Privacy

Controller and scope

The controller is Javier Eduardo Berrezueta Varas, an individual operator of PeerWay established in Ecuador. This policy applies to www.peerway.me, the PeerWay app and the account, cloud and P2P transfer features. You can contact us using the addresses at the end of this policy.

Free beta

PeerWay is currently offered as a free beta. No Pro or Team plans are available, no prices are displayed, and no subscription can be purchased or paid for. There is no automatic renewal, paid-plan cancellation or paid priority support. If we enable paid plans in the future, we will announce them and publish updated terms and privacy information before accepting payments.

Account and credentials

If you create an account, we process your username, an Argon2id password hash, your permanent code, your public keys, your plan and its expiry date, and hashes of active sessions. We do not store your password in plain text or your private key. We do not currently offer email-based password recovery. If you sign in on another device, the permanent code is reassigned to the new identity; the previous device may lose access to that code. If you request account deletion, you will lose your permanent code and associated cloud files.

P2P transfers

In P2P transfers, content and metadata travel end-to-end encrypted between devices. The coordination server and the relay cannot read names, sizes or content. However, the relay can carry the encrypted bytes, and both services see the data needed to connect: code, device name, platform, version, public keys, observed public IP address and port, LAN IP addresses, and traffic timing and volume. Anyone who knows a code while the device is online can query some of that peer data. On a local network, discovery broadcasts the code, device name and platform, version, LAN IP addresses and public keys. The relay cannot read content, but it can see volume and timing.

Cloud (free plan)

Cloud storage is optional and is not used for P2P transfers. In the free beta it includes 5 GB in total, and each file is automatically deleted 30 days after it is uploaded. We store the file name, size, SHA-256 hash, owner and upload date, as well as the content in the storage backend (server disk or an S3-compatible provider). The cloud is not end-to-end encrypted: the operator and the storage provider can technically access the content. Only you should be able to list and download your files through your session, apart from the technical or legal access described in this policy. Pro and Team plans are not currently available.

Data on your device

The app stores app history, sessions, downloaded files and the keys it needs to work on your device. That local data is not uploaded to PeerWay, except for account data, optional telemetry and content you choose to upload to the cloud. Your identity private key and session keys stay on the device. If you erase local data or reinstall the app, you may lose history, downloads and keys; keep your own backups.

Technical app identity

For API protection, the app generates an installation identifier and an Ed25519 key pair. Each request is signed with the private key, which never leaves the device. The server stores the public key and a hash of the identifier, and binds the session to that hash while it is active. Version and platform may travel signed to check compatibility. We do not use this data for advertising. Reinstalling the app generates a new identity; you can request deletion of the installation data by writing to privacidad@peerway.me or privacy@peerway.me.

Technical and security logs

To operate, protect and diagnose the service, we may process IP addresses, codes, timestamps, security events (for example, rate limits) and technical connection data. Server access logs may contain IP addresses. We do not use this data for advertising or sell it.

Optional app telemetry

If you enable “Share usage statistics” in the app, we receive a pseudonymous heartbeat, not an anonymous one. It includes a random installation identifier (stored by the server as a hash), version, platform, plan, whether you are signed in, and aggregate counters for completed, failed and relayed transfers. It does not include files, names, codes, IP addresses or account data. The server keeps persistent per-installation rows and a daily presence record; the current code does not delete them automatically by age. You can disable telemetry in Settings at any time, although data already sent may remain as described in the retention section.

Website analytics

The public website uses first-party, cookieless analytics: aggregate daily counters of visits by page, language, approximate country, referring domain and downloads. It does not create profiles or use behavioural advertising. Server access logs may contain IP addresses. We do not use Google Analytics. You can block the analytics script in your browser without affecting how the page works.

Cookies and site storage

The website stores your language preference and, if you sign in on the web, an access token valid for 30 days. It may also use IndexedDB for the app identity. We do not use advertising cookies. PayPal is currently disabled and is not loaded on the pages while payments are unavailable.

