Privacy

flies is built so that the people running it cannot see what you send. Here is what the server handles, what it keeps, and what stays in your browser.

What the server never sees

Your files, your text, and their names travel directly between the two paired devices over an encrypted connection. They are not uploaded, never stored on a server, and not visible to flies at any point. When a direct connection is not possible, the data passes through a relay that only ever forwards encrypted packets it cannot read. You can forbid that relay in settings.

What the server handles to connect you

• A pairing code and a session token, held for the length of the session (about 15 minutes) so the two devices can find each other.
• Connection-setup messages — the WebRTC “signaling” (SDP and ICE data) — relayed between the two devices and not stored.
• Your IP address, which the other device sees. This is inherent to any peer-to-peer connection.

The server is a Cloudflare Worker. It allocates codes, relays signaling, serves these pages, limits how often codes can be created or tried, and sends each visitor to their language.

What the server keeps

Three things are kept after your session ends:

• The rate limiter stores the time of recent failed join attempts and session creations, keyed to a coarse form of your network address (IPv6 is grouped into a /64 block), for the length of its sliding window. This is what stops someone trying codes in bulk.
• Cloudflare retains ordinary request metadata (timestamps, coarse location, user-agent) as part of running the service, under Cloudflare’s privacy policy.
• Usage statistics, if you share them, described in the next section.

Usage statistics

To know how flies is used, your browser reports page views and sessions. You can turn this off in settings, and nothing is sent when your browser uses Global Privacy Control.

Page views are counted by Cloudflare Web Analytics, which sets no cookie and does not fingerprint your browser. It records the page, the site that linked to it, your country, and your browser, operating system and type of device, under Cloudflare’s privacy policy.

A session report describes this device’s side of the session only:

• Whether it created or joined the session, how far the session got, and whether it failed.
• The kind of connection: same network, direct over the internet, or relayed.
• How many bytes of files it sent over each kind of connection, and how many files and texts it sent, received, canceled, or failed to send.
• How long the session lasted.
• Its connection setting, and whether it skips the safety check.

The server adds your country and a description of your browser: its name and main version number, your operating system, and whether the device is a phone, a tablet or a computer. It then stores the report in Cloudflare Workers Analytics Engine for three months.

A session report never contains your files, your text or their names, the pairing code, your IP address, the full User-Agent string, or any identifier. Nothing is stored on your device to recognize it, so two reports cannot be linked to each other or to you.

What stays in your browser

• Your settings (which connections are allowed, whether to skip the safety check, and whether to share usage statistics) are saved in this browser’s local storage. They reach the server only inside the usage statistics described above.
• How many bytes this device has sent through the relay this month, so it can apply its own monthly relay allowance. The count resets each month and is never sent to the server.
• Your theme choice, if you change it from the system default.
• If you pick a language in settings, a cookie named NEXT_LOCALE remembers it for a year, so the right language loads on your next visit. It holds nothing but that choice.

What flies does not do

• No accounts, and no cookies beyond the language one above.
• No advertising, no cross-site tracking, and no analytics beyond the usage statistics above.
• No selling or sharing of data, and no profile of you.

Third parties

Cloudflare hosts the site and runs the signaling Worker. If a direct connection fails, a TURN relay — Cloudflare’s, or one configured by whoever deployed this instance — forwards encrypted packets between the two devices without being able to read them. No other third party is involved.

Changes

If this policy changes, the “last updated” date above changes with it. There are no accounts to notify.

Contact

Questions about privacy: hello@itflies.app.