Legal
Privacy policy
What we hold, what we are unable to hold, and how to make us delete it.
Last updated Aug 22, 2026
01
The short version
Encryption is on by default and it happens on your device. What reaches us is sealed bytes, a salt that is useless on its own, and filenames we cannot read. The key never touches our servers, so there is no version of this where we hand your files to somebody else, or read them ourselves.
Around that we keep as little as the product allows: an email address if you open an account, the shape of a transfer so your dashboard can show it back to you, and the delivery state of any link we mailed for you. None of it is sold, and there is no advertising or cross-site tracking anywhere on this site.
To have all of it deleted, write to contact@betterfiletransfer.com from the address on the account. There is no form and no waiting list.
02
Who we are
BetterFileTransfer operates this service and decides what is stored on it, which makes us the controller of the data described below. Everything on this page is answered at contact@betterfiletransfer.com.
03
What we cannot see
On an encrypted transfer your browser generates a key, or you type one, and every chunk of every file is sealed before a byte leaves your device. We receive the sealed chunks, a random salt, and a short sealed word used only to tell a right key from a wrong one. None of those three can be turned back into your files.
The filenames are sealed the same way, so the page that shows a transfer does not know what is in it either. The key travels to your recipient inside the part of the link after the hash, which browsers never send to a server, or you pass it to them yourself.
Turn encryption off and this changes, honestly: the files are then stored as you sent them, and our servers can read them the way any host can. The switch is in the send panel and it starts on.
04
What we store
- The files
- The bytes you upload, sealed on your device when encryption is on. They sit in object storage until the transfer expires or you revoke it.
- The transfer
- File names and sizes, an optional title and message, the link token, the lifetime you picked, and a count of downloads. On an encrypted transfer the names are sealed and the file type is not recorded at all.
- Your account
- Your email address, a display name taken from the part before the @, and which plan you are on. There is no password stored, because there are no passwords.
- Signing in
- A bcrypt hash of the six-digit code, never the code itself, and the address the request came from so that one person cannot mail-bomb another. Both are short-lived.
- Your session
- A random token, and the date it stops working.
- Links we mailed
- Each recipient address, the mail provider's id for that message, and whether it was delivered, opened, clicked or bounced. This is what the receipts on your dashboard are made of.
- Payments
- If you subscribe, an id tying your account to a customer record at our payment provider, plus the plan status and its renewal date. Card details never reach us.
- Visitor numbers
- Which pages were viewed, roughly where in the world from, and which site or search sent you. Two of these tools also record how a page was used — scrolling, clicks, where a cursor went. It runs on the marketing pages only, it is used to see whether the product is being found and where it confuses people, and it is never joined to your account or to anything you have sent.
06
How long we keep it
- The files
- Until the day you picked, or until you revoke the link, whichever comes first. Deletion is immediate and there is no recovery path afterwards, for you or for us.
- The record of a transfer
- 90 days after it retires, so your history still shows what you sent and how it did. Then the record itself is deleted.
- Uploads that were abandoned
- Deleted 24 hours after they were started. An upload that never finished never became a link.
- Sign-in codes
- Minutes. A code is burned the moment it is used, and asking for a new one retires the old one.
- Sessions
- 30 days, then removed by the maintenance run.
- Your account
- Until you ask us to delete it.
07
Who else touches it
A handful of companies, each doing one job, none of them given more than the job needs.
- Resend
- Delivers our mail: sign-in codes, the share links you ask us to send, and the notices about your own transfers. It sees the recipient address and the message.
- Polar
- Runs Pro subscriptions and takes the payment. Card details go to them and never to us.
- Google Analytics
- Counts visits to the marketing pages so we can tell whether anyone is finding us. It sees the page address, the referrer and a coarse location, and it is never given your email, a share link or anything about a transfer.
- Microsoft Clarity and Hotjar
- Record how the marketing pages are used — where a cursor moved, what was clicked, how far a page was scrolled — so we can see where the product confuses people. Neither loads on a share link or on the dashboard, and the filenames you drop in, the link you get back and the key itself are masked out of what they capture.
- Our hosting provider
- Runs the servers, the database and the storage this site is built on.
We do not sell personal data, we do not share it for advertising, and nobody buys a list from us. If we are ever legally compelled to hand something over, what exists to hand over for an encrypted transfer is sealed bytes.
08
Your rights
Wherever you live, you can ask us for a copy of what we hold about you, ask us to correct it, ask us to delete it, or object to us holding it at all. We answer within 30 days and there is no charge.
If you are in the UK, the EU or the EEA, the GDPR puts those rights on a legal footing and you can complain to your national data protection authority if we get it wrong. We would much rather you told us first.
We hold your account details because you asked for an account, we hold transfer records because that is the service you are using, and we hold the sign-in and rate-limiting data because a service that mails codes has to defend itself from being used to flood somebody's inbox.
09
Deleting your data
Three ways, depending on how much you want gone.
- One transfer
- Open your dashboard and revoke it. The files are deleted straight away and the link stops working for everybody holding it. You do not need to ask us.
- A transfer sent without an account
- There is no dashboard behind it, so send the link to contact@betterfiletransfer.com and we will delete it. If it was encrypted we still cannot open it, only destroy it. Left alone it expires by itself after a day or a week.
- Your whole account
- Write to contact@betterfiletransfer.com from the address on the account and ask for it to be deleted. The account goes, and with it every transfer on it, the stored files, the history and the recipient records.
Deletion requests are answered within 30 days, usually the same week. The one thing that outlives it is the billing record our payment provider has to keep for tax law, which is an invoice, not your files.
10
Where it is stored
The site, its database and its storage run in the region chosen for this project. Our mail and payment providers run their own infrastructure, and some of that processing happens outside your country. Where it does, it is covered by the standard contractual clauses those providers publish.
11
Children
This is not built for children. You need to be at least 16 to open an account, and we do not knowingly hold data about anyone younger. If you believe we do, write to us and it goes.
12
Changes to this policy
If this policy changes in a way that matters, the date at the top changes with it and the change is described here rather than folded quietly into a paragraph. If you have an account and the change is significant, we will mail you about it.
13
Contact
- Privacy, deletion, data requests
- contact@betterfiletransfer.com
- Reporting a link, or anything else
- contact@betterfiletransfer.com
A real person reads these. Say what you want done and, if it is about a specific transfer, include the link.