Speed measurement

The app may measure your upload speed by sending a small amount of random bytes to the PeerWay server. The server discards them and does not store the result; the value stays on your device to help you choose between P2P and cloud.

Why we use data

We use data to create and maintain your account, provide cloud and P2P transfers, protect the service and prevent abuse, diagnose errors, respond to support requests and comply with legal obligations. The legal basis depends on the processing: performance of the service you request, your consent for optional telemetry, legal obligations and, where the law allows it, our legitimate interest in security and service operation. We maintain a database with the information described in this policy. We do not make automated decisions or build profiles with legal effects. Providing this data is necessary to create an account and use cloud storage; if you do not provide it, we cannot provide those features. If the data is inaccurate, you may request its rectification. You can withdraw consent at any time without affecting use of the service that does not depend on it.

Retention

While your account is active, we keep account data and cloud metadata. Free cloud files are automatically deleted 30 days after upload. Sessions expire after 30 days. If you request account deletion, we will handle the request and delete or anonymise associated data, except what we must keep for legal obligations, security or defence of claims.

We are implementing these retention targets: access logs, 30 days; inactive analytics and telemetry data, 12 months; support communications, 24 months; backups, 30 days; and payment records, only for the applicable legal period. Some periods are not yet automated. In particular, the current code keeps installation rows and aggregate analytics counters indefinitely, and access logs may be kept longer than the target while we complete rotation and automatic deletion. We do not claim that those periods are already guaranteed.

Providers and recipients

We may use or may start using providers to host the VPS and S3-compatible storage (mostly in the United States), Cloudflare for DNS and security, Backblaze B2 for object storage, Resend and Zoho Mail for email, and PayPal for payments when enabled. PayPal is disabled and is not used for charges in the beta. When they act as processors, these providers process technical data or cloud content on our instructions; when they act as independent controllers (for example, PayPal for payments), they are governed by their own policies. The PeerWay relay cannot read P2P content. We may also disclose data if required by law, to protect rights or safety, or in response to a valid request from a competent authority.

International transfers

Some providers may process data outside Ecuador. Where applicable law requires it, we will use appropriate safeguards for international transfers. This policy does not assert that every provider already has a signed contract, clauses or an adequacy decision; we will update this information when it is confirmed.

Security

We use TLS for API communications, Argon2id for passwords, hashes for session tokens and end-to-end encryption for P2P transfers. The cloud is not end-to-end encrypted, and the operator or storage provider can technically access its content. No system is completely infallible. If we detect a breach affecting your data, we will notify as required by applicable law and the competent authorities where appropriate. To report a security issue, email privacidad@peerway.me or privacy@peerway.me. See also our terms of service.

Your rights

You may exercise your rights of access, rectification, updating, erasure, restriction, objection, annulment, portability, not to be subject to automated decisions and withdrawal of consent. Requests are handled manually: write to privacidad@peerway.me in Spanish or privacy@peerway.me in English. Tell us which right you want to exercise and the details needed to identify your account; we may ask for additional information to verify your identity. You may also complain to the competent data protection authority; in Ecuador, the Superintendency of Personal Data Protection (SPDP). We do not sell personal data or use behavioural advertising.

Minimum age

PeerWay is not directed to children under 16. You must be at least 16 to create an account. If we learn that we have collected data from a child under that age, we will take steps to delete it.

Changes to this policy

We may update this policy to reflect changes in the service or the law. We will publish the current version with a new date. If a change is material, we will try to tell you through the website or app before it takes effect. We will not apply material changes retroactively without a legal basis.

Contact

For privacy, security, legal or copyright matters: privacidad@peerway.me (Spanish) or privacy@peerway.me (English). The Spanish mailbox is the main channel; the English alias is pending configuration and monitoring. If a message to the English alias fails, use the Spanish mailbox, and we will update this page when the alias is operational.