Privacy Policy

This policy explains what information BoltShare (www.boltshare.in) handles when you send or receive files, what we use it for, and the choices you have. BoltShare is built and operated by an independent developer based in India ("we", "us"). If anything here is unclear, email [email protected].

Summary

• We never store your files. Files go straight to the receiver, either directly between browsers or streamed through our relay without being saved.
• No account is needed. We do not ask for your name, email or phone number to use the service.
• To connect sender and receiver, our servers briefly see transfer details (file name, size, type, count) and your IP address.
• We use analytics (Google Analytics, PostHog and a small site counter) and Google AdSense ads, which use cookies. You can opt out (see Your choices).

1. Your files

When you share files, you pick one of two transfer modes on the send screen:

Direct P2P

Your browser opens a WebRTC connection straight to the receiver's browser. File data travels over that connection and is encrypted in transit with DTLS, which is built into WebRTC. File contents do not pass through BoltShare servers. If a direct path cannot be found because of firewalls or NAT, the encrypted connection may be routed through a TURN relay server. The TURN server forwards encrypted packets and cannot read them.

Bolt Tunnel (the default)

Your browser streams the file to our relay service, which runs on Cloudflare Workers. The relay forwards each piece to the receiver as soon as it arrives. The connection is encrypted in transit with TLS (HTTPS/WSS). File data is held only in memory for the moment it takes to forward it. It is never written to disk or storage, never inspected, and never logged. Because encryption in this mode is between each browser and the relay rather than end-to-end, choose Direct P2P if you want file contents to avoid our infrastructure entirely.

Receiving

Received files are written directly to the receiver's device by their browser, using the browser's file saving features or a small download helper (a service worker) that BoltShare installs. Nothing is uploaded anywhere when a file is saved.

2. Transfer details and share links

To pair a sender with a receiver, our signaling server (hosted on Render) receives:

• the name of the file (or a generated name like batch_3_files.zip for several files), its total size, type, the number of files and the chosen transfer mode;
• a random session token, which forms your share link (/receive/<token>);
• connection setup messages exchanged between the two browsers.

We show these transfer details to the receiver so they know what they are accepting. Session data is kept in memory only. It is deleted when the sender closes the session, or 5 minutes after both people disconnect. Our server's operational logs may record the file name, size and session token for troubleshooting. These logs are kept by our hosting provider for a limited period and are not used for any other purpose.

Anyone who has your share link can request the transfer while the session is active, so share it only with the people you intend to receive the files.

3. IP addresses and connection data

Like any website, our servers and hosting providers receive your IP address and basic request data (browser type, time of request) when you connect. In addition:

• In Direct P2P mode, WebRTC shares your IP address with the other person in the transfer so a direct connection can be made. This is how peer-to-peer technology works.
• To find a working network path, your browser contacts public STUN servers operated by Google (stun.l.google.com), which see your IP address.
• In Bolt Tunnel mode, Cloudflare processes your connection to our relay.

4. Analytics

We use analytics to understand how BoltShare is used and to find and fix failed transfers:

• Google Analytics records page views, approximate location (derived from IP), device and browser information, and referral sources. It uses cookies. See how Google uses data from sites that use its services.
• PostHog records product events such as files selected, share link created, receiver connected, transfer completed / failed / resumed and feedback submitted. These events include the number of files, total size and transfer mode. They never include file names or file contents. PostHog also captures page views, clicks, technical error reports and session recordings (a replay of how the page behaved during a visit) to help us find bugs. Recordings mask text that you type into form fields. PostHog uses cookies and local storage to recognise returning visitors.
• A lightweight site visit counter (track.aadarsh.pro) records page views and basic visit information.

5. Advertising (Google AdSense)

BoltShare is free and supported by ads served through Google AdSense.

• Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this website or other websites.
• Google's use of advertising cookies enables it and its partners to serve ads to you based on your visits to this site and/or other sites on the Internet.
• You may opt out of personalised advertising by visiting Google Ads Settings. You can also opt out of some third-party vendors' use of cookies for personalised advertising at www.aboutads.info.
• Learn more in how Google uses cookies in advertising.

Where required by law (for example in the EEA, UK and Switzerland), Google will ask for your consent before showing personalised ads.

6. Feedback and contacting us

After a transfer you may rate it with 1 to 5 stars. The rating is sent through Web3Forms, a form delivery service, to our email inbox. No file details are included. If you email us or use the contact form, we receive your name, email address and message, and use them only to reply to you. Contact form messages are also delivered through Web3Forms.

7. Cookies and local storage

What	Set by	Purpose
boltshare-theme (local storage)	BoltShare	Remembers light or dark theme
Download service worker	BoltShare	Streams received files to your device
_ga, _ga_*	Google Analytics	Distinguishes visitors and sessions
ph_* cookie / local storage	PostHog	Product analytics and session recordings
Advertising cookies	Google AdSense and partners	Serving, measuring and personalising ads

You can block or delete cookies in your browser settings. BoltShare will still work, but your theme preference may not be remembered.

8. Service providers

We rely on these providers to run BoltShare. Each processes data under its own privacy policy:

• Vercel: hosts the website.
• Render: hosts the signaling server.
• Cloudflare: runs the Bolt Tunnel relay.
• Google: Analytics, AdSense, STUN servers and Google Fonts.
• PostHog: product analytics, error tracking and session recordings.
• Web3Forms: delivers feedback ratings and contact form messages.
• Product Hunt: the badge image on our pages is loaded from Product Hunt's servers.

These providers may process data in countries other than your own, including the United States. We do not sell your personal information, and we do not share it except with these providers or when required by law.

9. How long we keep data

• File contents: not stored at all.
• Session data: deleted when the session ends, or 5 minutes after both people disconnect.
• Server logs: kept by our hosting providers for a limited period, then deleted automatically.
• Analytics data: kept according to each analytics provider's retention settings.
• Emails and contact messages: kept as long as needed to handle your request.

10. Your choices and rights

• Use Direct P2P mode so file contents never pass through our relay.
• Opt out of personalised ads at Google Ads Settings.
• Opt out of Google Analytics with the Google Analytics opt-out add-on.
• Block cookies, or use a content blocker or your browser's tracking protection.

Depending on where you live, including under India's Digital Personal Data Protection Act, 2023, the EU/UK GDPR, or California law, you may have the right to access, correct or delete personal data about you, or to object to certain processing. We do not hold accounts or user profiles, so we usually have little or no data that identifies you. To make a request, email [email protected]. We will respond within 30 days.

11. Children

BoltShare is not directed at children under 13, and we do not knowingly collect personal information from them. Users under 18 in India should use BoltShare with the involvement of a parent or guardian. If you believe a child has given us personal information, contact us and we will delete it.

12. Security

All connections to BoltShare use encryption in transit (HTTPS, WSS, or DTLS for direct transfers). Share links use random tokens that are hard to guess. No method of sending data over the internet is perfectly secure, so avoid sending highly sensitive data through any online service without encrypting it first.

13. Changes to this policy

If we change how BoltShare handles data, we will update this page and the "Last updated" date above.

14. Contact

Questions or requests about privacy: [email protected], or use our contact page.