Privacy at todevice

File contents

Encrypted in your browser before upload with AES-256-GCM.

Filenames and file metadata

Encrypted together with the file.

Text-drop contents

Encrypted the same way as files.

Encryption keys

Generated on your devices and never sent to us. The private half cannot leave the browser it was created in.

Encrypted package size

We store the ciphertext, so we know how big it is.

Transfer timestamps

When a transfer was created, uploaded, and downloaded.

Device identifiers

Which of your devices sent and received a transfer.

Account information

Your email address and plan.

IP addresses and basic service metadata

Standard operational logs, kept briefly.

Encryption in a browser means trusting the site

Your browser downloads the encryption code from us, and we publish the directory of device keys that senders encrypt to. So our security is part of yours: if our systems or build pipeline were tampered with, altered code or a substituted key could reach you. This is true of every service that encrypts inside a browser, including password managers and encrypted mail — it is exactly why we never claim we are physically unable to read your files. What we do about it: no third-party scripts anywhere, a strict Content Security Policy that blocks anything we did not serve, few dependencies, and a published security model. If your threat model includes someone targeting us specifically to reach you, a native, independently audited tool is the more honest choice than any web app.

Your device identity lives in browser storage

Each paired device generates a non-exportable key inside the browser. Clearing this browser's site data removes that identity and any pending items for it — you would pair the device again. Browsers can also evict stored data on their own when storage runs low.

View-once removes our copy, not their memory

When you open a view-once text, the encrypted copy on our servers is deleted once your device confirms it decrypted. It cannot stop the person reading it from copying or photographing what they saw. If the confirmation never reaches us, the copy is deleted at expiry instead.

Transfer metadata is kept briefly

Sizes, timestamps, and delivery status — never filenames — are retained for up to 7 days for reliability and abuse prevention, then deleted automatically.

Two counters on your account outlive that

We keep a running count of how many transfers your account has completed, and which weeks it was active in. That is how we tell whether todevice is actually useful to anyone. It is two numbers — no sizes, no times of day, no filenames, no record of which device or person. We are calling it out here rather than letting it hide behind the 7-day line above.

Deleting your account leaves a deactivated record

Deleting your account removes your devices, your sessions, and anything still in flight, and permanently prevents signing in again. What stays is a deactivated record holding your email address and the two counters above, so the address cannot be quietly re-registered by someone else. We would rather describe that accurately than claim a clean erase we do not perform.

Security events are kept for 90 days

Sign-ins, devices added or removed, and passkey changes are recorded so you can review them on your account, and that log is kept for 90 days — longer than the 7 days above. It records the event and the device name you chose, never file contents or filenames.