ZapFile Privacy Policy

Effective date: 10 July 2026

ZapFile ("the app", "we") is a peer-to-peer file sharing application. This policy explains what information the app collects, how it is used, and the choices you have. The short version: we collect the minimum needed to run the service, the files you share travel directly between devices whenever possible, and we never sell your data or show ads.

1. Information we collect

Account information — your email address and a password. Passwords are stored only as salted cryptographic hashes; we cannot read them.
Device information — a device name/model and a push notification token, so your friends can see which device is online and so we can notify you of incoming files.
Friend connections — the list of accounts you have paired with using a pairing code or QR code.
Transfer metadata — file name, file size, sender, recipient, timestamps, and transfer status (for example accepted, completed, failed). This powers your transfer history.

2. Your files

File contents are transferred peer-to-peer over an encrypted WebRTC connection directly between your device and your friend's device. In this mode the bytes of your files never touch our servers.

If a direct connection cannot be established, the transfer falls back to an encrypted relay through our server. Relayed data is passed through in memory and is never stored, logged, or inspected.

3. Device permissions

Camera — used only to scan a friend's pairing QR code. No photos or video are captured or stored.
Photos / media / storage — used only to let you pick files to send and to save received photos, videos and files to your gallery or Downloads folder.
Notifications — used to alert you about incoming file offers and completed transfers.

4. How we use information

To operate the service: authentication, friend pairing, presence, and delivering file transfer offers.
To send push notifications about transfers addressed to you.
To maintain your transfer history inside the app.
To protect the service, including rate limiting and abuse prevention.

We do not sell or rent your personal data, use it for advertising, or use it to train machine-learning models.

5. Service providers

We rely on a small number of infrastructure providers to run ZapFile:

Render — hosts our backend server.
Supabase — hosts our database (account, friend, and transfer metadata described above).
Expo & Firebase Cloud Messaging — deliver push notifications to your device.

These providers process data only on our behalf to deliver the service.

6. Data retention and deletion

Account data, friend connections, and transfer metadata are kept while your account is active. You can delete your account and all associated data at any time from inside the app (Delete account at the bottom of the main screen — takes effect immediately) or by emailing us at the address below (completed within 30 days). See our account deletion page for details. Files saved to your device remain under your control and are unaffected.

7. Security

All communication between the app and our servers uses TLS (HTTPS/WSS). Peer-to-peer transfers are encrypted end-to-end by WebRTC (DTLS-SRTP). Passwords are hashed with bcrypt. No method of transmission or storage is 100% secure, but we work to protect your information using industry-standard practices.

8. Children

ZapFile is not directed at children under 13, and we do not knowingly collect personal information from children. If you believe a child has created an account, contact us and we will delete it.

9. Changes to this policy

If we make material changes to this policy, we will update this page and the effective date above. Continued use of the app after changes take effect constitutes acceptance of the updated policy.

10. Contact

For privacy questions, data deletion requests, or anything else, email sandip@roostoo.com.