How Handspan protects file transfers
Handspan uses a temporary invitation to pair a sender with a receiver. The receiving device reviews the offered files before file content moves. Handspan tries a direct connection when possible. When a direct route is unavailable, updated clients use temporary encrypted storage.
Direct transfer
When WebRTC can connect the devices, files travel over an encrypted device-to-device connection. The service helps exchange connection information. Google and Cloudflare STUN services help discover network routes; they receive address-discovery traffic, not your file content.
Temporary encrypted storage fallback
Updated clients can upload encrypted objects directly to a private Cloudflare R2 bucket and download them directly to the receiving device. Names and contents are encrypted before upload, and only the paired devices hold the file keys. Handspan authorizes object access and tracks encrypted object metadata and cleanup in a private database; Render does not carry file payloads on this route.
A storage session lasts up to two hours. Delivery confirmation, cancellation or expiry requests deletion; retries and provider outages can delay it. Cleanup records are kept at least 24 hours beyond the last signed upload URL expiry so late uploads can be removed. A configured bucket lifecycle rule adds asynchronous cleanup. Browser Save can confirm a download request, not disk persistence. Keep the original until the receiver has saved their copy.
Temporary network failures and expired object URLs can be retried while the session is open. This does not provide browser-restart recovery, a permanent cloud inbox or guaranteed delivery. The service has no recovery key. Browser encryption still depends on the integrity of the code delivered to the device; it is not a promise that every future client update is incapable of compromising privacy.
What does the service learn?
Connection setup involves temporary room identifiers, authentication exchanges and encrypted signaling. Hosting and network providers can observe metadata such as IP addresses, timing and traffic volume. Direct peers also learn network information required to connect. Encryption of files does not hide all connection metadata.
Usage totals
Updated receivers report a completed batch's file count, rounded size and duration, receiving platform, and direct or temporary storage method. The service combines these into administrator-only daily and overall totals. It does not include file names or contents in those reports. The privacy notice explains retention and provider details.
Your approval matters
Only scan invitations and accept files from people you expect. Treat the receiving QR and code as private invitations. Verification checks that received bytes match the transfer; it does not scan files for malware or prove that their contents are safe. Handspan does not open received files automatically.
Practical limits
Keep both devices connected until completion. No browser-based transfer can guarantee operation through every firewall or during device sleep. Browser storage limits also apply. If you need to send to an offline recipient, use a service designed for stored deliveries instead.
Handspan has automated security and protocol checks but has not had an independent security audit. For privacy or accessibility questions, contact handspanbusiness@gmail.com.