Privacy Policy

Last updated October 6, 2026

1. Overview

This Privacy Policy explains how Vertex Core LLC ("we," "us," or "our"), doing business as TransferNode, collects, uses and protects information when you send or receive files through our website or Android app.

2. Information We Collect

Files and transfer details: The files you upload, their names, types and sizes, and the optional title, message, password and expiry you choose. Passwords are stored only in a scrambled (hashed) form that cannot be turned back into the password.
Account information: If you create an account or confirm your email to send a transfer: your email address, your plan, your list of transfers (title, size, number of files, download count, dates), and your billing status. We do not use passwords; you sign in with a one-time code sent to your email.
Payment information: Payments are handled by Stripe. We receive your Stripe customer and subscription details (such as plan, status and renewal date) but never your full card number or security code.
Technical information: Your IP address, browser or device type, and basic request information, which our hosting provider and our servers process to deliver pages and files, prevent abuse, and enforce rate limits and the Free plan's daily limit.
Download activity: We count how many times a transfer's files are downloaded and show that count to the sender if they have an account. We do not record who downloaded them.

3. How We Use Information

To provide the Service: Storing your files, creating share links, delivering files to people who have the link, and showing your transfer history.
To run plans and billing: Applying your plan's limits and processing subscriptions and storage add-ons.
To show ads on the Free plan: See Section 5.
To keep the Service safe: Preventing fraud, spam, ad fraud and abuse, investigating reports (see our Content Moderation Policy), and complying with the law.
To communicate with you: Sending sign-in codes and important account or billing messages.

4. Who Can See Your Files

If you sent a transfer while signed in or after confirming your email, its download page shows a shortened form of your email address (for example j•••@gmail.com) so recipients can recognise you. Anyone who has a transfer's link (and its password, if you set one) can download its files until the link expires. Files are encrypted in transit using HTTPS and are kept in a private storage bucket, but they are not end-to-end encrypted, so our systems and our storage provider can technically access them. Programs, scripts, documents and archives up to 95 MB are checked automatically by our virus scanner before they can be downloaded. Apart from that automated check, we do not look at your files except when needed to investigate abuse or a legal request, or to fix a problem you ask us to help with. We do not use your files to train AI models and we do not sell them.

5. Advertising and Cookies

The Free plan is paid for by advertising. On our website we use Google AdSense (and may use Google Ad Manager); in our Android app we use Google AdMob. These are not shown to paid users or to people opening links sent by paid users.

Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this and other websites. Google's use of advertising cookies enables it and its partners to serve ads based on your visits to this and other sites. You can opt out of personalised advertising by visiting Google's Ads Settings (adssettings.google.com), or opt out of some third-party vendors' use of cookies at www.aboutads.info. Learn more about how Google uses information from sites that use its services at policies.google.com/technologies/partner-sites.

Where the law requires it (for example in the European Economic Area, the United Kingdom and Switzerland), we ask for your consent before personalised ads are shown, using Google's consent tools, and you can change your choice at any time using "Privacy choices" at the bottom of every page. In the Android app, AdMob may use your device's advertising ID, which you can reset or limit in your device settings.

Outside the European Economic Area, the United Kingdom and Switzerland, our website checks whether an ad blocker is active when you send files on the Free plan: it briefly tries to load Google's ad script and checks a hidden page element. This check runs only in your browser and nothing about it is stored. In the EEA, the UK and Switzerland we do not run this check; we only show a note you can close, and we remember that you closed it in your browser.

6. Other Storage on Your Device

Apart from advertising cookies, we store a few small items in your browser: your chosen language, your sign-in session if you have an account, and a short-lived access token after you enter a transfer password, so you don't have to type it again. If you share files to our installed app, they are kept in your browser only until they are added to your transfer. None of these are used for tracking.

7. Service Providers

We do not sell your personal information. We share it only with providers that help us run the Service, and only as needed for that:

Backblaze: Stores your files and transfer records.
Cloudflare: Hosts our website, delivers pages and requests, and runs our virus scanner: programs, scripts, documents and archives up to 95 MB are checked with the open-source ClamAV engine on Cloudflare servers before they can be downloaded. Transfers containing malware are blocked and deleted. When you send a free transfer, Cloudflare Turnstile checks that you are a person, using signals from your browser and IP address; it does not use advertising cookies.
Supabase: Runs accounts, sign-in codes and transfer history.
Stripe: Processes payments and subscriptions.
Google: Provides advertising on the Free plan (AdSense, Ad Manager, AdMob) and its consent tools.

8. How Long We Keep Information

Free transfers: Files are deleted automatically about 5 days after upload. Links stop working when they expire (after 12 or 24 hours).
Paid transfers: Files are deleted within about 30 minutes after their link expires, or straight away if you delete the transfer.
Unfinished uploads: Deleted after 48 hours.
Transfer records: Basic records of a transfer (such as its size and dates) are kept for about 100 days after it ends, to handle abuse reports and support questions, and then deleted.
Accounts and billing: Kept while your account is open, and afterwards only as long as needed for legal, tax and accounting duties.

9. Your Rights

Depending on where you live, you may have the right to access, correct, download, or delete your personal information, to object to or restrict some uses of it, and to withdraw consent you have given. You can delete your transfers yourself from your account page; for anything else, contact us at . If you are in the EEA or UK, you also have the right to complain to your local data protection authority.

10. California Residents

We do not sell personal information for money. Showing personalised ads on the Free plan may count as "sharing" personal information for cross-context behavioural advertising under California law. You can opt out by turning off personalised ads in Google's Ads Settings, by using a browser that sends a Global Privacy Control signal, or by choosing a paid plan, which has no ads.

11. Legal Bases (EEA and UK)

We process personal information to perform our contract with you (providing transfers and plans), based on our legitimate interests (keeping the Service secure and preventing abuse), with your consent (personalised advertising where required), and to meet legal obligations.

12. Security

We use HTTPS for all traffic, private storage, link IDs that are hard to guess, hashed passwords, and short-lived download addresses. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

13. International Transfers

Our providers may process and store information in the United States and other countries. Where required by law, we rely on appropriate safeguards such as standard contractual clauses.

14. Children

The Service is not directed to children under 13 (or under 16 in parts of the EU), and we do not knowingly collect their personal information. If you believe a child has given us personal information, contact us and we will delete it.

15. Business Transfers

If we are involved in a merger, acquisition, financing, reorganisation or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change and any choices you may have.

16. Changes and Contact

We may update this Privacy Policy and will change the date at the top when we do; for significant changes we will give notice on the website or by email. Questions or requests: .