We never store your files. Peeza is a conduit: file bytes stream between two devices that are online at the same time, end-to-end encrypted with a key our servers do not receive — with one exception, when you ask for it, and two places where you trust our servers: the web page that decrypts in a browser and the first key for a new device. There is no cloud copy of your files — nothing to store, subpoena, or leak.
To route transfers and run accounts, our relay keeps the metadata below — the same list as what the relay sees in our published protocol. It never keeps file contents. It never keeps an encryption key either; the one time it holds one is when you ask for a link, for 30 seconds, in memory.
| Data | Why | Kept for |
|---|---|---|
| Account (email, identity provider, display name, the web address of your Google or GitHub profile picture, plan, language) | your account | while your account exists — deleting it removes it |
| Session token | keep you connected | until you disconnect or delete your account, or 90 days without use |
| Share link (token, room, timestamps) | deliver a one-time link | 48 hours, then deleted |
| Your devices (name, OS, version, public key) | "send to my devices" | until you remove the device or delete your account |
| Directed-send envelope (sealed key, opaque to us) | hold a transfer for an offline device | 7 days, then deleted |
| Connectivity metrics (direct-vs-relay, timings) | improve reliability | anonymous — no account, room, or IP |
| Crash reports (app and system version, device model, day, where in our code it crashed) | fix crashes | newest 200, plus a count per kind of crash — no account or IP |
| Bug reports (what you wrote, an optional contact, app version and device, your account email if connected) | fix what you reported, and reply | 90 days, then deleted. The GitHub issue we file keeps your description and the app details, never your email or contact |
| Encrypted backups of the above | recover the relay after a failure | 30 days, then deleted |
| Relay logs (events with account or device ids — never IPs, tokens, links or keys) | find and fix problems | 7 days, at our host (Fly.io) |
| Disconnect links sent in device-connection emails (with the device's name as it reported itself) | let you disconnect a device from the email | 30 days and one use, then deleted — and deleted with your account |
| Teams (name, owner, invite code; for each member: account, email address, role, and the devices they put in the team) | share files with a team | while the team exists — a team goes with its owner's account, a member's seat with theirs |
| Team catalogue (for each file shared with a team: its name, size, whether it is a folder or bundle, who shared it from which device, and when — never its contents or key) | let teammates fetch a file later, from whoever holds it | up to 250 files per team, oldest out first; removed with the team, or with the seat of the member who shared it |
| Dashboard mirror (each connected device's transfer list: file names, sizes, status, the other device's name — never keys, link fragments or local folder paths) | show and control your devices from the web dashboard | in memory only, while the device is connected; gone when it disconnects or the relay restarts |
| Each transfer (the IP addresses of both devices, the time, the size, the file's modified time, whether it is a folder or bundle; for a relayed transfer, the encrypted frames as they pass) | connect the two devices, forward what cannot go direct, and count relay use | in memory only, for the life of the transfer; its size is added to your usage counters |
| Sender proof (a SHA-256 hash of a random secret the relay gives the device that opened a transfer) | tell that device apart from anyone else who knows the transfer's id | in memory only, for the life of the transfer |
| If you send without an account: a keyed hash of your device's random installation id — never the id itself — with how much it relayed | apply the free relay allowance, and nothing else | 30 days |
Our own software uses your IP address only in memory, for four things: carrying a transfer between two devices (when they connect directly, each also learns the other's address), rate limiting (to keep the free relay fair), and, when you connect a device to your account, comparing the network the device connects from with the network of the browser you connected in, to catch a connection someone else started — kept for that at most 15 minutes; and comparing the networks your own signed-in devices connect from, so the app can show which of them is on the same network as the one in your hands — the answer is only yes or no, and no address is passed on. The relay application never writes it to disk and never includes it in application logs; it is discarded when the relay restarts. For the second use, the relay looks up the address's country and network operator in a database it holds itself (IP geolocation by DB-IP) — no one else is asked — and only those, never the address, appear in the emails below.
The infrastructure that carries the traffic is a separate matter, and we won't pretend otherwise: our relay runs on Fly.io and this website is served through Cloudflare. Like virtually all hosting providers, they process and may temporarily log connection IPs to deliver traffic, prevent abuse, and keep their networks running, under their own privacy policies (Fly.io, Cloudflare). We do not receive or use those logs.
When a transfer tries to connect two devices directly, the peeza apps, and the web page that opens a peeza link in a browser, ask public STUN servers which address the device has on the internet: stun.l.google.com and stun1.l.google.com, operated by Google, and stun.cloudflare.com, operated by Cloudflare. Each of them sees the device's public IP address at that moment, and nothing about the file, its name, or your account, under its operator's own privacy policy (Google, Cloudflare).
Your account picture is drawn by the app itself, from outside image servers. If you connected with Google or GitHub, our relay keeps the web address of the profile picture that service gave at sign-in — never the picture itself — and your device loads it from Google's or GitHub's image server. If there is none, or it does not load, the app asks Gravatar, operated by Automattic, for a picture tied to a fingerprint of your email address (its SHA-256 hash, never the address), and otherwise shows your initials. Each of those servers sees your device's public IP address and which picture was asked for, under its operator's own privacy policy (Google, GitHub, Automattic).
