Privacy Policy
Last updated: September 26, 2026
1. No accounts, no file storage
FilePass has no accounts and uploads no files to any server. File bytes flow directly between browsers over WebRTC. Signaling rooms live in Durable Object memory only and expire after 30 minutes idle — there is no persistent room database.
2. What the signaling service sees
Only connection-setup traffic passes through the Worker: ready, SDP offer/answer (≤ 32 KiB each), and ICE candidates (≤ 8 KiB each, raw cap 128 KiB). Messages are relayed transiently between the two peers and are not stored. Invalid or oversize messages are dropped.
3. What the other peer sees
Your browser necessarily reveals to the other peer: your public IP address/port (via ICE), the file name, size, MIME type, and the file contents you choose to send. Only connect with parties you trust.
4. Local processing and storage
Integrity is checked with incremental SHA-256 computed locally as chunks arrive. Where available, the receiver streams to the origin-private filesystem (OPFS) and the temporary entry is deleted after download or abort; otherwise the file is held in memory as a Blob for download. FilePass sets no cookies and uses no localStorage.
5. Third-party infrastructure
- Cloudflare Workers (signaling host) may log IP addresses and request metadata per Cloudflare's privacy policy.
- STUN (
stun:stun.cloudflare.com:3478) sees your IP during NAT discovery. - Cloudflare Pages (static frontend host) may log standard web-server data.
FilePass itself includes no analytics, advertising, or cross-site trackers.
6. Retention
Signaling state is ephemeral (room memory + 30-minute idle expiry alarm). Edge-provider logs are retained according to their own policies, outside FilePass's control.
7. Your rights and contact
Because FilePass stores no personal data tied to an account, most requests can be satisfied by simply closing the tab (signaling sockets close, OPFS partials are removed on abort). For privacy questions or abuse reports, contact: esmeraldoinciso.work@gmail.com.