隱私權

TransferKite is run by a sole trader, whose name and address are on our contact page. They decide how your information is used, so any question about it goes to hello@transferkite.com. We keep as little as we can to send your files and run your account. We don't sell your information or use advertising cookies, you can turn analytics off at any time, and you can object to the rest.

If someone sends you files, they decide what's in them and why it's shared with you; we just store and deliver them. Questions about what's in a transfer can go to the sender or to us.

If someone asks you for files with a transfer request, they decide what to ask for and what happens to the files once they have them; we keep what you send on their behalf. Questions about a request can go to the person who asked, or to us.

What we'll never do

• Use your files, or anything in them, to train AI.
• Sell your files or your information, or share them beyond the people you send them to, the companies listed below, and anyone the law makes us give them to.
• Look inside your files, unless someone reports a transfer, the law requires it, or you ask us to help with one.

What we keep, and why

• Your email address, so you can sign in and so people can see who sent their files, and the language you use TransferKite in, so our emails are in it. We need these to provide your account. Anyone with one of your links can see your email address, even before they unlock a password-protected transfer, and so can anyone with the link of a request for files you send, with your name if you've set one.
• The files you upload, with each transfer's title, message, file names, sizes and types, expiry, its password if you set one (only in a form that can't be read back), and the email addresses you send it to. We need these to deliver your transfers. If you're a recipient, we got your email address from the sender, and only use it to deliver their files and, if you have an account, to show them under Received and let you recover them. That's in our and the sender's legitimate interest.
• If you ask someone for files: the email address you enter for them, if you enter one, in which case we email them the request; any label you give the request, which one made without an address needs; and your message. If you're the person asked and the requester entered your address, that's how we got it. A request made without an address has only its label, whichever way its link reaches you. When you send files to a request, we keep them the same way as any transfer, with their names, sizes and types and when they arrived. They become a transfer in the requester's account, which names you by that address, or by the label if there's no address. We keep all this on the requester's behalf, to get your files to them, and that's in our and the requester's legitimate interest. You don't need an account: we don't create one for you, and the only email we send you is the request itself, and only if the requester entered your address. We never send you marketing. To limit abuse, we count how often request links are used from each IP address and how often each request's link is used, and, when someone asks for files, how many requests they and their workspace send and how many go to each address. Each count is kept under a hash, never the IP address or email address itself.
• Download records: when a file was downloaded, the IP address and browser it came from, and the email of whoever downloaded it if they were signed in. Senders see how many times a transfer was downloaded and when it was last downloaded. Unless they turn it off, we also email senders when a transfer is first downloaded and, for a transfer sent by email, when each recipient first downloads it, naming that recipient. We know it's them when they're signed in or use the link from their email. We keep these because it's in our and senders' legitimate interest to know transfers arrived and to spot abuse.
• Sign-in records and IP addresses, to protect accounts and limit abuse such as repeated sign-in attempts. That's in our legitimate interest, and yours.
• Your plan and payment status, and the payment updates Stripe sends us, which can include your billing details. We need these to provide your plan. When you buy from us, Stripe collects your billing address, and we keep the country you paid from, because tax law requires a record of where each sale happened. Stripe handles card details; we never see or store your card number.
• Which country your IP address is in, looked up in a database on our own server (IP Geolocation by DB-IP). It sets the currency you see, and when you subscribe it decides whether we or Onelink sell to you. If we can't tell your country, Onelink sells to you. Think we got it wrong? Tell us.
• If a sale we make directly has a billing address or card from a country where Onelink should have sold it, we're emailed the subscription and those two countries so we can check whether tax is owed there.
• How the service is used, to make it better and to set fair prices. Our server records the main things you do with your account, such as signing up, sending a transfer and subscribing, under your account number rather than your email. When you subscribe, that includes your IP country, the region you picked in the footer, and the billing address and card countries Stripe reports, so we can see whether our local prices work. Your plan and billing country are kept with your account number in PostHog. We never include your email, IP address, file names, titles, messages or links, but these records are tied to your account, so they aren't anonymous. That's in our legitimate interest, and the cookie choices don't change it; to object, write to us.
• Unless you turn analytics off, or you're somewhere we have to ask first and you haven't said yes, which pages you visit and which buttons you press in your browser, with your browser, device type, approximate location, the theme you picked, your plan, and the region and currency you're shown. We use it only to see what to improve, and never tie it to your account. Share links, emails, transfer titles and file names are removed in your browser before anything is sent. Where we ask first, this is based on your consent; elsewhere, on our legitimate interest in improving TransferKite.
• Where we ask first, until you say yes to more, which pages our server sends you: the page's address with any share link or other secret removed, the site you came from, your country from our own lookup, and whether you're on a phone or a computer. It's counted on our server, so nothing is stored on or read from your device, and it carries no ID, IP address or account, so it can't be joined up or tied to you. That's in our legitimate interest in seeing what to improve; you can object at any time, as described under Cookies below.
• Error reports from our server, to find and fix faults. They can include technical details and subscription references. That's in our legitimate interest.
• What you write to us, so we can answer it and deal with reports about transfers. That's in our legitimate interest, and sometimes the law requires it.

