Last updated: 11 August 2026
Your files never touch our servers. Zen-Share sends files directly from your device to the recipient. We operate no file storage, no user database and no accounts, so there is nowhere for us to keep your data even if we wanted to.
The desktop app turns your own PC into the server. It makes no analytics calls and reports nothing back to us.
| What happens | Where the data goes |
|---|---|
| Same-network sharing (Wi-Fi / LAN) | Nothing leaves your local network. Not to us, not to anyone. |
| Internet sharing (public link) | The recipient's browser connects directly to your PC using WebRTC. The file
does not pass through us. It is encrypted with AES-256-GCM before it leaves your
machine, and the key travels in the part of the link after the #,
which browsers never send to a server, so even a relay could only ever see
ciphertext. |
| Finding each other (signalling) | To introduce the two devices, the app opens a WebSocket to
signal.zen-share.online, which we run on Cloudflare. It carries only
the share ID and the connection offers the two sides need to find each other. It
never carries file contents, filenames or the encryption key. We do not log it. |
| Working out your public address (STUN) | Establishing a direct connection needs each side to learn how it looks from the outside. The app asks two public STUN servers, run by Cloudflare and Google. They see your IP address, which is unavoidable for any direct connection, and nothing else. |
| Relay fallback (TURN) | Some networks block a direct connection. When that happens the transfer can be relayed instead, and the relay sees encrypted bytes only, never the key. This is currently switched off, so today a connection that cannot go direct simply fails rather than being relayed. |
| When Internet mode is selected | The signalling connection above is opened when the app starts, not when you first share, so that a link is ready the moment you ask for one. If you would rather it made no connection until you act, choose Same-network mode. |
| Update check | On launch the app fetches zen-share.online/version.json to see
whether a newer build exists. That request carries nothing about you beyond the
IP address any web request carries. |
| Crash reports | If the app crashes it writes a log to your TEMP folder and asks whether to send it. Nothing is sent unless you say yes. The log names where the crash happened; it does not contain your files. |
| Password-protected shares | If you set a password, the encryption key and the filename are locked behind it using PBKDF2-HMAC-SHA256 at 600,000 iterations, and only that locked form goes in the link. The password itself is never stored, never sent anywhere, and cannot be recovered by us. If you lose it, the file cannot be opened. |
| App settings and keys | Stored locally in %APPDATA%\Zen-Share. Never uploaded. |
Transfers run device-to-device over your local network. We run no server in the middle.
Permissions, and why each one exists:
| Permission | Why |
|---|---|
| Local network / Wi-Fi state | To find nearby devices and transfer files to them. |
| Location | Android requires this permission before an app may read the Wi-Fi network name and IP address, which Zen-Share needs to show you which network you're sharing on. We do not use GPS, do not determine your location, and never store or transmit any location data. |
| Camera | Only to scan a QR code to connect to a device. No images are stored or sent. |
| Photos and files | To let you pick what to send, and to save what you receive. |
Advertising. The Android app is not published yet and the current build contains no ad code at all. When it ships it is intended to show ads through Google AdMob. AdMob may collect your advertising ID, IP address, device information and ad interactions in order to serve and measure ads. This is handled by Google under its own privacy policy, not by us. We receive only aggregate earnings totals, never data about individuals. You can reset or delete your advertising ID in your Android settings at any time.
| What | Detail |
|---|---|
| Download counter | We increment a single total number when someone downloads the app. No IP addresses, no identifiers, nothing tied to a person. |
| Email signup form | If you type your email into a form on this site, it is delivered to us by Web3Forms so we can reply. We use it for that and nothing else. |
| Ad on the recipient download page | When someone opens a Zen-Share link, the download page shows one ad from a third-party ad network. That network may set cookies and receive the visitor's IP address and browser type, which is standard for any ad on the web. The ad never has access to the file being transferred. |
Zen-Share is not directed at children under 13, and we do not knowingly collect personal information from them.
Because we hold no user records, there is generally nothing for us to look up, export or delete. If you sent us your email through a form and want it removed, email us and it's gone. For advertising data, use Google's controls linked above.
If this policy changes materially, we'll update the date at the top and note the change on this page.
Questions about privacy: ehsankhalifa@zen-share.online