Privacy

What we store

• Encrypted file contents (ciphertext), until deletion.
• Minimal metadata: an unguessable id, file size, an encrypted filename label we cannot read, your chosen expiry and burn setting, a one-way password verifier (if set), and a download counter.
• A salted, hashed form of the uploader's IP for abuse prevention — never the raw IP.

What we never store

• Your decryption key (it lives only in the link fragment).
• Your password in any recoverable form.
• The plaintext contents of end-to-end encrypted files.
• File contents in logs.

Deletion

Files are deleted on download (burn mode) or at expiry, whichever comes first. Metadata rows are removed once the file is purged.

Beam (device-to-device)

When you use Beam, your files never touch our storage. The two devices connect directly whenever possible, and we relay only the brief, automatically-expiring signalling needed to introduce them — short-lived public keys and connection details, deleted within minutes. When no direct path exists, the encrypted stream passes through a relay that cannot read it. We store no file, no filename, and nothing that would let us reconstruct or read the transfer.

Clipboard (device-to-device)

Clipboard text and images are never uploaded to or relayed through our server. Our server handles only temporary presence and WebRTC connection details so the browsers can find each other; those records expire automatically. Transfers use direct peer-to-peer connections only, are end-to-end encrypted in the browsers, and remain only in the current tab's temporary history.

Rooms (real-time collaboration)

DocuChan never stores Rooms document content or room keys. The server temporarily stores participant presence, room lock and approval state, and WebRTC SDP/ICE signalling, which can contain IP addresses and other network connection details; those records expire automatically. Display names, cursors, comments, and host status are session metadata and do not authenticate anyone’s legal identity. Document changes and comments travel over application-encrypted WebRTC. Browsers prefer a direct path using public STUN services; when that fails, DocuChan's configured TURN service may relay encrypted packets. STUN/TURN can observe connection metadata and encrypted traffic volume, but not document content or the room key. Direct peers can see one another's network addresses. Your browser keeps a local working copy in IndexedDB and the complete resume credential, including the fragment key and any host capability, in this browser's site storage so Recent documents can reopen it. Remove or Clear all deletes that browser-local recovery data. Any approved participant can retain or export content they receive.

No ads, no data sales

We do not show ads and we do not sell data. The service is designed to know as little about your files as technically possible. Our only analytics is cookieless and self-hosted on our own server — it counts visits and funnel steps, and never sees a filename or link id.