Transmit
Open the app
Draft: this text is waiting for a final check before it is relied on.
Trust and safety
The facts about how Transmit handles your data and keeps people safe, in one place. The privacy policy and terms are the full text; this page is the summary.
Who handles your data
| Service | What it does for me | What it gets |
|---|---|---|
| OVH | The servers that run Transmit | Everything the app handles, as the host. Voice and video go from your device to these servers only |
| Cloudflare | Sits in front of the website, the app and live connections; DNS; sends and receives my email | Traffic to and from the app, and the emails I send you or you send me |
| MongoDB Atlas | The database | Accounts, messages, settings and the other records in the privacy policy |
| Backblaze B2 | Stores files you send, and desktop app downloads | Your uploaded files and pictures |
| Sign-in, and checking links against Safe Browsing | Your sign-in, and the web addresses of links in messages | |
| Firebase Cloud Messaging (Google) | Delivers notifications you turned on | A token for your device and the notification |
I do not sell data, show adverts, or use analytics or advertising cookies. [[TO CONFIRM: where each service stores data, and the signed data processing agreement and transfer safeguards with each.]]
How long I keep things
| What | How long |
|---|---|
| Your account and messages | Until you delete your account, or a year after you stop using it (I email you twice first) |
| An account you delete | Hidden for a waiting period (14 days by default), then erased. Signing in again in that time cancels it |
| Sign-in sessions | Up to 30 days. Your network address is stored only as a scrambled (hashed) value |
| Drafts | 30 days |
| Security log | 90 days |
| Notification tokens | Until you turn notifications off or sign out of the device, and removed after 90 days of the device not opening the app |
| Files | With the message they were sent in. A file attached but never sent goes after a day. Files that are not pictures go after 90 days unless a server keeps them |
| A copy of your data you asked for | Ready after 48 hours, available for 7 days, then deleted. Deleted at once if you delete your account |
| A report of child sexual abuse material to the authorities | The record is kept for a year after I have sent it, even if the account is erased in the meantime |
| Appeals | The link works for 30 days. An appeal and what was written in it are kept for a year after it is answered |
| Reports | Up to a year after they are closed. [[TO CONFIRM: reports about illegal content that must be kept for the authorities]] |
| A record that an account was erased | Kept, as a scrambled version of the email address and counts of what was removed. It cannot be turned back into your email address, and it stops a restored backup from bringing you back |
| Backups | [[TO CONFIRM: how long backups are kept]]. Anyone erased since a backup is erased again if it is ever restored |
How I protect it
- No passwords to lose. You sign in with Google, so I never hold a password for you.
- Encrypted in transit. Connections to the website, the app and live chat use HTTPS and secure WebSockets.
- Files are not public. A file is only reachable through a link that is signed and expires.
- Checked on my side, not just yours. Who may do something is decided by my servers from my records. Hiding a button in the app is never the only protection.
- Limits on misuse. Sign-in attempts, messages and uploads are rate limited, and everything sent to the servers is checked for its shape and size.
- Sensitive actions need a second step. Safety decisions that affect a person (suspending, banning, removing content) can only be made by the owner, from a separate tool that checks a hardware-backed passkey.
- Messages are only read when reported. When a message is reported I see it with a few messages around it, and every reading is logged. Messages are not end-to-end encrypted, but they are protected in transit and while stored.
- Erasure survives a restore. The record of who was erased is kept outside the database, and the app checks for it and raises an alarm if a restored database brings someone back.
How it is tested
The code is built with AI-assisted coding (see About), and I check it with automated tests that run before changes are accepted:
- 1,900+ backend tests for the server's routes, live connections and data.
- 800+ frontend tests for the app's screens, hooks and logic.
- 1,000+ end-to-end browser tests (Playwright) that drive the real app like a person would, in Chrome and Firefox, on desktop and phone layouts.
- Security tests that try to do things you should not be allowed to do (acting on someone else's messages, servers or settings from an outsider's or ordinary member's account), feed the servers malformed and hostile input, and race two actions against each other.
- Long-running soak tests for chat, voice, streaming, reconnecting, restarts and many people at once.
- Automated scanning on every change and weekly: leaked secrets across the whole history, known vulnerabilities in dependencies, and insecure configuration in the build and deployment files.
This is my own automated testing, not an independent test (see below).
What I have not done yet
- No independent security test yet. Everything above is testing I do myself. Down the road, if it becomes financially viable, I would like to have an outside company penetration-test the service, and I will say here if that happens.
Reporting a security problem
If you think you have found a weakness in Transmit, please tell me before telling anyone else: write to [email protected] with the subject Security report. Tell me what you found, how I can see it for myself, and what you think it could allow. A person reads it, and I will reply as soon as I can. My contact details are also in a security.txt file.
- I will not take action against someone who looks for problems in good faith, only uses their own accounts and data, does not read or change other people's data, does not slow the service down for others, and gives me a reasonable time to fix it before sharing it. [[TO CONFIRM: wording of this promise, with your solicitor.]]
- I cannot pay rewards. I am glad to thank you here if you would like that.
- Please do not test with other people's accounts, try to get at children's data, or use social engineering or physical attacks.
Reports, removals and appeals
- Anyone can report. In the app, report a message, a person or a server from its menu, and choose whether to block them too. Someone without an account, or an authority, can write to [email protected].
- A person reads it. Reports about something illegal are put first. [[TO CONFIRM: how quickly you aim to look at illegal-content reports and at other reports.]]
- I decide. I can dismiss the report, remove the message or file, suspend an account for a number of days, close it, or delete a server. Someone who removes something is not told who reported it.
- I tell both sides. The person whose content was acted on gets an email with what I did and why. The person who reported it is told that I looked and whether I acted.
- Illegal content. Anything that sexually exploits a child is reported to the National Crime Agency. I keep a record for that report: the reported message, and the details I hold about the account. I never keep or send copies of images or files. I do not scan private messages looking for it.
- You can appeal. The email to the person has a link that works once and needs no sign-in, because a suspended person cannot sign in. They say why they think it was a mistake, a person looks again, and the answer comes by email. A suspension or closure is lifted if I got it wrong. A removed message or a deleted server cannot be brought back. They can also write to [email protected].
Authorities, regulators and rights holders can reach me at the same address; it is read by a person.