Privacy policy

AirTransfer sends your files straight between your devices, sealed with keys that stay on those devices. This page says exactly what the service holds, who else ever receives anything, and how to get rid of all of it. It is written to be read, not to be survived.

Who we are

AirTransfer is made by SoftenAI Global Private Limited, registered in India. We decide what the service stores, so under India’s Digital Personal Data Protection Act, 2023 we are the data fiduciary, and under the GDPR we are the data controller. Write to hello@airtransfer.com about anything on this page.

What we cannot see

Files, clipboard text and messages are encrypted on your device before they leave it. The keys never leave your devices. Nobody running the service can decrypt your transfers, and nobody can recover them for you if you lose them.

File contents, file names, file sizes and clipboard text never reach our server. Not in a log, not in a backup, not in a notification.

What the server stores

• Your account id, your account’s public key with the list of keys it has replaced, and the public keys and names of the devices on it.
• Your email address, if you claim one, and your username, if you claim one.
• Your friend list, friend requests, and anyone you have blocked.
• The groups you are in: each group’s name, who owns it, and who is in it.
• On iPhone and iPad, one Apple push token per device, so we can wake it. See Notifications below.
• Which plan your account is on, and a Stripe customer id if you have ever paid.
• How many bytes your account moved through the server this month, for quota.
• For a device that used our relay before it had an account: an identifier for that device and the total bytes it has relayed, so the one-off allowance cannot be reset. That row holds no account id and nothing deletes it (see Deleting your account).
• The timing of the requests your devices make.

A group name is plain text on our server. The members of a group share no key to seal it under, so the name is the one label here that we can read. Pick one you would not mind us seeing. What a group sends is encrypted exactly like everything else and leaves no record on the server.

Your devices also keep some settings in step through us: device names, device types, public keys, and a pinned copy of your contacts. These are the same things already listed above. Avatars travel sealed and we cannot see them. The labels those settings are filed under (which device, which group) are plain text.

If you set up account recovery, the server also holds your account key wrapped with a key derived from your recovery phrase. The phrase itself never reaches the server, so the wrapped copy is useless to us and to anyone who takes it.

Like any server, ours sees the IP address a device connects from. It is used to rate-limit abuse and it is not turned into a profile. Server logs carry no transfer contents, no sign-in codes and no notification tokens.

Your email address

If you claim an email address, the server stores it as you typed it, in plain text. It is not hashed. That is deliberate: it is how you receive sign-in codes, and how someone who already knows your address can find you. If you would rather not have an address on the server, you can use AirTransfer without one; you will be limited to devices and people you link in person.

When something goes through our server

Devices transfer directly whenever they can. When they cannot, an encrypted blob is parked on the server for the recipient to collect. It is opaque to us, it is deleted once it is claimed, and it is deleted again, blocks and all, when it expires. A share link you create works the same way and stops working when it expires or when you revoke it.

How long things are kept

• A parked transfer, and its ciphertext: until it is fetched, at most 7 days.
• The record that a transfer was delivered or expired: 24 hours, or up to 7 days when the sender has not yet been told it expired.
• Sign-in and confirmation codes: the code stops working after 10 minutes; the row is deleted within 24 hours.
• Your account, devices, handles and friend list: for as long as the account exists.
• Monthly byte counters: for as long as the account exists.
• The relay counter for a device that relayed without an account: kept forever, and not tied to any account. See Deleting your account.
• After you delete your account: a tombstone, kept forever. Deleting your account below says exactly what is in it and why.
• Operator action log: kept forever. An action log an account could erase by deleting itself would be worthless.

Notifications

On iPhone and iPad, the app registers with Apple’s push service so we can wake your device when something is waiting. Apple receives a device token. The notification itself carries one of three fixed phrases (“New file waiting”, “Clipboard updated”, “Incoming transfer”) and never a sender, a file name or any part of your content.

The Android app has no push notifications at all and registers nothing with anyone.

