Privacy Policy

Last updated: 19 October 2026

1. Who we are

Poof is a file-sharing app for Windows, Android, the web, iPhone and Mac, operated from Belgium. “We” means the Poof team. For any question about your data, write to limeayhan@gmail.com.

2. What we collect

Created by the app

• Device identifier — a random ID created by Poof the first time it opens. It is not your phone's or computer's hardware or advertising ID. It lets your paired devices find each other.
• Device name and type — for example “PC” or “Android”, shown to your own devices when you pair them.
• Encryption public key — the public half of your device's encryption key, so your other devices can encrypt files for it. The private key never leaves your device.
• Notification token (iPhone and Mac) — lets us tell your device that a file has arrived.
• Nearby — when you look for nearby devices, our server compares a scrambled (hashed) version of your network address with other devices on the same network. Your IP address itself is not stored.

What you send

• Files, photos, videos and text you send to your devices. Between devices with a current version of Poof they are end-to-end encrypted: our server only ever sees scrambled data it cannot read.
• Messages to support, if you write to us from the app.

Optional

• Sign in with Apple — only if you use it to unlock a Premium bought on iPhone or Mac. We receive an anonymous Apple user ID and the purchase status. We do not receive your Apple password.
• Premium purchases on Windows, Android or the web are handled by Lemon Squeezy, our reseller. They collect your payment details and email; we never see your card. We receive your license key and whether it is active, so Premium can be turned on.

3. Why we use it

• To deliver your files to your own devices.
• To pair devices and show them to each other.
• To turn Premium on when you have bought it.
• To prevent abuse (for example, limiting how many requests one device can make).

We never use your data for advertising, profiling or selling to anyone. The legal basis is that this data is needed to provide the service you ask for (Art. 6(1)(b) GDPR) and our legitimate interest in keeping it secure (Art. 6(1)(f)).

4. How long we keep it

• Files in transit — stored temporarily, encrypted, on our server until the receiving device downloads them, then deleted. Files that are never collected are deleted after 1 hour.
• Pairing codes — 5 minutes.
• Device identifier, name and public key — as long as you use Poof.
• Sign in with Apple session — up to 90 days, or until you sign out.
• Purchase link between a checkout and its license key — 30 days.
• Your history of received files is kept only on your own device. Uninstalling Poof removes it.

5. Who else is involved

We only use services that are needed to run Poof:

• Render — hosts the server that connects your devices and relays files.
• Cloudflare — hosts this website, the web app and the account service.
• Lemon Squeezy — sells Premium on Windows, Android and the web, and handles payments, taxes and receipts. See their privacy policy.
• Apple — App Store purchases, Sign in with Apple and notifications on iPhone and Mac.

Some of these providers may process data outside the European Union; they do so under the safeguards required by the GDPR (such as Standard Contractual Clauses).

6. Cookies

This website uses no cookies and no trackers. The app stores its settings and your history on your device only.

7. Your rights

Under the GDPR you can ask to access, correct or delete your data, receive a copy, or object to its use. Uninstalling Poof deletes everything stored on your device; to delete what our server holds about your device, email us with your request. You can also complain to the Belgian Data Protection Authority (dataprotectionauthority.be) or the authority in your country.

8. Children

Poof is not directed at children under 13.

9. Changes

If this policy changes, we update the date at the top. Important changes are announced in the app.

Contact

limeayhan@gmail.com