Privacy Policy

I Love Doc operates ilovedoc.org, a browser-to-browser file transfer service. This policy covers the website, the transfer service, and the relay infrastructure we operate. It applies whenever you send or receive files, or simply browse the site. Where required by law (including the GDPR for users in the European Economic Area and the CCPA/CPRA for California residents), the operators of the Service act as the controller of the small amount of data described below.

Because transfers are peer-to-peer, entire categories of data that most services collect simply do not exist here:

• File contents. Bytes travel over the WebRTC data channel between the two browsers. Our servers coordinate the connection; they do not carry the payload.
• Plaintext passwords. If a sender protects a transfer, the password is hashed in the sender’s browser with scrypt and a random salt. Only the hash is sent to us — and only so the receiver’s unlock can be verified.
• File integrity hashes. The SHA-256 fingerprints used to verify each file are computed on both ends and compared between the browsers. They are not stored on the server.
• Identity data. No accounts, no email addresses, no profiles, no contact lists. The only optional personal input is a display name the sender may attach to a transfer.
• Browsing behavior. No analytics, no ads, no session recorders, no fingerprinting scripts, no third-party trackers of any kind.

A coordination server has to see something to coordinate. Here is the complete inventory, with why each item exists and how long it stays:

The public statistics shown on the home page (transfers created, deliveries completed, files and bytes moved) are aggregate totals that cannot identify any transfer or person.

I Love Doc uses WebRTC, the same standard that powers browser video calls. Two things follow from that, and we would rather explain them than gloss over them:

The connection is end-to-end encrypted

WebRTC traffic is encrypted with DTLS between the two browsers. On the normal (direct) path, only those two devices ever see the file bytes. The app's connection badge shows “Direct P2P” when this is the case.

Peers can see each other's IP address

As with any direct connection, the sender and the receiver learn each other's network addresses during connection setup. That is inherent to connecting two browsers directly — it is also what removes the middleman from your file traffic.

STUN helps browsers find each other

We use public STUN servers (operated by Google and Cloudflare) for address discovery. Their operators can see that a connection attempt happened, but never any file data. Their own privacy policies apply to their infrastructure.

Relay fallback, honestly labeled

When a firewall or carrier-grade NAT blocks direct connections, traffic may be routed through an encrypted TURN relay. The relay forwards encrypted bytes it cannot decrypt, and the app's badge changes to “Secure relay” so you always know which path you are on.

Some conveniences live entirely in your browser’s local storage. They are never transmitted to us, never leave your device, and you can clear each of them from the app itself:

ilovedoc:recent-v1

The sender's “recent transfers” list — a short local history of sessions you initiated, with a clear button in the app.

ilovedoc:received-v1

The receiver's “recently received” list — same idea, for sessions you accepted. Also clearable with one click.

theme

Whether you prefer light or dark mode.

The Service sets no cookies — there is no login to remember and nothing to track. We run no analytics or advertising SDKs, load no third-party scripts, and perform no cross-site tracking or fingerprinting. Even the fonts are self-hosted. The only third parties your browser talks to are the public STUN servers (and, only if a direct connection fails, the encrypted relay) as part of the WebRTC connection setup described above. The “Do Not Track” signal and browser privacy settings need no special handling here because there is nothing to opt out of.

Retention in the Service is mechanical, not aspirational:

• Expiry is enforced, not promised. Share links stop working the moment they pass their expiry (1 hour to 7 days, as chosen by the sender). After that, the session cannot be joined or resumed.
• Metadata is purged automatically. A scheduled sweep deletes every record of a transfer — metadata rows, hashed credentials, and lifecycle events — within 7 days after the transfer expires. Deletion is cascading and permanent; nothing is moved to a soft-delete state.
• Rate-limit state lives in memory for minutes and disappears on its own.
• Device-local history (recent sends and receives) stays until you clear it, because only your browser ever had it.

We may retain minimal records beyond this window where we are legally required or permitted to (for example, to respond to a lawful request or to investigate abuse), and standard server access logs are kept only as long as operationally necessary for security.

If you are in the EEA, UK, or Switzerland, we process the data described above on the grounds of performance of a contract (running the transfer you asked for) and legitimate interest (rate limiting, abuse prevention, and keeping the service secure and available). If you are a California resident, the CCPA/CPRA applies; we do not sell or share personal information as those terms are defined, and there are no advertising cookies to opt out of.

What you can do

• Let it expire. Most rights here are exercised automatically: the data that identifies a transfer is gone within 7 days of expiry, without anyone asking.
• Ask us. You may request access to or deletion of a specific record while it still exists — include the share link or code so we can find it — by writing to [email protected].
• Complain. You have the right to lodge a complaint with your local data protection authority.

We do not carry out automated decision-making or profiling — there is no profile to make decisions about.

The Service is not directed to children under 13, or to EEA users under 16, and we do not knowingly process their personal data. Because there are no accounts, we have no way to know a user’s age; if you believe a child has used the Service and want a record removed, write to [email protected] — the normal retention sweep will in any case delete transfer metadata within 7 days of expiry.

The Service is available globally, and a transfer can connect browsers in any two countries — that is rather the point. In the normal (direct) case, file data crosses whatever borders those two devices sit behind, without passing through us. The coordination data described above may be processed in the country where our servers are located; where that country is outside the EEA, UK, or Switzerland, we rely on the applicable safeguards for the limited, non-content metadata involved.

If we change what the Service processes, we will update this page and its “last updated” date before the change takes effect. The current version is always published here: ilovedoc.org/legal/privacy.