Connecting two devices

Two devices on different networks each have to learn how they look from the outside, and sometimes need a relay in the middle. Our apps point at our own server for both jobs at startup, and our relay only ever forwards encrypted packets it cannot read.

Payments

The apps contain no payment code at all. If you buy a plan, you do it on the account page in a browser: that page loads Stripe’s own script, and your card details go straight from your browser to Stripe. They never touch our servers. Stripe holds your card and your invoices; we hold which plan you are on and the Stripe customer id that links the two. When you delete your account, we have Stripe delete your customer record too (see Deleting your account).

No analytics, no trackers

The apps collect no usage analytics. There are no third-party analytics SDKs, no advertising identifiers and no crash-reporting uploads, on Android, iOS, macOS, Linux or Windows. The Diagnostics screen writes an error journal that stays on the device unless you export it and send it somewhere yourself.

This website runs no analytics and serves its fonts from its own domain rather than a font CDN.

Cookies

The pages of this site (this one, the home page, the legal pages, the deletion form) set no cookies at all. Signing in to the account page sets exactly one: at_web_session, which holds your sign-in session, lasts 12 hours, is marked Secure and HttpOnly, and is unreadable to JavaScript. An operator signing in to our admin dashboard gets the equivalent, at_admin_session. Both are strictly necessary to keep you signed in. There is no analytics cookie, no advertising cookie and no third-party cookie anywhere on this domain.

It also runs no error monitoring: a Sentry integration is wired into the build, but it is switched off unless an address is configured for it, none is configured in this build, and with none configured no such code is shipped to your browser at all.

What stays on your device

Your transfer history, your roster, recent clipboard items and your settings live on the device. Settings · Local storage clears received files and the clipboard cache. Settings · Security · Auto-delete history prunes history on a schedule you choose.

Deleting your account

Deleting your account clears, from the server: your account record, your email addresses and your username, your devices and their push tokens, your friend list with the device permissions in it, everyone you blocked, the groups you own and your membership of anyone else’s, your synced settings, your share links, your parked items and their ciphertext, your monthly byte counters, any unused sign-in codes, your wrapped recovery key, and the history of your account’s keys. It is irreversible.

You can do it yourself in Settings · Security · Delete account. It asks for a code we email you, and it applies to every device on the account, not just the one you are holding. If you have lost every device you had, use the form at /delete-account and we will do it after checking you control the address you name.

If you pay for a plan, deletion ends it at once. Before any of your data is deleted, we ask Stripe to delete your customer record there: your name, your email address and your saved card. That cancels your subscription on the spot, with no refund for the unused part of the period you have paid for. Stripe keeps your past invoices and payment records only for as long as the law requires it to. If Stripe cannot be reached, nothing is deleted, here or there, and you can try again.

On our server, three things survive it, each on purpose:

1. A tombstone, kept forever: the account id, a receipt id, the time it happened, which device asked (or, when an operator carried it out for you, that operator’s name instead of a device) and which tables were cleared. The id cannot be re-created afterwards, not with the same email address and not with your recovery phrase, because other people’s friend lists and device permissions still name it, and handing that id to whoever next holds the key would put them in your place in those lists.
2. Operator action log entries that happen to name the account.
3. The relay counter for any of your devices that relayed before the account existed. It is keyed by the device and holds no account id, so deletion cannot find it by your account. It is also kept on purpose: that counter is a one-off allowance, and erasing it would hand the same device a fresh one.

Signing out of a device erases that device’s keys. It does not delete the account.

Your rights

Wherever you live, you can ask us for a copy of what the server holds about you, ask us to correct it, ask us to delete it, or object to what we do with it. We grant these rights to everyone rather than only to the people a particular law covers. Deletion you can already do yourself, without asking (down to the survivors named in Deleting your account). For anything else, write to hello@airtransfer.com. There is no self-service export yet, so a person answers you.

If you are in the EU or the UK you also have the right to complain to your data protection authority. In India, the Digital Personal Data Protection Act, 2023 gives you the same core rights, and the same address reaches us.

Changes

If this policy changes, this page changes and the date at the top of it changes with it.