Transmit
Open the app
Draft: this text is waiting for a final check before it is relied on.
Trust and safety
The facts about how Transmit handles your data and keeps people safe, in one place. The privacy policy and terms are the full text; this page is the summary.
Who handles your data
| Service | What it does for us | What it gets |
|---|---|---|
| OVH | The servers that run Transmit | Everything the app handles, as the host. Voice and video go from your device to these servers only |
| Cloudflare | Sits in front of the website, the app and live connections; DNS; sends and receives our email | Traffic to and from the app, and the emails we send you or you send us |
| MongoDB Atlas | The database | Accounts, messages, settings and the other records in the privacy policy |
| Backblaze B2 | Stores files you send, and desktop app downloads | Your uploaded files and pictures |
| Sign-in, and checking links against Safe Browsing | Your sign-in, and the web addresses of links in messages | |
| Firebase Cloud Messaging (Google) | Delivers notifications you turned on | A token for your device and the notification |
We do not sell data, show adverts, or use analytics or advertising cookies. [[TO CONFIRM: where each service stores data, and the signed data processing agreement and transfer safeguards with each.]]
How long we keep things
| What | How long |
|---|---|
| Your account and messages | Until you delete your account, or a year after you stop using it (we email you twice first) |
| An account you delete | Hidden for a waiting period (14 days by default), then erased. Signing in again in that time cancels it |
| Sign-in sessions | Up to 30 days. Your network address is stored only as a scrambled (hashed) value |
| Drafts | 30 days |
| Security log | 90 days |
| Notification tokens | Until you turn notifications off or sign out of the device, and removed after 90 days of the device not opening the app |
| Files | With the message they were sent in. A file attached but never sent goes after a day. Files that are not pictures go after 90 days unless a server keeps them |
| A copy of your data you asked for | Ready after 48 hours, available for 7 days, then deleted. Deleted at once if you delete your account |
| A report of child sexual abuse material to the authorities | The record is kept for a year after we have sent it, even if the account is erased in the meantime |
| Appeals | The link works for 30 days. An appeal and what was written in it are kept for a year after it is answered |
| Reports | Up to a year after they are closed. [[TO CONFIRM: reports about illegal content that must be kept for the authorities]] |
| A record that an account was erased | Kept, as a scrambled version of the email address and counts of what was removed. It cannot be turned back into your email address, and it stops a restored backup from bringing you back |
| Backups | [[TO CONFIRM: how long backups are kept]]. Anyone erased since a backup is erased again if it is ever restored |
How we protect it
- No passwords to lose. You sign in with Google, so we never hold a password for you.
- Encrypted in transit. Connections to the website, the app and live chat use HTTPS and secure WebSockets.
- Files are not public. A file is only reachable through a link that is signed and expires.
- Checked on our side, not just yours. Who may do something is decided by our servers from our records. Hiding a button in the app is never the only protection.
- Limits on misuse. Sign-in attempts, messages and uploads are rate limited, and everything sent to the servers is checked for its shape and size.
- Sensitive actions need a second step. Safety decisions that affect a person (suspending, banning, removing content) can only be made by the owner, from a separate tool that checks a hardware-backed passkey.
- Moderation sees only what is reported. We do not read private conversations. When a message is reported we see it with a few messages around it, and every reading is logged.
- Erasure survives a restore. The record of who was erased is kept outside the database, and the app checks for it and raises an alarm if a restored database brings someone back.
What we have not done yet
- Messages are not end-to-end encrypted. They are protected on the way and while stored, but our servers can read them. We choose not to, except for a message that has been reported.
- No independent security test yet. We have not yet had an outside company test the service. We will say here when we do.
Reporting a security problem
If you think you have found a weakness in Transmit, please tell us before telling anyone else: write to [email protected] with the subject Security report. Tell us what you found, how to see it for ourselves, and what you think it could allow. A person reads it, and we will reply as soon as we can. Our contact details are also in a security.txt file.
- We will not take action against someone who looks for problems in good faith, only uses their own accounts and data, does not read or change other people's data, does not slow the service down for others, and gives us a reasonable time to fix it before sharing it. [[TO CONFIRM: wording of this promise, with your solicitor.]]
- We cannot pay rewards. We are glad to thank you here if you would like that.
- Please do not test with other people's accounts, try to get at children's data, or use social engineering or physical attacks.
Reports, removals and appeals
- Anyone can report. In the app, report a message, a person or a server from its menu, and choose whether to block them too. Someone without an account, or an authority, can write to [email protected].
- A person reads it. Reports about something illegal are put first. [[TO CONFIRM: how quickly you aim to look at illegal-content reports and at other reports.]]
- We decide. We can dismiss the report, remove the message or file, suspend an account for a number of days, close it, or delete a server. Someone who removes something is not told who reported it.
- We tell both sides. The person whose content was acted on gets an email with what we did and why. The person who reported it is told that we looked and whether we acted.
- Illegal content. Anything that sexually exploits a child is reported to the National Crime Agency. We keep a record for that report: the reported message, and the details we hold about the account. We never keep or send copies of images or files. We do not scan private messages looking for it.
- You can appeal. The email to the person has a link that works once and needs no sign-in, because a suspended person cannot sign in. They say why they think it was a mistake, a person looks again, and the answer comes by email. A suspension or closure is lifted if we got it wrong. A removed message or a deleted server cannot be brought back. They can also write to [email protected].
Authorities, regulators and rights holders can reach us at the same address; it is read by a person.