Security & Privacy

At QuickShare, security and privacy are not afterthoughts—they're built into the core of our platform. Here's how we protect your files and data.

Zero-Knowledge Architecture

No Server Storage

• Files never stored on our servers
• We only provide WebRTC signaling to establish connections
• Once connected, transfers happen directly between devices
• No way for us to access or intercept your files

Minimal Data Collection

• No user accounts or personal information required
• No file metadata stored
• Session data automatically deleted after use
• No tracking cookies or analytics

Encryption & Security

WebRTC Encryption

All file transfers use WebRTC's built-in security features:

• DTLS Encryption: All data encrypted during transit
• SRTP: Secure Real-time Transport Protocol
• Key Exchange: Automatic secure key negotiation
• Perfect Forward Secrecy: Each session uses unique keys

Connection Security

• ICE/STUN: Secure connection establishment
• NAT Traversal: Works securely behind firewalls
• Certificate Validation: Automatic certificate checking
• Replay Protection: Prevents connection replay attacks

Privacy Protections

Anonymous Usage

• No registration or login required
• No IP address logging beyond basic connection needs
• No user behavior tracking
• No persistent identifiers

Data Minimization

We collect only the absolute minimum data needed:

• Session IDs for connection establishment
• Basic connection metadata for debugging
• No file names, sizes, or content
• All data automatically purged

Automatic Cleanup

• Session data deleted immediately after transfer
• Connection logs purged within 24 hours
• No long-term data retention
• No backup copies of any user data

Code Security

Single-Use Codes

• Each 6-digit code works only once
• Codes expire automatically (default: 24 hours)
• Random generation prevents guessing
• No code reuse or recycling

Session Management

• Unique session IDs for each transfer
• Automatic session termination
• No persistent sessions
• Secure random number generation

Network Security

HTTPS Everywhere

• All web traffic encrypted with TLS 1.3
• HSTS headers prevent downgrade attacks
• Certificate pinning for additional security
• Secure cookie settings

DDoS Protection

• Rate limiting on code generation
• Connection throttling
• Automatic abuse detection
• Cloudflare protection layer

Compliance & Standards

Industry Standards

• Follows WebRTC security best practices
• OWASP security guidelines compliance
• Regular security audits and updates
• Vulnerability disclosure program

Privacy Regulations

• GDPR compliant (minimal data processing)
• CCPA compliant (no personal data sale)
• No cross-border data transfers
• Right to deletion (automatic)

Security Audits

Regular Testing

• Automated security scanning
• Penetration testing
• Code review processes
• Dependency vulnerability monitoring

Transparency

• Open source code for public review
• Security issue disclosure policy
• Regular security updates
• Community security contributions

Threat Model

What We Protect Against

• ✅ Server-side data breaches
• ✅ Man-in-the-middle attacks
• ✅ Eavesdropping on transfers
• ✅ Unauthorized file access
• ✅ User tracking and profiling

Limitations

• ❌ Cannot protect against compromised devices
• ❌ Cannot prevent social engineering
• ❌ Cannot guarantee recipient security practices
• ❌ Cannot protect against malware in files

Best Practices for Users

For Maximum Security

1. Verify Recipients: Confirm codes through secure channels 2. Use HTTPS: Always access QuickShare via HTTPS 3. Keep Browsers Updated: Use latest browser versions 4. Secure Networks: Avoid public WiFi for sensitive files 5. Scan Files: Recipients should scan files for malware

Red Flags

• Never share codes publicly
• Don't use codes received from unknown sources
• Be cautious with executable files
• Report suspicious activity

Security Contact

Found a security issue? We take security seriously:

• Email: security@quickshare.app
• PGP Key: Available on our GitHub
• Response Time: 24-48 hours for critical issues
• Disclosure: Responsible disclosure preferred

Continuous Improvement

Security is an ongoing process. We continuously:

• Monitor for new threats
• Update security measures
• Improve encryption methods
• Enhance privacy protections

Your trust is our responsibility. We're committed to maintaining the highest security standards while keeping file sharing simple and accessible.

---

Last updated: December 15, 2025