Privacy

Plain description, not a legal document

This is a description of what the service actually holds. It is not a compliance statement and it does not claim any certification.

What the server stores

Public key

The public half of the key pair your Mac generated. It is how a sender seals a file to you.

Device id

A random identifier for your installation, with a hash of its access token, the word "macos", the app version, and when it was first and last seen.

Sealed header

An opaque blob carrying the per-file key and the file's name, sealed to the recipient. The server stores it and cannot open it.

Ciphertext

The encrypted file and a SHA-256 digest of it, held for up to 24 hours and then deleted.

Transfer record

Which device sent to which, the size in bytes, and the times it was created, became ready and completed.

Quota counters

Bytes per device per day, so the daily and monthly limits can be counted.

DeviceCheck token

A token your Mac produces for Apple's DeviceCheck. It is kept so the server can record that this Mac has spent its free allowance.

What it does not store

• The contents of your files. They are encrypted before they leave your Mac and the key never reaches the server.
• The name of your file in readable form. It travels inside the sealed header, which only the recipient's Mac can open.
• An email address. There is no account and no sign-up.
• A password. Your identity is a key pair in your Mac's Keychain.
• Your IP address. It is used while a request is in flight to apply rate limits, and it is not written to the database.

What it can see anyway

Encrypting the file does not hide everything around it. The server knows how large each transfer is, when it happened, and which device sent to which. It cannot read what you sent, but it can see that you sent something, and how much.

Your three words

Your words are only an address. The rotating ones are short-lived — ten minutes on the free tier, an hour on a paid balance — and asking for new ones by hand stops the old ones working immediately.

Permanent and custom codes do not expire and are not replaced when your rotating words change. A code you keep is a lasting public name for this Mac: anyone who has it can tell you still use the service and can send you files, indefinitely. Delete your device to retire one.

How long things last

A transfer expires 24 hours after it is created and the encrypted object is deleted. The record of it is removed about 30 days after it finishes. Expired words are deleted a day after they expire, and quota counters are kept for 30 days.

Your device row stays until you delete it. Reset device, under Advanced in Settings, tells the server to delete it and then removes this Mac's key. That takes the row, your words, your quota counters and every transfer record this Mac is part of, including the ones where it was the recipient. Anything still in flight is cancelled and its encrypted object deleted. None of it is recoverable.

The one thing a delete cannot reach is Apple's DeviceCheck bits. See below.

Other services involved

The service runs on Cloudflare, which processes requests and stores the encrypted objects and the database on our behalf.

When your Mac registers, it sends a DeviceCheck token to us and we pass it to Apple. We read two bits back: whether this Mac has already used its free allowance this month, and whether it has already registered this month. We do not learn anything else from it. Apple is not told who you are, but it does learn that this Mac contacted us, and when.

We also write those two bits. They are stored by Apple against the Mac itself, not against your device row, which is the point of them: they survive deleting the app, wiping the Keychain and reinstalling macOS. Deleting your device row does not clear them and neither can you. A bit set this month stops mattering once the month ends, because we only act on a bit Apple stamps with the current month.

If automatic update checks are on, the app fetches an update feed from transferme.it. Like any web request, that reveals your IP address and the version you are running. You can turn it off in Settings.

On your Mac

Your private key, access token and device id live in the Keychain. Your list of transfers, your preferences and a log file live in your user folder. None of that is sent anywhere. Clearing the history in Settings removes the list.

Other people's servers

Transfer Me It is open source and the app can point at any server running it. If you use somebody else's server, this page describes the software, not their operation of it.