Privacy

1. Who is responsible

File Transfer - Tool - by Alexandru Jungean (“the service”) is an operator-gated, expiring file-transfer tool at https://transfer.alexjungean.com. The data controller is Alexandru Jungean, a natural person. Contact: alex.jungean@gmail.com. Portfolio: https://alexjungean.com.

This policy explains how personal data is processed when you visit the site, unlock the operator session, create a transfer, open a capability link, preview or download a file, or submit an abuse report. It is issued under Regulation (EU) 2016/679 (GDPR), Romanian Law no. 190/2018, and the ePrivacy rules implemented in Romania by Law no. 506/2004.

2. What this service is — and is not

Only the operator can create a transfer. There is no public account, no sign-up, no payments, no email delivery, and no marketing list. Recipients use a capability link. The app reads proofs from the URL fragment only and sends them in a same-origin POST body. This service does not promise anonymity, malware scanning, or end-to-end encryption. A password is an extra gate, not encryption of the stored object.

3. Categories of data

3.1 Data you provide

• Transfer options: optional title (up to 100 characters), optional recipient message (up to 2,000 characters), optional password (8–128 characters). The password is stored only as an Argon2id hash. The password itself is never stored.
• File metadata: declared filename, size, media type, optional SHA-256 checksum, and a client object id. Filenames and text are treated as untrusted.
• File bytes uploaded to a private Cloudflare R2 bucket in the EU.
• Abuse reports: only a parsed public ID. A pasted proof or full capability URL is not stored.
• Operator unlock: the secret is verified and discarded. It is not written to the database.

3.2 Data we generate

• Public ID (32-character hex), HMAC verifiers for download and delete, key version, expiry, state timestamps, idempotency keys, object keys, detected media type, and previewability.
• Tombstones after delete or expiry (public ID, verifiers, key version, terminal state, retain-until).
• Cleanup outbox items (object kind, object key, attempt count, error class).
• Operator session cookie send_op: an HMAC ticket bound to an expiry timestamp, not the operator secret.

3.3 Data collected automatically

• Client IP is read from the hosting edge to apply rate limits. The durable limiter stores a SHA-256 partition of that source, not the raw IP, in application artifacts.
• Application logs use route templates, method, status, latency, and coarse error class. They omit proofs, passwords, filenames, titles, messages, object keys, and public IDs.
• Hosting and CDN access logs (Netlify, Cloudflare) may still record request paths, query strings, IP addresses, user-agent, and timestamps. A first visit that puts a proof in ?proof= can appear there. Middleware then redirects to the path only and does not put the proof back into the URL.

We do not run marketing analytics, advertising pixels, or social trackers.

4. Purposes and legal bases

Legitimate interests are balanced against your rights. You may object under Article 21 where that basis applies. There is no marketing, so there is no marketing consent to withdraw.

5. Cookies

The only cookie this application sets is send_op. It is httpOnly, SameSite=Strict, Path=/, lasts 12 hours, and is issued only after a successful unlock on /operator. In production it is marked Secure. There is no marketing analytics cookie. Details are in the cookie policy.

6. Recipients and processors

Recipients who receive a share link can inspect metadata and download files until expiry, delete, or revoke. A person who has the delete proof can delete the transfer. Competent authorities may receive data when the law requires it.

7. International transfers

File bytes and the application database are stored in the EU. Compute and access logs may be processed by Netlify outside the EEA. Mail sent to the published contact address is handled by Google as an independent mailbox provider; there is no separate DPA for that consumer mailbox. Where a transfer to a country without an adequacy decision occurs, it relies on GDPR Chapter V safeguards, typically the European Commission’s Standard Contractual Clauses with the hosting provider, plus the technical measures described here (no analytics SDK, capability denylist in application logs, private bucket, short retention).

8. Retention

• Files: authorization ends at expiry (default and maximum 7 days), recipient delete, or operator revoke. Physical removal completes within 24 hours. An R2 lifecycle rule is a delayed safety net (10 days on staging and final prefixes).
• Transfer rows are wiped after they become terminal. Tombstones are kept for 691500 seconds (maximum lifetime plus the cleanup SLA plus a clock skew buffer) so a public ID cannot be reused while a verifier is still meaningful.
• Abuse reports stay until the operator deletes them after review. There is no automatic purge of that table.
• Rate-limit windows are hourly. The operator cookie lasts 12 hours.
• Hosting logs follow the provider’s own retention.

This is the seven-day expiry published on the product: there is no unlimited retention.

9. Security

Access to create, upload, and finalize requires the operator session. Recipients need the matching proof, and a password if one was set. Objects are private. Uploads target random staging keys; finalize promotes to a random final key. Application logs follow a denylist. TLS is used on the public site. These measures reduce risk. They do not make the service anonymous or immune to a leaked share link, a first-hit query-string proof in a CDN log, or a lawful request.

10. Your rights

If you are in the EEA, the UK, or another jurisdiction that grants equivalent rights, you may ask for:

• access (Art. 15);
• rectification (Art. 16);
• erasure (Art. 17);
• restriction (Art. 18);
• portability where Art. 20 applies;
• objection to processing based on legitimate interests (Art. 21);
• a complaint to a supervisory authority (Art. 77).

Write to alex.jungean@gmail.com. Do not paste proofs or full capability URLs in email. For a transfer, send the public path or public ID only. We will need enough information to find the relevant row. Some rights will not apply where we no longer hold the data (for example after expiry and wipe) or where we cannot identify you (for example a recipient who never contacted us).

You may complain to the supervisory authority of your habitual residence, place of work, or the place of the alleged infringement. If the controller is established in Romania, the Romanian authority is ANSPDCP (Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal), dataprotection.ro.

We do not use automated decision-making that produces legal or similarly significant effects.

11. Children

The service is not directed at children. Romania’s digital-consent age under GDPR Article 8 is 16. Do not use the service to send files to or about a child in a way that is unlawful. We do not knowingly collect account data from children because there are no accounts.

12. File contents and third-party data

Files may contain personal data of people other than the operator. The operator who uploads is responsible for having a lawful basis to share those files. Recipients must use downloaded files only as the law and the sender allow.

13. Changes

We will update this policy when the processing changes. The effective date at the top is the current version. Material changes will be published on this page before they apply to new transfers.