Private Direct
Powered by Forensic Intelligence

Privacy Policy

Last updated: March 2026

1. Overview

Forensic Intelligence ("we", "us") operates Private Direct, a peer-to-peer file sharing service. We are committed to protecting your privacy. This policy explains what data we collect, how we use it, and your rights.

2. What We Collect

We collect minimal metadata necessary for service operation and security:

  • Hashed IP Address: Your IP address is cryptographically hashed using HMAC-SHA256. The original IP cannot be recovered from the hash.
  • File Hash (SHA-256): A cryptographic fingerprint of transferred files. The original file cannot be reconstructed from this hash.
  • Transfer Metadata: File size, download count, timestamps, and transfer status.

3. What We Do NOT Collect

  • File Content: Files are end-to-end encrypted and transfer directly between users. We never see, access, or store file content.
  • File Names: We do not store file names in any form.
  • Encryption Keys: Keys are embedded in URL hash fragments that browsers never send to servers.
  • Personal Information: No registration, no email, no name collection.
  • Tracking Cookies: We use no analytics or advertising trackers.

4. Data Retention

All collected metadata is automatically and permanently deleted after 30 days. This deletion is automated and irreversible. We do not retain any data beyond this period.

5. Data Sharing

We do not sell, trade, or share your data with third parties except as required by law. We may provide hashed metadata to law enforcement upon valid legal request (court order, warrant).

6. Security Measures

  • End-to-end AES-256-GCM encryption for all file transfers
  • Zero-knowledge architecture — we cannot access your data
  • Cryptographic hashing of all stored identifiers
  • Encrypted database storage for all metadata
  • Automatic 30-day data purge

7. Cloudflare

We use Cloudflare to provide CDN services, SSL/TLS termination, and DDoS protection. When you access Private Direct, your connection passes through Cloudflare's network. Cloudflare may temporarily process your IP address, TLS handshake data, and HTTP headers for routing and protection purposes. Cloudflare does not have access to the content of your encrypted file transfers, as encryption occurs in your browser before data is transmitted. Cloudflare's data processing is governed by their privacy policy.

8. Server Location

Our servers are located in Europe within a secure data center. All metadata we collect is processed and stored exclusively within the European Union. No data is transferred outside the EU for processing or storage.

9. Database Encryption

In addition to end-to-end encryption of file transfers, all sensitive metadata stored in our database is encrypted at rest using Fernet symmetric encryption (built on AES-128-CBC with HMAC-SHA256 authentication). IP addresses are irreversibly hashed using HMAC-SHA256 before storage, making it impossible to recover original IP addresses from our database.

How End-to-End Encryption Works

Files are encrypted in the sender's browser, transferred directly over WebRTC, and decrypted only in the receiver's browser. The server never sees the file content or encryption key.

10. Browser Storage

Private Direct uses localStorage to store your language preference and theme choice. No personal data or file information is stored in your browser beyond your active session. When a transfer ends or the sender disconnects, all transfer-related data is automatically removed from your browser.

11. Your Rights (GDPR)

Under GDPR and similar regulations, you have the right to access, correct, or delete your personal data. Since we only store cryptographic hashes (which cannot identify you), most of these rights are inherently satisfied. Contact us if you have any concerns.

12. Contact

For privacy-related inquiries, contact us at [email protected]