Your files are yours.
We just pass the envelope.

1What Space. collects

Space. is built so there is very little to collect:

• No account needed nearby. A same-network hand-off does not ask for a name, email, or phone number. Sending or receiving through the relay requires a sign-in. An @username is optional (see section 4).
• Your email address, if you sign in. The address you sign up with is held by our sign-in provider so you can log in. If you also link an address to your device (to receive a username certificate), the relay keeps it until you remove it. You can delete your account at any time (see section 7).
• Files, photos and text you send are stored only for the lifetime of a drop or a Space, sealed on your device. The relay stores those sealed bytes and a lookup id. It does not receive the code. Each file is limited to 50 MB, and a drop to about 96 MB.
• Minimal, opaque metadata — piece counts, byte sizes and timestamps needed to run a drop or a shared board — exist only for as long as the drop or Space does (see section 3).
• No advertising identifiers, no third-party trackers, no analytics SDKs. We build no profiles and sell nothing, because there is nothing to sell.

2How transfers are protected

Every drop and every Space post is end-to-end encrypted. The key is derived on your device from the six-character code — like 7KP4XN — and never leaves it. Content is sealed before it leaves your device and can only be unsealed by a device that enters the correct code.

The relay stores the sealed bytes. It does not have the code, so it cannot open the drop. Someone who obtains both the sealed bytes and the code can open them: the code is the key.

A device keypair is generated on your device and used to sign mail and claims. Signing in, when a send goes through the relay, uses that identity plus the account you create. With direct sends, the sender's drop code reaches you inside a sealed envelope.

3How long we keep things

Space. is ephemeral by design — everything on our relay deletes itself:

• Drops — deleted automatically: about 15 minutes after creation if unclaimed, and no later than 10 minutes after the first pickup. When both sides have the content, it's gone.
• Spaces — a shared board wipes itself after 24 hours without activity and never lives longer than 7 days. Old posts fall off past 60 posts or 120 MB, and the creator can wipe every post for everyone at once.
• Direct-send envelopes — the sealed note that tells you a sender's drop code lives at most 20 minutes.
• Presence pings — the "who's here" count in a Space refreshes over a rolling 60-second window.

We do not keep backups. Deleted means deleted: there is no trash to restore from.

4Optional usernames

If you want people to reach you by name instead of a code, you can register an @username. This is completely optional. If you do, we store the username you chose, a display name you can set, the date you registered, and the public halves of your device keys — the minimum needed to route direct sends to you and verify signatures. None of it identifies you personally: the keys are random, generated on your device, and unique to you.

You can stop using your username at any time: choose Delete account in Config, or use app.spaceapp.cloud/delete, and the record is removed immediately.

5Connection data & abuse protection

To stop anyone from brute-forcing codes, the relay keeps a temporary, per-IP record of wrong-code guesses: miss timestamps are held for up to 10 minutes, and repeat offenders earn a cool-off — from 1 minute up to a full hour. Your IP address is used for nothing else: no profiling, no analytics, no log of what you transfer.

Space. is hosted on Cloudflare, which processes standard connection data (like IP addresses) as part of serving any site or API. The spaceapp.cloud website itself sets no advertising or analytics cookies; it loads its display font from Google Fonts, which may receive your IP address as part of that request.

6Children

Space. is simple enough for anyone to use and collects no personal information beyond what is described above. We do not knowingly collect personal information from children under 13. A relay sign-in is not offered as a child account.

7Your choices

• Stay nearby: a hand-off on a shared Wi-Fi network does not need an account. Sign in only to send far.
• Clear a Space: if you created it, one tap wipes every post from every device.
• Delete your account: choose Delete account in Config (signed in), or go to app.spaceapp.cloud/delete. It immediately removes your login (the email you signed up with), your @username, any email linked to your device, and your direct-send mailbox. It cannot be undone, and the username becomes available to others.
• Local data: your recent-contacts list and preferences live on your device and never leave it unless you send them. Anything the app keeps on-device — including the hidden easter egg's progress — stays there.

8Changes to this policy

If we change this policy, we will update the date at the top of this page. For day-to-day use of Space., nothing here changes how the app behaves: files stay sealed on the device, nearby needs no account, and drops stay short-lived.

9Contact

Questions about privacy? The support team answers in Telegram at t.me/Spaceapp_supportbot. To delete your account and its data yourself, go to app.spaceapp.cloud/delete.