Cookie Policy
Last updated 15 September 2026
Draft for review. Keep this list accurate: if you add an analytics tool or an embedded widget later, it belongs here before it ships.
Last updated: [date]
1. The short version
We set cookies only where something would not work without them. There are no advertising cookies, no cross-site tracking, and nothing that follows you to other websites. That is why you are not asked to accept a banner: there is nothing optional to accept.
2. What we set
| Name | Purpose | Lasts |
|---|---|---|
tfsess |
Keeps you signed in for the length of a visit and carries the token that protects forms against forgery. Without it, signing in and submitting forms cannot work. | Until you close the browser |
tfremember |
Set only if you tick "keep me signed in". Lets you return without signing in again. It holds a single-use token that is replaced each time it is used, so a copied cookie stops working once you sign in again. | 30 days |
tf_access_<transfer> |
Set after you enter the password for a protected transfer, so you are not asked again on every file. It is scoped to that one transfer and is invalidated if the sender changes the password. | 2 hours |
All three are HttpOnly, meaning scripts on the page cannot read them, and are marked Secure when the site is served over HTTPS.
3. Local storage
While an upload is running we keep one value in your browser's local storage: an identifier for the upload in progress. It is what allows an interrupted upload to continue instead of starting again. It is removed when the transfer completes or is cancelled. It is not a cookie, is not sent to us automatically, and contains nothing about you.
4. Cookies from other companies
We load our typefaces from a font provider, which means your browser makes a request to that provider and it can see your IP address. It does not set a cookie for us and we receive nothing back from it.
If this installation has been configured with an analytics tool by its operator, it will be named here. [Add any such tool, or state that none is used.]
5. Turning them off
Your browser can block or delete cookies. If you block ours, you can still receive a transfer someone sent you, but you will not be able to sign in, create a transfer, or open a password-protected transfer, because those depend on the session cookie.
6. Contact
Questions about this policy: [support email].