When a device connects to your peeza account, we email your account's address to say which device, and from which country and network operator, with a link to disconnect it. When the device is on a different network from the browser you connected in, the email asks you to approve it instead, and the device waits until you do. When your account first joins the waitlist, we email you once to say you're on the list, with the links to join the iPhone and Android betas; when it comes off the waitlist, we email you once to say so, with the links to install peeza. Both are in the language of the browser you last connected in. These emails are delivered by Resend (privacy policy), which receives your email address and the message for that purpose only. They are the only emails peeza sends today.
Paid plans are processed by our merchant of record, who acts as the seller of record and handles billing and applicable taxes. We receive confirmation of your plan, not your full payment details.
Product analytics are off by default and opt-in; if enabled, they contain no identifiers and no file names — only aggregate, day-bucketed counts. The share site (g.peeza.app) carries no analytics of any kind.
Crash reports are sent automatically, so a crash gets fixed without anyone having to report it. A report contains only: which peeza app crashed and its version, the operating system version, the device model (for example “iPhone17,1”), the day it happened, the kind of crash with a short description (such as “index out of range”), and where in peeza’s code it happened (program names with code offsets or function names). It never contains your account, your IP address, a device identifier, your language or region, file names or paths, or anything from your files: paths, network addresses, e-mail addresses and similar details are removed on your device, and again on our server, before anything is kept. Our relay keeps the 200 most recent reports and a count per kind of crash, and opens one private issue per kind of crash in our code tracker (GitHub). You can turn crash reports off at any time with the “Send crash reports” switch in the app’s settings — on a Mac, Settings › General; on an iPhone or iPad, the settings at the foot of your account screen; on Android, the settings on the Account tab — or from a command line with peeza config set crashReports=false, and turning them off also deletes any report still waiting to be sent.
This marketing website (peeza.app) uses privacy-friendly, anonymous traffic statistics; a cookie banner lets you decline non-essential cookies.
peeza is also available as an app for Android, through Google Play. Everything above applies to it; a few things are specific to Android.
Scan QR uses Google's code scanner, which runs inside Google Play services rather than inside peeza: the camera view is Google's, peeza asks for no camera permission, and peeza receives only the text of the code that was scanned. Google collects its own diagnostics about that component (such as the device model, the operating system and app versions, and per-installation identifiers) under Google's privacy policy.
Google Play Protect, part of Android, may scan the apps installed on a device, peeza included. That is a behaviour of the platform, not something peeza does or controls.
While a transfer is moving, the Android app runs a foreground service — what lets the transfer carry on when the app is not on screen — with a notification for as long as it runs (if notifications are allowed for peeza). It stops by itself when the transfer ends, does not run otherwise, and never starts from the background. The Android app sends crash reports as described under Telemetry & crash reports, including when Android stops the app because it is not responding.
You can access, correct, export, or delete your data — for most users that's an email address, a usage counter and the devices they connected; if you use teams, also the teams you are in and the files shared there (the table above). You can delete your account yourself, in any peeza app (Account › Delete account…) or in the web dashboard's account menu. For anything else, email [email protected]; we respond within 30 days. EU users have a right to a representative and to lodge a complaint with a supervisory authority; where we have no EU establishment we appoint an Article 27 representative (details to be listed here on publication).
Deleting your account removes it immediately from our relay, together with your sessions, your devices, your share links, the teams you own (for all of their members), your place in other teams and what you shared there, your referral links and the bug reports you filed while connected. A subscription you bought from us on the web is cancelled first; if it cannot be, nothing is deleted and the app tells you. One thing is kept: if you paid for relay top-ups, a record of each payment — its date, amount and payment reference, with no name, email or account attached — for up to 18 months, so that a payment dispute can still be answered. Our payment provider keeps its own records of your payments under its own policy. Deleted data leaves our encrypted backups within 30 days, as they rotate, and a bug report that was already filed as a GitHub issue is removed on request to [email protected].
Peeza is operated from Montréal, Québec. As required by Québec's Loi sur la protection des renseignements personnels dans le secteur privé (as amended by Loi 25), the person responsible for the protection of personal information is the operator of peeza (title: Responsable de la protection des renseignements personnels). Reach them at [email protected] for any question, request, or complaint about how personal information is handled. Complaints are answered within 30 days.
The relay runs on Fly.io, on one server in the United States (Ashburn, Virginia); this website is served through Cloudflare; account emails are delivered by Resend. Signaling and relayed traffic from every country, the EU included, passes through that server. File contents cross it encrypted, under a key it is not given (the limits), and are never stored. The metadata in the table above is processed there too, in readable form — including, for a connected account, the names of files in your dashboard and your teams. So this processing happens on servers outside Québec, Canada and the EU.
peeza is for people aged 16 and over, the minimum age set in our Terms of Service.
We cannot see file contents (the limits of that are in our published protocol). Report abuse — including child-safety concerns — to [email protected]; our only remedy is invalidating a share link, and we preserve and report as required by law. See also Security.
Privacy questions or requests: [email protected].