Privacy

Privacy Policy

Last updated October 17, 2026

Vastova is a program for sending large files directly from one computer to another. It is built so that we never see your files or your data. This policy explains what that means in practice.

In short: no accounts, no analytics, no tracking. Your files travel directly between computers, encrypted, and are never stored on a Vastova server, because there isn't one.

Your files

Files go straight from the sender's computer to the receiver's, encrypted end to end (TLS 1.3) with keys that exist only on those two computers.
When a direct connection isn't possible, an encrypted relay server passes the data along. Relays can't read it, and they don't keep it.
On the download page (vastova.pages.dev), the key to a link sits after the # in the address. Browsers never send that part to the website.

What we collect

Nothing. Vastova has no user accounts and contains no analytics or advertising code. We don't sell, rent or share data, because we don't have any.

A few services see technical details, such as your IP address, as part of ordinary internet connections:

Cloudflare hosts the website and keeps standard request logs under its privacy policy.
GitHub serves downloads and update checks under its privacy statement.
Relay and address-lookup servers help two computers find each other. They see that a connection happens, not what's in it.

Cloud destinations (Google Drive, OneDrive, Dropbox, Box)

You can choose to have received files saved into a cloud drive. If you connect one:

You sign in on the provider's own page. Vastova never sees your password.
The provider gives Vastova an access token. It is stored only on your computer, in its system keychain, and is never sent to us or anyone else.
Vastova uses that access for one thing only: uploading the files you chose to deliver there, into the folder you chose.
For Google Drive, Vastova asks only for the drive.file permission. It can see and change only files it created itself, not the rest of your Drive.
Disconnecting the drive in Vastova deletes the token from your computer. You can also withdraw access at any time in your account's security settings with the provider.

Vastova's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Data from Google, Microsoft, Dropbox or Box is not used for advertising, not transferred to anyone, not read by people, and not used to train AI models.

Storage accounts and servers you add

If you connect an S3-compatible bucket or a WebDAV server, its address and credentials stay on your computer (secrets in the system keychain). They are used only to read and write the files you choose.

Children

Vastova isn't directed at children under 13 and doesn't knowingly collect anything from them; it doesn't collect personal data from anyone.

Changes

If this policy changes, the new version will be posted here with a new date.

Contact

Questions: jayrossproduction@gmail.com