Privacy Policy

1. What we collect

When you use TrunkTransfer, we collect only what is necessary to provide the service:

• Account data: email address and password (hashed) if you create an account.
• Transfer metadata: file name, file size, upload timestamp, expiry date, and download count. We do not read file contents.
• Usage data: IP address (for rate limiting), browser type, and pages visited. This data is not sold or shared.
• Payment data: handled entirely by Polar. We never see or store your card details.

2. How we use it

• To operate the file transfer service.
• To enforce plan limits and rate limits.
• To send transactional emails (account confirmation, password reset, download notifications).
• To process subscription payments via Polar.

We do not use your data or uploaded files to train AI models. We do not sell your data to third parties.

3. No AI training. Ever.

We do not use your uploaded files to train, fine-tune, or evaluate any AI or machine learning model, ours or anyone else's. This applies to every file, on every plan, at all times. No exceptions.

Technically, this is enforced by architecture: files travel directly from your browser to private object storage without passing through our servers. We never have access to file contents, only metadata (file name, size, expiry). There is nothing to train on.

Files are permanently and irreversibly deleted after expiry. No backups, no archives, no copies retained for any purpose.

4. File storage

Files are stored on private, secure object storage. Download links are temporary and generated at the moment a recipient clicks download. Free plan links are valid for 4 hours and Starter plan links for 12 hours. Transfer links expire based on your plan (7 days free, 30 days Starter). After expiry, files are permanently and irreversibly deleted. Your files are never used for AI training or any purpose beyond delivering them to your intended recipient.

5. Third-party services

• Supabase: authentication and database.
• Object storage provider: file storage (private, no public access).
• Polar: subscription and one-time payment billing.
• Resend: transactional email delivery (download notifications, account emails).
• Vercel: hosting and edge functions.
• PostHog: anonymous product analytics (page views, feature usage). No personally identifiable data is sent.

6. Your rights

You can delete your account and all associated data at any time from the Settings page. Deleting your account permanently removes your profile, transfers, and all files stored on our servers. For data requests or questions, contact us at khulanwar@trunktransfer.com.

7. Cookies

We use only a single session cookie to keep you logged in. We do not use advertising cookies or tracking pixels.

8. Changes

We may update this policy occasionally. Significant changes will be communicated via email to account holders. Continued use of the service after changes constitutes acceptance.