We need your email address to give you an account, your files and recipients to send a transfer, and billing details to sell you a plan. Without them we can't provide that part of TransferKite. Analytics are always optional.

Who helps us

• Railway hosts the app, the database and file storage, in its Amsterdam region in the EU. Stored files are encrypted at rest. Railway also runs a browser check on sign-in pages to stop bots, which looks at your IP address and browser and may set its own cookie.
• Cloudflare checks our sign-in form for bots with its Turnstile service, so nobody can use TransferKite to email people who didn't ask. When you ask for a sign-in code, a check runs in your browser and reads technical details from it, then sends Cloudflare your IP address, details about your browser and device, and which site you're on. Our server then asks Cloudflare whether the check passed and passes on your IP address. Opening the form alone sends Cloudflare nothing, and it never gets your email address or anything else you type. It uses these details on our behalf to tell people from bots, which is in our legitimate interest and in the interest of people whose email addresses could otherwise be misused. It also uses them for itself, to improve its bot detection, relying on its own legitimate interests. Cloudflare is responsible for that use, which its Turnstile privacy terms explain, and you can ask it about it at dpo@cloudflare.com.
• Stripe takes payments and keeps the record of your plan. If we give you a plan for free, we send Stripe your email address for it, even though you pay nothing. If you subscribe from outside the UK, the US, Canada, Australia, New Zealand, Switzerland, Japan, Singapore and South Africa, Onelink, a Stripe company, sells the subscription to you itself and handles its tax, receipts and payment support. Stripe, and Onelink for the sales it makes, also use payment details for their own purposes, such as preventing fraud and meeting their legal duties, under their own privacy policy.
• Resend delivers our emails, such as sign-in codes, transfer emails and requests for files. It sees the addresses and what's in each email, including a transfer's title, message and link, or a request's message and link, but never your files. It stores email data in the US.
• PostHog stores our usage analytics, and error reports from our server, on its servers in the EU (Frankfurt). Your IP address passes through to find your approximate location and isn't stored. PostHog never sees your files.

Railway, Stripe, Resend, PostHog and Cloudflare are based in the US, and some information may be handled there. Cloudflare runs its bot check on servers around the world, usually the one nearest you, so the details it collects may be handled outside the UK and EU, including in the US. Information handled outside the UK and EU is protected by the safeguards UK and EU law require for international transfers, such as the UK–US data bridge, the EU–US Data Privacy Framework or approved contract terms. Ask us and we'll tell you which applies and send you a copy.

