Privacy

Last updated 2 November 2026

We never see your files or messages. To connect two browsers we briefly handle your IP address and some technical details, and our web server keeps standard access logs for up to 7 days. There are no accounts, cookies, analytics or adverts.

Who we are

peer.io is run by PeerX Ltd, a company registered in England and Wales (company number 07476951) whose registered office is at Tempo House, 15 Falcon Road, London SW11 2PJ (“we”). We are the controller of the personal data described here. You can contact us about privacy at [email protected].

What we never receive

Files, file names, and messages you exchange go directly between the two browsers over an encrypted connection. They never reach our server, so we can’t see, store, scan or hand them over. The same is true of the receipt, which your browsers create and sign themselves, and of the two words in each transfer code: they are only ever in the part of a link after the “#”, which browsers never send to a server.

What we do process, and why

Connection details

To introduce two browsers to each other, our server receives your IP address, the number at the start of the transfer code (never the two words), a temporary connection token, and the connection information your browser generates (which includes your IP address). This is held only in the server’s memory, is never written to disk, and is deleted no more than 10 minutes after both people have closed the page.

Web server logs

Like most websites, our web server records each request: your IP address, the date and time, and the page requested (which can include the number of a transfer code, but not its words). We don’t record your browser type or where you came from. We use these logs to keep the service secure, stop abuse, and fix problems. They are deleted after 7 days.

Cloudflare

We use Cloudflare to deliver and protect the site, so all traffic to peer.io passes through their network. Cloudflare also helps your browser work out how to reach the other person, and if a direct connection isn’t possible it relays the transfer. Relayed transfers stay encrypted end to end: Cloudflare forwards the data but can’t read it. Cloudflare processes this data on our behalf and may do so outside the UK, including in the United States, under the UK Extension to the EU–US Data Privacy Framework.

Anonymous totals

When a transfer finishes, both browsers tell our server how big the file was, along with a one-off check value that lets us confirm both sides agree without revealing anything about the file. We add the transfer to running totals: how many transfers there have been and how much data in total (overall and for each month), the largest single transfer and the month it happened, and how many were relayed. We don’t keep a record of individual transfers, and the totals contain nothing that could identify you or your files.

Receipt seal

When a transfer finishes, the sender’s browser asks our server to seal the receipt. The request contains only a scrambled value (a hash) worked out from the receipt and a random number that only the two browsers know. It contains nothing that identifies you, the other person or the file, and it can’t be turned back into any of those. Our server signs it with the current time and sends it back; it doesn’t keep it. The request appears in our web server logs like any other (see above), but the scrambled value itself isn’t logged.

Checking a receipt at peer.io/verify happens entirely in your browser. The receipt and file you choose are not uploaded; the page only fetches our published seal keys.

The other person

Because your browser connects directly to theirs, the person you’re transferring with can usually see your IP address, and you can see theirs. If the transfer is relayed, each of you sees Cloudflare’s address instead.

Our legal basis

We process this data because we have a legitimate interest in providing the service you’ve asked to use and in keeping it secure. We keep it to the minimum needed for that.

Storage on your device

We don’t use cookies. The page installs a small helper (a service worker) so that large files can be saved as they arrive instead of being held in memory. It is needed for the service to work and stores no information about you.

If you use the light/dark switch and pick the opposite of your device’s setting, your choice is saved in your browser so the site remembers it. It never leaves your device, and switching back to match your device removes it.

Your rights

You can ask for a copy of personal data we hold about you, ask us to correct or delete it, or object to how we use it. Because we keep so little and for such a short time, we may hold nothing we can link to you, but we’ll always check. If you’re unhappy with how we handle your data, you can complain to the Information Commissioner’s Office at ico.org.uk.

Links to other sites

If you follow the tip link to Ko-fi, Ko-fi’s own privacy policy applies there.

Changes

If we change how peer.io handles data, we’ll update this page and the date at the top.