Privacy Policy

Last updated: October 2026

At OWL Transfer, the best way to protect your data is not to collect it. Where most websites track their visitors, we chose the opposite: no analytics tools, no advertising cookies, no tracking pixels, and no data sold. The only cookies we set are used to sign you in, remember your language, secure the site and, on payment pages, secure your transaction. This policy describes exactly what we collect, why, and how to exercise your rights.

1. Data Collected

When using OWL Transfer, we may collect the following data:

• Account data: email address, name, password (hashed).
• Payment data: handled by Stripe, our payment provider. OWL Transfer stores no banking data.
• Transfer data: file metadata (name, size, expiry date). File contents are encrypted in your browser, with AES-256, before they are sent: neither our hosting providers nor technical intermediaries can read them. With private end-to-end encryption, only the recipient can open the files: OWL Transfer never has access to them.
• Browsing data: IP address and browser type, for security, abuse prevention and enforcement of free sending quotas.
• Visitors without an account: the sender's email address, in a normalised form, and IP address, kept for 30 days to enforce free sending quotas. The verification code is valid for 10 minutes.

2. Use of Data

Your data is used solely to:

• Provide and improve the OWL Transfer service.
• Manage your account and subscriptions.
• Send you notifications related to your transfers (links, confirmations).
• Comply with our legal obligations.

We do not sell your data to third parties and do not use it for advertising purposes. In our administration console, your personal data (email address, name, IP address, file names) is masked: our team does not see it in day-to-day operations.

3. Hosting and Data Location

The site is hosted by Infomaniak, in Switzerland. Transferred files are stored by a specialised provider: standard transfers are stored encrypted, while OneTimeView files are converted on our servers to produce the single view.

Where the processing of personal data involves a transfer outside the European Union or the European Economic Area, OWL Transfer implements appropriate safeguards in accordance with applicable data protection regulations.

4. Retention Period

Transferred files are automatically deleted when the link expires (set by the sender). Account data is retained while your account is active. Upon account deletion, your data is erased within 30 days. Identification data linked to each transfer and each account (IP address, connection port, date, email address) is kept for one year in a separate register, for our legal obligations as a host, then deleted.

5. Cookies

OWL Transfer sets no audience measurement or advertising cookies, and no cookies that require consent. Only strictly necessary cookies are used: sign-in session (7 days), display language (1 year), bot protection by Cloudflare (30 minutes to 1 year) and the result of email address verification (1 minute). Details are on the Cookies page.

6. Your Rights (GDPR)

Under the General Data Protection Regulation (GDPR), you have the following rights:

• Right of access to your personal data.
• Right to rectification of inaccurate data.
• Right to erasure ("right to be forgotten").
• Right to data portability.
• Right to object to processing.

To exercise your rights, contact us at: [email protected]. We respond to all requests within 30 days.

7. Contact

For any questions regarding this privacy policy, you can reach us at: [email protected]