Privacy Policy

Effective July 17, 2026

amanmaps is a peer-to-peer sharing tool built around a simple idea: the content you share should never touch a server. This policy describes what data our systems process, what we don’t collect, and how the architecture protects your privacy by default.

✓No accounts. No sign-up. No persistent identity.▶

There is no user database, no login system, no profile, and no way to identify you across sessions. Each session is a fresh, anonymous pairing between two browsers.

✓Nothing stored. Zero retention of content.▶

All content — text, links, files, and images — travels directly between your phone and computer via WebRTC, a peer-to-peer encrypted data channel. Our server never sees, logs, or stores any of it. File bytes are chunked and transferred over the same peer-to-peer channel as text messages, with no intermediate relay.

✓Peer-to-peer by design.▶

The signaling server only relays connection setup data (session IDs, SDP/ICE handshake messages) to help the two devices find each other. Once the peer-to-peer channel is established, the server is out of the loop entirely. File transfers, like text, happen entirely device-to-device.

✓Client-side safety checks only — no server-side scanning.▶

Files are validated entirely in your browser before transfer and again after receipt. These checks verify the file type (against a list of safe formats), the file size (against a configurable limit), and the file's content signature (magic number bytes) to confirm it matches its extension. No file content or metadata is sent to any server for inspection — we deliberately have no infrastructure that could scan or store file contents. Because we never handle file data on our servers, we cannot and do not provide antivirus or malware scanning. Only specific file types are accepted, and received files are never auto-opened or auto-executed. You should only accept files from people you trust.

✓Ephemeral on refresh — session dies instantly.▶

Closing or refreshing either browser tab immediately destroys the session and all associated state on the server. Partially transferred files are discarded — no bytes are retained anywhere. Sessions also expire automatically after 10 minutes of inactivity.

✓No tracking. No analytics. No cookies.▶

We do not use tracking pixels, analytics scripts, fingerprinting, or any form of persistent identifier. No cookies are used for tracking purposes.

What the signaling server handles

When you start a session, your browser connects to our signaling server to exchange the information needed to establish a direct peer-to-peer connection. This exchange consists of:

  • A session ID — a random identifier generated by your browser that tells the server which two devices belong to the same session. This ID has no relationship to your identity.
  • SDP handshake data— technical metadata about your device’s network configuration and media capabilities, exchanged briefly during connection setup.
  • ICE candidates — potential network routes between the two devices, relayed so they can find the most direct path to each other.

This handshake data is held in server memory only for the duration of the session. If the session is idle for 10 minutes, or if either device disconnects, all associated data is deleted immediately. File content never passes through the signaling server at any point.

IP addresses

Our signaling server processes IP addresses transiently for two purposes: rate-limiting (to prevent abuse) and facilitating the WebSocket connection. IPs are checked against an in-memory rate limit counter and are not logged or stored beyond the current time window. We do not correlate IP addresses with session IDs or content — we cannot, because content never reaches our server.

Separately, WebRTC peer-to-peer connections inherently reveal each device’s public IP address to the other device. This is a structural property of direct peer-to-peer networking, not something we control or store. If you are on a local network, the two devices may connect over your local IPs without any data leaving your network.

File handling and safety

Files and images are transferred using the same peer-to-peer WebRTC channel as text messages. Our servers never see, inspect, or store file contents at any point — not even transiently. All validation (type checking, size limits, content signature verification) happens entirely in your browser, client-side.

We deliberately do not operate any server-side scanning or antivirus infrastructure, because doing so would require file contents to pass through our systems. Instead, safety is enforced through client-only measures: only a specific list of safe file types is accepted, files are verified by their content signatures (magic number bytes), and received files are never auto-opened or auto-executed. These are practical safeguards, not a substitute for caution — you should only accept files from people you trust, just as with any direct file transfer.

Hosting subprocessors

amanmaps uses the following infrastructure providers, which process connection metadata as part of standard web and server hosting:

  • Vercel Inc.

    Frontend hosting

    Hosts the Next.js application that users load in their browser. Processes IP addresses and standard HTTP request metadata for CDN routing and DDoS protection.

    Vercel Inc.privacy policy →

  • Render Services Inc.

    Signaling server hosting

    Hosts the WebSocket signaling server that facilitates peer discovery. Processes connection metadata (IP addresses, timestamps, WebSocket handshake data) as part of standard server operations.

    Render Services Inc.privacy policy →

Why this is different

Most services that let you share content between devices work by uploading your data to a server, storing it (even temporarily), and then sending it to the other device. This means the service provider can see, log, or inspect your content. amanmaps was built specifically to avoid this pattern. By using WebRTC for direct device-to-device transfer, the content — whether text, links, files, or images — never exists on any intermediary. It goes from your phone to your computer, end to end, with no third party in the path.

Contact

For privacy questions, data requests, or concerns, contact:

issameljaouhariel@gmail.com