Privacy Policy

1. Scope of this Policy

This Privacy Policy applies to the AnyTransfer website ("the Service"), including any subdomains, dashboards, and APIs operated by us. By uploading files, creating an account, or visiting our website, you acknowledge that you have read and understood this Policy in full.

2. Information We Collect

We collect information in the following categories:

• Account information: When you sign up we store your name, email address, hashed password, and OAuth profile data (if you log in via Google).
• Uploaded files: Any file you upload is stored on our servers together with its original filename, size, type, and a unique ID used to generate share links.
• Usage data: We automatically record your IP address, browser type, device information, and page requests for security, anti-abuse, and analytics purposes.
• Verification data: One-time passwords (OTPs) sent via email are stored only for the duration of the verification attempt and deleted immediately after use or expiry.
• Communications: Any emails or support tickets you send us are retained for customer service records.

3. How We Use Your Information

Your information is used to:

• Provide, operate, and maintain the file upload, storage, and sharing features.
• Authenticate your account and protect against fraud, spam, and unauthorized access.
• Send you transactional emails such as OTP codes, password reset links, and important service announcements.
• Monitor and analyze usage trends to improve performance, features, and user experience.
• Comply with applicable laws, regulations, and valid legal requests from authorities.

We do not sell your personal data to third parties. We do not use the contents of your uploaded files for advertising, profiling, or machine learning training.

4. File Storage & Access

Uploaded files are stored in our uploads/ directory and referenced by a unique random token ID in the database. A file is private by default — it can only be accessed by you when signed in, or by anyone who holds the unique share link you generate.

For guest uploads (uploads without an account), the file is associated only with the IP address used at upload time. Only holders of the share link can access or download the file; there is no dashboard or file listing for guests.

Share links do not expire by default on the Free plan. On paid plans you can optionally set an expiry date or revoke a link at any time from your dashboard. Deleting a file immediately invalidates all share links pointing to it.

5. Sharing & Disclosure

We may share your information only in these limited circumstances:

• With your consent: When you explicitly choose to share a file link, the recipient can view and/or download that specific file (and nothing else in your account).
• Service providers: Trusted vendors (e.g., hosting, email delivery, database backups) who are contractually required to keep your data confidential and only process it on our behalf.
• Legal compliance: When compelled by a valid court order, law enforcement request, or regulation. Where legally permitted, we will attempt to notify you before disclosing data.
• Business transfers: In the event of a merger, acquisition, or asset sale, your data may transfer as part of the transaction, subject to the same or equivalent privacy protections.

6. Data Security

We take a layered approach to security:

• Passwords are hashed with PHP's native password_hash() using bcrypt / Argon2, never stored in plaintext.
• Sessions use secure, HttpOnly, SameSite=Lax cookies.
• CSRF tokens protect all authenticated state-changing requests.
• File access controls prevent directory traversal and unauthorized file enumeration.
• Database credentials are stored outside the web root in config.php.
• All traffic should be served over HTTPS in production (TLS 1.2+ recommended).

No method of transmission over the Internet is 100% secure. We implement industry-standard protections but cannot guarantee absolute security.

7. Data Retention

Account records are kept for the lifetime of your account. Upon permanent account deletion, all personal data and associated files are removed from our live system within 30 days, except where longer retention is required by law (e.g., tax records, fraud logs).

Guest uploads (no account) are retained indefinitely unless the user reports the file for takedown or the file is flagged by our automated abuse systems.

OTP and login-attempt records are retained for a maximum of 90 days.

8. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access a copy of the personal data we hold about you.
• Request correction of inaccurate or incomplete data.
• Request erasure of your account and uploaded files ("right to be forgotten").
• Restrict or object to certain types of processing.
• Receive your personal data in a portable, machine-readable format.
• Withdraw consent at any time, where processing is based on consent.

To exercise any of these rights, contact us using the details in Section 12. We respond to verifiable requests within 30 calendar days.

9. Cookies & Tracking

We use a small number of essential cookies and local storage to operate the Service:

• PHPSESSID — Required for session handling and staying logged in.
• anytransfer-theme — Remembers your light / dark theme preference (stored in localStorage, not sent to the server).

We do not use third-party advertising cookies, cross-site trackers, or analytics pixels. For more details see our separate Cookie Policy.

10. Children's Privacy

The Service is not directed to children under 13 years of age, and we do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal data, contact us and we will promptly remove the information.

11. Changes to this Policy

We may update this Privacy Policy from time to time. Material changes will be posted on this page with a revised "Last updated" date, and — where appropriate — notified via email or an in-app banner. Your continued use of the Service after changes take effect constitutes acceptance of the revised Policy.

12. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or your data, please contact:

We aim to acknowledge and respond to all legitimate privacy inquiries within 30 days.