payments and pay sellers. Basis: contract, and our legal duty to keep financial records.
  • Connected storage: if you connect Google Drive or Dropbox, the access they give us, used only to save files there when you ask. Disconnecting removes it. Basis: consent.
  • Photos: the app asks for your photo library only so you can pick files to send. It reads only what you choose. Basis: consent.
  • Push notification token: to send the notifications you’ve turned on. Basis: consent.
  • Security checks: a scrambled form of your internet address, used to limit repeated attempts and kept in our records of sign-ins and changes; on the website, a bot check by Cloudflare when you open an account; in the apps, a one-time confirmation from Apple or Google that the app is genuine. Why: to stop accounts being opened in bulk and keep the service safe. Basis: legitimate interests.
  • Support emails you send us. Why: to answer them. Basis: legitimate interests.

We do not sell your data, we show no adverts, and we use no analytics or tracking tools. We don’t open, index or analyse the contents of your files, with one exception: files may be scanned for malware before they can be downloaded.

2. Who else handles it

We use other companies to run the app. They only get what they need for their job, under a contract that stops them using it for anything else.

  • Cloudflare — stores your files (Western Europe) and runs the bot check on the website.
  • Neon — hosts the database (London, UK).
  • Vercel — hosts the website and the app’s server (London, UK).
  • Resend — sends our emails (Ireland, EU).
  • Stripe — takes card payments and pays sellers (United States and EU). Stripe is the controller for card data under its own policy.
  • Apple and Google — sign-in, push notification delivery, confirming the app is genuine, app distribution and in-app billing (United States).
  • Expo — passes push notifications on to Apple and Google (United States).
  • Google Drive and Dropbox — only if you connect them (United States).

Where a provider is outside the UK, the transfer is covered by the UK International Data Transfer Addendum or the UK’s adequacy regulations for that country.

When you send a transfer, the people you send it to see your name, email address and message. When you buy a paid download, the seller sees your email address and the amount.

We’ll share data if the law requires it — a court order, a lawful request from the police or a regulator — and to protect someone’s safety.

3. How long we keep it

  • Files: until the transfer expires (the date you chose), its download cap is reached, or you delete it — whichever comes first. Then they are removed from storage. Uploads never finished are removed after 3 days.
  • Your account and what’s in it: while your account exists. Deleting it removes your details and every transfer you’ve sent straight away; a record that an account once existed is kept with no personal details in it.
  • Signed documents and their signing record: until the sender deletes them or the request ends.
  • Payment records: 6 years after the transaction, because tax law requires it. These contain only what the record needs.
  • Download locations and scrambled internet addresses: 30 days. Notifications in the app: 90 days.
  • Backups: up to 30 days, after which deleted data is gone from them too.

4. Your rights

Under UK data-protection law you can ask us to:

  • show you what we hold about you (a copy, usually within a month);
  • correct it;
  • delete it — which you can also do yourself in the app at Account › Delete account, or on the website at transferitapp.com/delete-account;
  • give you a copy in a form you can take elsewhere;
  • stop using it for a particular purpose, or object to our legitimate-interests uses;
  • withdraw consent for anything that was based on it, like notifications or a connected drive.

Email theitgroupapps@gmail.com and we’ll reply within one month. If you’re not happy with how we handle it you can complain to the ICO at ico.org.uk/make-a-complaint or on 0303 123 1113.

5. Reporting a transfer

Every download page has a Report link, or write to theitgroupapps@gmail.com. Reports are reviewed by a person; a reported transfer may be blocked while that happens.

6. Children

TransferIt is not for anyone under 13. We don’t knowingly collect data from them. If you think a child has given us data, email us and we’ll delete it.

7. Security

Data is encrypted in transit and at rest with our hosting providers. Access to it is limited to the people who need it to run the app. No system is perfect; if we ever have a breach that puts you at risk we’ll tell you and the ICO as the law requires.

8. Cookies and tracking

Two cookies, both strictly necessary: one keeps you signed in, one remembers that you’ve entered the password for a protected transfer. Neither is used for tracking or advertising, and there are no third-party analytics cookies. The website’s bot check by Cloudflare runs only when you open an account. We don’t ask to track you across other companies’ apps because we don’t.

9. Changes

If how we handle data changes, this page is updated first and the effective date above changes. For anything significant we’ll tell you in the app or by email.

10. Contact

Iam The Protagonist Ltd, trading as TransferIt and The It Group
Registered in England and Wales, company number 16842280
60 Hay Lane, London, NW9 0NB, United Kingdom
theitgroupapps@gmail.com