Skip to content

Privacy

Privacy Policy

Last updated:

WarpSend (“we”, “our”, “us”) respects your privacy. This Privacy Policy explains what personal data we collect when you use WarpSend, how we use it, and the rights you have over it. It applies to our website (warpsend.io), the WarpSend iOS, Android, desktop and NAS applications, and all related services (collectively, the “Service”).

1. Personal data we collect

We collect the following categories of personal data:

  • Account data — name, email address, hashed password, and any organization details you provide when you sign up.
  • Billing data — payment method information (handled by our payment processor), billing address, and invoice history. Full card numbers are never stored on our servers.
  • Usage data — aggregate metrics such as bytes transferred, storage consumed, transfer counts, device types, and app version. We use this to enforce storage limits and UDP endpoint speed limits, prevent abuse, and improve the Service.
  • Communication data — messages you send through our support channels or contact forms.
  • Technical data — IP address, user agent, and the basic server logs needed to operate the Service securely.
  • Website analytics — how visitors use warpsend.io, collected with Google Analytics as described in Section 3.

A successful direct endpoint tunnel does not store the file payload in our cloud storage. WarpShare, File Requests, and transfers that use WarpFabric staging do store file content so it can be retrieved or delivered. Stored cloud objects are encrypted at rest with AES-256 and removed according to the applicable retention rules in our Terms of Service.

End-to-end encryption depends on the transfer route and settings. On supported routes, content is encrypted before transfer and the service does not receive the recipient’s decryption keys. File Requests offer this protection when the owner enables it with WarpSignet. Current password-protected browser uploads to WarpShare keep the decryption secret out of the service; endpoint-backed and legacy share links pass password or key material through the service. Links without a password and File Requests without end-to-end encryption use service-managed storage and access controls. See our security and encryption explanation for each route’s boundaries and the operational metadata we process.

Mobile app data and permissions

The iOS and Android apps process the photos, videos and documents you choose to send or save. Camera and microphone access is used when you choose to take a photo or record a video. Saving photos uses the platform’s photo-library permission. Authentication uses your account email and the provider identifier returned by Apple, Google or Microsoft; Apple may supply a private relay address.

Account and transfer requests include technical information such as IP address, app and operating-system version, and device type. Our infrastructure may derive approximate location from the IP address for account security. The mobile apps do not request GPS location, include advertising or analytics SDKs, or use cross-app advertising tracking. Biometrics authorize operations on the device; biometric templates are not sent to WarpSend. When enabled, app updates contact Expo’s update infrastructure.

Files you export to Photos or an external folder remain under your control after sign-out or account deletion. You can remove them using your device’s file or photo app.

2. How we use your data

We use personal data to:

  • Provide, operate, and maintain the Service.
  • Authenticate you and protect your account.
  • Process payments and prevent fraud.
  • Enforce plan limits and bill paid subscriptions.
  • Respond to support requests.
  • Send transactional emails (account confirmations, billing receipts, security notices). We do not send marketing emails without your consent.
  • Comply with legal obligations and respond to lawful requests.

3. Cookies and similar technologies

We use cookies and similar technologies sparingly. We do not use advertising cookies or marketing pixels.

Strictly necessary cookies are required for core functionality — for example, authentication and session management when you sign in to the Service or to our admin tools, and CSRF tokens that protect form submissions. You can disable cookies in your browser, but doing so may break parts of the Service.

Language preference: when you choose a language on warpsend.io, or dismiss the suggestion to switch languages, we store that choice in a wt-locale cookie for one year so the site opens in that language next time.

Analytics: warpsend.io uses Google Analytics 4, a service provided by Google, to understand how visitors find and use the site. It sets first-party cookies named _ga and _ga_ followed by an identifier for our account, which keep a random visitor ID for up to two years so repeat visits can be recognized. Google Analytics receives the pages you view, the page that referred you, whether you scroll to the end of a page, clicks on links to other sites and into the WarpSend app (which link, where it sits on the page, and the page’s language), your device and browser type, and an approximate location. Google derives that location from your IP address; Google Analytics 4 does not store IP addresses. We use these reports only to improve the site. Our Analytics account is not linked to any advertising account, and we do not use Analytics data for advertising.