How long we keep it

• A transfer stops working when it expires or when you delete it, and its files are then queued for deletion. Transfers sent on Creator and Pro are first kept for a recovery window, from 3 days up to a year depending on the plan and their size; our terms list them. Files another transfer still uses are kept for it, and a copy a recipient recovered into their own account isn't deleted with yours.
• Transfer details, including the email addresses you sent them to, stay in your Sent history after their files are deleted, until you ask us to delete your account.
• Files sent to a request are part of a transfer in the requester's account, so they go when it expires or the requester deletes it, like any transfer's, after any recovery window. The transfer's title names you, by address or label, and like any transfer's details it stays in the requester's transfer history after the files are deleted, until the requester's account is deleted. The request itself, with any address, label and message, stays in the requester's list of requests until they delete it, which they can do once it's closed, has run out or its files have arrived, or until their account is deleted. Deleting the request doesn't delete the transfer or change its title. Each of the counts above covers only its own window, 15 minutes for using a link and up to a day for sending requests, and is deleted at our next daily clean-up once that window ends.
• IP addresses, browsers and emails in download and sign-in records are kept for 12 months. After that, download counts stay but say nothing about who downloaded.
• We don't keep anything from Cloudflare's bot check; our server only uses whether it passed. What Cloudflare keeps for itself is covered by its Turnstile privacy terms.
• Analytics events, including the pages our server counts, and the anonymous count of answers to the cookie notice, are kept for one year, then deleted.
• Payment and tax records are kept for at least 6 years, for tax and in case of legal claims, and longer if a claim is still open.
• What you write to us is kept for as long as we need it to deal with what you asked, or with a related claim.
• Your account stays until you ask us to delete it, or until we close it because it broke our terms. We'll delete it within a month of your asking. Deleting it ends any plan straight away, signs you out everywhere, and deletes your transfers and their files, your requests for files and the addresses they were sent to, your sign-in records and your analytics. Files another account still uses, such as a copy a recipient recovered, stay with that account. We keep a note of your account number, when your account was deleted and why, but not your email address, and the payment records the law makes us keep. Your email address stays on transfers other people sent you, in their Sent history, and in their download records for 12 months.
• If we suspend an account while we look into a report, nobody can sign in to it and its links stop working, but nothing is deleted. Lifting the suspension brings it all back.

Cookies

We use one cookie to keep you signed in for up to 14 days, and one to remember for 30 minutes that you've unlocked a password-protected transfer. If you choose a region in the footer, a cookie remembers it for a year, and the same goes for a language. Your light, dark or system theme is saved in your browser. When you ask for a sign-in code, Cloudflare's bot check reads technical details from your browser, and Railway's own bot check may set a cookie. None of these track you, and they're needed to run TransferKite and keep sign-in safe, so they don't need your consent.

Analytics in your browser give it a random ID so a visit can be counted and its pages joined up. They're only used to see how TransferKite is used and what to improve, and they're never tied to your account. We never use them to build a profile of you for advertising, and never sell what they collect or share it with anyone; PostHog only stores and processes it for us, and can't use it for anything else.

• In the EU and EEA, in Canada, and anywhere we can't tell where you are, nothing runs in your browser until you say yes with Sure, or tick Count clicks too in Options. Until then, and if you choose No, just visits, our server counts the pages it sends you instead, as described above, with nothing on your device.
• Everywhere else, including the UK, visits and clicks are counted from the start without storing anything on your device: the ID is kept only in the open page and is forgotten when you reload or leave it, so no lasting record of you builds up. The notice's OK just hides it, and its Options let you turn counting off. Since the Data (Use and Access) Act 2025, UK law allows this without asking first for statistics used only to improve a service, as long as you're told and can easily say no.
• Once you say yes, PostHog's cookie and browser storage (named ph_…) keep the ID so separate visits can be joined up. The cookie lasts up to a year; the browser storage stays until you clear it or turn counting off.

You can object to visit counting at any time. Open Cookies at the bottom of any page and untick Count page visits or Count visits and clicks, and we stop counting your visits, on our server and in your browser. A browser that sends Global Privacy Control isn't counted either, unless you say yes while it's on.

To see how this notice is doing, we count each time it's shown and each answer to it (yes, no, or which options), with which version you saw and your country. That count includes no account, analytics ID, IP address or cookie, so it can't be linked to you, and it's kept even if you say no.

A cookie called analytics_consent remembers your answer for six months. If your browser sends Global Privacy Control, we take that as turning analytics off, even if you said yes before; only an answer given while it's on counts. You can change your choices at any time with Cookies at the bottom of every page. Turning counting off stops it straight away, in every open tab, and removes PostHog's cookies.

Your rights

You can ask for a copy of your information, ask us to correct it, delete it, limit how we use it, or send it to you in a format you can take elsewhere, and you can object to how we use it. Where we rely on your consent, you can take it back at any time. Write to hello@transferkite.com; we'll reply within a month. If you're unhappy with how we've handled your information, you can complain to the Information Commissioner's Office at ico.org.uk, or, in the EU, to the data protection authority where you live. You don't have to come to us first, but we'd like the chance to put it right.

To complain to us, write to hello@transferkite.com with what happened and what you'd like us to do. We'll confirm we've got it within 30 days, look into it, keep you posted and tell you the outcome.

Children

TransferKite is for people aged 18 and over. If you think someone younger has given us their information, tell us and we'll delete it.