Privacy
Last updated 5 September 2026
Pasa File has no accounts, no analytics, and no advertising. The short version: your files are never sent to this server, and the only thing stored is the room itself, which deletes itself. The rest of this page is the detail behind that claim, including the parts most privacy pages leave out.
Your files and shared text
File contents, file names, sizes, and types are transferred directly between the two browsers over an encrypted WebRTC data channel. They do not pass through this server, are not written to disk here, and are not logged. There is no copy of your file on our side to delete, retain, or hand to anyone, because one is never created.
Text shared through the room's text box goes over that same peer-to-peer channel, for the same reason: it reaches every connected device directly and is never sent to, or stored on, this server.
What is stored on the server
| Data | Why | How long |
|---|---|---|
| The room code | So the second device can find the room | Expires after 60 minutes; the record is deleted within about a day |
| The room password, if you set one | So it can be checked when someone joins | Deleted with the room |
| Your session identifier | To recognise the room's creator, so only they can close it | Deleted with the room |
| Signaling messages and a temporary device id | To introduce the two browsers to each other | Held in a short-lived cache, minutes at most |
| Standard web server request logs | Operating the server, diagnosing faults, abuse handling | Rotated on the host's normal schedule |
A note on the room password, because it matters: it is stored in a form the server can read for as long as the room exists, so that it can be compared when someone tries to join. Treat it as a door code for that one room, valid for an hour. Do not reuse a password you use anywhere else.
Cookies
Two functional cookies, both first-party: a session cookie, which is how the site remembers that you created a room or already entered its password, and a CSRF token cookie that protects the forms on this site from being submitted from somewhere else. There are no analytics, advertising, or tracking cookies, and nothing is shared with an advertising network. Your theme preference is kept in your browser's local storage and never leaves the device.
Third parties your browser contacts
Two, and both are worth naming because they see your IP address even though we do not send them anything about you.
-
Google's public STUN servers
To open a direct connection, each browser has to discover how it appears from outside its own network. It asks a public STUN server, which replies with the address it sees. Pasa File uses Google's public STUN servers for this, so Google's servers see your IP address and the fact that a request was made. No file data, room code, or password is sent to them — STUN carries none of that.
-
Bunny Fonts
The page's typeface is loaded from Bunny Fonts, a font host that states it does not log IP addresses or set cookies. Your browser still makes a request to it to fetch the font file.
There is no analytics service, no tag manager, no session recording, and no advertising script anywhere on this site.
What the other device learns
Establishing a peer-to-peer connection means the two devices exchange network addresses, including local ones, and each ends up knowing the other's IP address. That is how a direct connection works and it is true of every WebRTC application. Only join rooms you or someone you trust created, and set a password when you are on a network you share with strangers.
Questions
Pasa File is built and run by Adnan Temur Barcha. If something on this page does not match what you observe, that is a bug worth reporting — reach out via GitHub.