Effective Date: August 2026
Welcome to QN Share. We believe that file sharing should be direct, private, and entirely under your control. This Privacy Policy explains how QN Share handles your data, permissions, and network connections to keep your files secure.
Our core principle is original-location sharing.
We do not upload your file contents to any cloud server, including Firebase.
We do not create duplicate staging folders before sharing.
All file transfers happen directly between the host and the guest device over your Local Area Network (LAN) or via a direct WebRTC peer connection over the Internet.
Remote access is strictly read-only; guests can browse and download, but they cannot edit, delete, upload, or execute anything on the host device.
When you choose to share files over the open Internet, QN Share uses Firebase Realtime Database purely as a temporary "matchmaker" to introduce the two devices. To establish this connection, we temporarily process and store:
A random session ID and anonymous user IDs (UIDs).
Creation and expiration timestamps.
Connection status and protocol generation.
Network routing data (encrypted SDP offers, answers, and ICE candidates).
Encrypted password-verification data (if you enable a password).
Important: The cryptographic secret used to secure your session is carried in the URL fragment (or QR code) and is never uploaded to Firebase. Once the devices connect, the signaling handshake is cleared.
To function correctly, QN Share requests specific on-device permissions:
Camera Access: We request camera access exclusively for scanning session QR codes. Video frames are processed locally on your device and are never recorded, retained, or uploaded.
Storage/Filesystem Access: Required so you can select the files you want to share and save the files you download.
While QN Share transfers files peer-to-peer, the app relies on select third-party infrastructure to facilitate the connections. These services may process standard technical data, such as IP addresses, user-agent information, and operational logs:
Google Firebase: Used for anonymous authentication, database matchmaking, and website hosting.
Google STUN Services: Used to help devices discover their public IP addresses for Internet sharing.
Internet/Carrier Networks: Used to transport the encrypted WebRTC data.
We use industry-standard cryptography to ensure your sessions stay private.
Internet signaling payloads are secured using AES-256-GCM authenticated encryption.
File data transferred over the Internet is protected by WebRTC’s native encrypted transport.
Optional session passwords are secured using PBKDF2-HMAC-SHA256 with 100,000 iterations.
You control exactly what files or folders are exposed. Sessions are protected by long random links, optional passwords, and expiration timers. You can manually terminate a session at any time by clicking "Stop sharing". Please remember that anyone possessing a valid link and password may attempt to access the session while it is active; treat your share links carefully.