Your choice: if you visit from the European Economic Area, the United Kingdom or Switzerland, a banner asks first, and Google Analytics loads only if you allow it. Elsewhere it loads by default. Wherever you are, Cookie settings at the bottom of every page lets you allow or decline analytics at any time; declining stops it and deletes its cookies. We remember your choice in a wt-consent cookie for six months and then ask again. You can also block these cookies in your browser or install the Google Analytics opt-out browser add-on.

No advertising trackers: we do not load Meta Pixel, LinkedIn Insight Tag, or any similar advertising or marketing tracker on this website.

4. Lawful bases (EEA / UK users)

If you are in the European Economic Area or the United Kingdom, we process your data on the following lawful bases:

  • Contract performance — to deliver the Service you signed up for.
  • Legitimate interests — to keep the Service secure, prevent abuse, and improve features.
  • Consent — for optional processing, such as analytics cookies on warpsend.io and marketing communication.
  • Legal obligation — where required by tax, accounting, or other applicable law.

5. How long we keep your data

  • Account data is kept while your account is active. Completing account deletion removes the active profile and revokes sign-in sessions. This is permanent; we do not offer account recovery after deletion. Associated personal cloud data is removed according to the deletion scope shown before confirmation. Assets that belong to a surviving shared organization may be transferred to its owner.
  • Billing records are kept for 7 years to comply with tax and accounting laws.
  • File content is held only as long as its retention rule applies: 7 days for free-tier share links, and whatever window the link was given — up to 90 days — for paid links. Content is removed once that window closes, or sooner if you delete it.
  • Server logs are kept for up to 90 days unless required longer to investigate a security incident.

6. Sharing your data

We do not sell your personal data. We share data only with:

  • Sub-processors that help us run the Service: cloud infrastructure (Cloudflare), payment processing, transactional email delivery, and customer support tooling. These providers are bound by data-processing agreements.
  • Google, which provides Google Analytics for warpsend.io as described in Section 3.
  • Authorities, when required by law or valid legal process.
  • Acquirers, if we are involved in a merger, acquisition, or sale of assets — in which case we will notify you before your data is transferred.

7. International transfers

Our infrastructure runs on globally distributed servers. When data crosses borders we rely on legally recognized transfer mechanisms (including Standard Contractual Clauses) to maintain a level of protection equivalent to the laws of your home country.

8. Your rights

Depending on where you live, you may have the right to:

  • Access the personal data we hold about you.
  • Correct inaccurate data.
  • Delete your account and associated data.
  • Export your data in a machine-readable format.
  • Object to or restrict certain processing.
  • Withdraw consent at any time.

To exercise any of these rights, email us at privacy@warpsend.io. We respond within 30 days.

Account and data deletion

You can delete your WarpSend account from a browser without installing the mobile app. The same option is available in the app’s account settings. The process shows affected organizations and data before asking you to verify ownership and confirm deletion. If you cannot sign in, the deletion page explains how to contact us to request deletion after ownership verification.

Deletion revokes sign-in sessions and removes the active account and associated personal data. Shared-organization ownership must be resolved first, and data belonging to a surviving organization may remain with its owner. Billing and security records may be retained for the periods described above where required for legal obligations, fraud prevention or security. We do not retain an active account for recovery after a completed deletion.

9. Security

We protect your data with:

  • HTTPS/TLS for all client–server communication.
  • End-to-end encryption on supported transfer routes and when enabled, within the route-specific encryption boundaries described above.
  • AES-256 encryption at rest for files held in our cloud relay.
  • Strict access controls for our internal systems.
  • Regular security reviews and incident-response procedures.

No system is perfectly secure, but we make every reasonable effort to protect the data you entrust to us. If we ever detect a breach that affects you, we will notify you promptly.

10. Children

WarpSend is intended for use by professionals, businesses, and adults. We do not knowingly collect data from children under 16. If you believe a child has provided us with personal data, please contact us so we can remove it.

11. Changes to this policy

We may update this Privacy Policy from time to time. If we make a material change, we will notify you by email or in-app notice at least 14 days before the change takes effect. The “Last updated” date at the top of this policy reflects the most recent revision.

October 4, 2026: we corrected Section 3. It had said that warpsend.io used a cookieless analytics tool and did not load Google Analytics; in fact the site uses Google Analytics 4, which sets cookies. Section 3 now describes what it collects. Visitors from the European Economic Area, the United Kingdom and Switzerland are now asked before it loads, and everyone can decline it from Cookie settings. We also listed the language preference cookie.

12. Contact

For privacy questions, requests, or concerns, contact us at privacy@warpsend.io.