Privacy Policy
Effective Date: September 12, 2026 • Engineered & Maintained by Ahmed Algendy
Zero Server Storage
Files are streamed directly between browsers in memory. No bytes ever touch a disk or cloud bucket.
End-to-End Encrypted
Transfers use DTLS 1.3 cryptographic channels with ephemeral zero-knowledge keys in the URL hash.
No Activity Logging
We do not track file names, metadata, user identities, or retain transfer history logs.
1. Fundamental Architecture & Zero-Knowledge Commitment
PeerWarp is architected from the ground up as a pure Peer-to-Peer (P2P) direct transfer service. Unlike legacy cloud services (such as Dropbox, WeTransfer, or Google Drive) that require you to upload files to an intermediate cloud server before downloading, PeerWarp establishes a direct, encrypted browser-to-browser WebRTC connection.
Under this architecture, PeerWarp never stores, caches, retains, or hosts your files. When you transfer a file, the binary data streams directly from your device’s memory or local storage directly to the recipient’s browser. Once the transfer completes or the browser tab closes, the data ceases to exist within the application session.
2. Information We Do NOT Collect
We firmly adhere to the principle of data minimization. We do NOT collect:
- File Contents & Payloads: Your files remain 100% inaccessible to us.
- File Names & Metadata: File titles, sizes, MIME types, and folder structures are exchanged exclusively between peer browsers over encrypted signaling.
- Personal Identities & Accounts: No user registration, email address, password, or account is ever required.
- Tracking Cookies & Behavioral Profiling: We do not use advertising cookies, cross-site tracking, or commercial telemetry beacons.
3. Transient Data Handled During Operation
To coordinate direct P2P connections and protect against network abuse, minimal technical data is handled transiently:
A. Ephemeral WebRTC Signaling (Cloudflare Durable Objects)
To connect two peers, our signaling worker passes ephemeral WebRTC connection metadata (SDP offers/answers and ICE candidate IP addresses). This data lives solely in volatile server RAM and is permanently erased the instant peers disconnect or the room closes.
B. Volatile Rate-Limiting IP Memory Maps
To protect public infrastructure against DDoS attacks and proxy hijacking, client IP addresses are evaluated against short-lived, in-memory counters (e.g., max 10 TURN sessions/hour). These counters are stored in volatile edge memory and automatically expire every 60 minutes. They are never written to databases or linked to user identities.
C. Local Browser Storage (IndexedDB Checkpoints)
To enable seamless resumption of interrupted transfers, partial chunks are stored exclusively in your browser’s local IndexedDB on your physical machine. No checkpoint data is ever synchronized to our servers.
4. Cryptographic Security & Zero-Knowledge URL Secrets
PeerWarp utilizes a Zero-Knowledge URL Hash Secret (`#k=...`). When you generate a transfer link, a 128-bit cryptographic key is stored strictly within the URL fragment (the portion after `#`).
According to the W3C HTTP specification, URL fragments are never sent to web servers or proxies in HTTP request headers or WebSocket handshakes. This guarantees that only someone in possession of the full share link can access the room and negotiate peer encryption keys.
5. Third-Party Infrastructure Providers
PeerWarp relies on reputable, enterprise-grade cloud providers for real-time routing:
- Cloudflare, Inc.: Hosts our static web assets, Edge Worker routing, and Turnstile bot protection.
- Hetzner Online GmbH: Hosts our dedicated Coturn STUN/TURN relay server used for NAT traversal when direct P2P connections cannot be established. Relay traffic is encrypted via DTLS/SRTP and relayed in real time without recording.
6. Contact & Legal Inquiries
For privacy-related questions, technical inquiries, or open-source audits, you may contact the architecture lead: