1. Controller and scope
Last updated: August 31, 2026
This policy applies to sendlyy.net and the Sendlyy mobile applications. Sendlyy is an open-source service for direct transfers between devices. For privacy questions, use the Sendlyy Contact page.
2. Transferred files and text
Selected files and text are sent directly between devices over an encrypted WebRTC data channel. Sendlyy does not receive a copy for storage, does not create a transfer history, and currently uses no TURN relay. The recipient device you connect receives the content you choose to send.
3. Sessions and signaling data
To connect devices, Sendlyy temporarily processes a six-digit session code, each device’s role, and technical WebRTC messages such as offers, answers, and ICE candidates. These messages may contain network information, including IP addresses. Cloudflare Durable Objects session storage retains only the session expiry and a temporary disconnection marker. A session expires no later than 15 minutes after creation, after which this session data is deleted.
4. Infrastructure and technical logs
Cloudflare provides website hosting, content delivery, domain protection, the signaling Worker, and Durable Objects. Cloudflare may process the IP address, requested URL, date and time, browser or device information, and routing, security, and diagnostic data under its privacy policy. Sendlyy also uses Google’s public STUN service to help WebRTC discover a network path; that service does not receive the contents of transferred files or text. Sendlyy includes no advertising or behavioral analytics tool.
5. Local storage and permissions
Your language preference is saved in local storage in the browser or app until you clear it. Sendlyy sets no advertising or tracking cookie. On mobile, the rear camera is used only when you start QR-code scanning; the image is analyzed on the device and is not sent to Sendlyy. Only files you select through the system picker are accessed for the requested transfer.
6. Purposes and legal grounds
Technical data is processed only to provide the requested session, route and secure communications, prevent abuse, and diagnose incidents. This processing is necessary to deliver the requested service and, where required by law, relies on the legitimate interest in operating and securing Sendlyy.
7. Recipients and international transfers
Sendlyy does not sell your data. Technical recipients are Cloudflare and Google for the functions described above, as well as the recipient device you choose. These providers operate international infrastructure and may process data in several countries under their terms, safeguards, and privacy policies.
8. Retention, rights, and changes
Sendlyy session metadata is deleted when the session expires, no later than 15 minutes after creation. The language preference remains on your device until you remove it. Any technical logs are retained according to Cloudflare’s applicable retention periods. Depending on your country, you may request access, correction, deletion, restriction, or objection by using the Contact page. This policy may be updated when the service or its providers change.