The Private Way to Send Files Online: What Zero-Tracking Actually Means

"We don't track you." "Your privacy is our priority." "Zero tracking." These phrases have become so common in file sharing marketing that they've stopped meaning much. Almost every service collects some data — it's technically necessary for the internet to function. The meaningful questions aren't binary (tracked or not tracked) but specific: what exactly is collected, how long is it retained, who can access it, can it be linked back to you, and what does the platform do with it beyond the stated purpose?

This guide cuts through the vague privacy claims and explains what actually happens to your data when you use file sharing services — and which tools have architectures that minimize collection rather than just promising to handle it responsibly.

What "Private" File Sharing Services Actually Collect

Even services with genuine privacy commitments typically collect some subset of the following. Understanding the categories helps evaluate any specific service's claims.

IP address logging. Your IP address is recorded by virtually every server you connect to. It's technically required to route return traffic to you. The meaningful privacy question isn't whether an IP is logged — it is, always — but how long it's retained and whether it's linked to other identifiable data. A service that retains IP logs for 90 days and has no user accounts cannot link those logs to a named individual under most circumstances. A service with user accounts that retains logs indefinitely can build a complete picture of your activity over time.

Transfer metadata. Even without logging file contents, services can collect metadata: file size, file type (inferred from extension), transfer duration, timestamp, geographic region derived from IP, browser fingerprint, device type. This metadata can reveal behavioral patterns — which types of files you transfer, how frequently, at what times — without ever logging a single byte of actual file content.

Browser fingerprinting. Browser fingerprinting collects information about your browser version, installed fonts, screen resolution, time zone, hardware configuration, and dozens of other attributes. Combined, these create a unique identifier that can track you across sessions without cookies. Many analytics platforms embedded in file sharing sites collect this silently. You don't consent to it explicitly because it doesn't require cookies — the fingerprint is constructed from browser behavior, not stored data.

Third-party analytics scripts. Most websites embed Google Analytics, Hotjar, Mixpanel, or similar tools. These scripts send behavioral data to third parties — page visits, click patterns, time on page, scroll depth — completely separate from the service's own logging. A service might have a strict first-party privacy policy and simultaneously transmit detailed behavioral data to Google and Facebook via embedded scripts. Check what third-party scripts load on any file sharing page using uBlock Origin's logger or your browser's developer tools Network tab.

File content scanning. Many cloud-based services scan uploaded files for malware, policy violations, and copyright content. This involves accessing file content — which is, regardless of stated intent, the opposite of private file sharing. Google Drive, Dropbox, and most major cloud platforms explicitly state content scanning in their terms of service.

The Privacy Spectrum in File Sharing

Rather than binary "private or not," think of file sharing privacy on a spectrum from most to least data collection.

Worst: Ad-supported consumer platforms. Free tiers of consumer platforms that fund operations through advertising require extensive behavioral tracking. Your file sharing habits — what you share, with whom, how frequently, what types of files — inform ad targeting profiles. File content may be scanned. Data is retained indefinitely and linked to your account identity. Every transfer adds data points to a profile that exists to serve advertising.

Better: Privacy-focused cloud services. Services like Proton Drive explicitly commit to minimal logging, no ad targeting, and genuine E2E encryption. They still collect some metadata — IP logs for abuse prevention, connection events for service stability — but they don't link it to ad profiles, have clear retention limits, and use client-side encryption that prevents them from accessing file contents. These are policy-based privacy commitments from organizations whose business model doesn't require monetizing your data.

Best: P2P with no server file storage. Zapfile's P2P architecture minimizes collection by design. The signaling server — which facilitates the WebRTC connection setup — sees IP addresses and connection timestamps from both parties. The file itself never reaches Zapfile's infrastructure. There are no user accounts, so connection events cannot be linked to a persistent profile. No content scanning is possible because there's no content on the server to scan. No ad network scripts are embedded in the transfer flow.

This isn't perfect zero-tracking. A connection occurred, and IP addresses were logged. But it's architecturally close to the minimum data collection compatible with a functional internet service — and the most important data point (the file you transferred) was never collected at all.

How to Verify What a Service Actually Collects

Privacy policies are long and deliberately dense. Rather than reading the whole document, look for specific answers to these questions:

"Do you sell or share data with third parties?" This question has a specific answer. "Share with trusted partners" in the policy language often means selling in functional terms — the data flows to third parties for their commercial use. Look for explicit "we do not sell user data" language and verify it's not contradicted elsewhere in the policy.

"How long do you retain logs?" 30–90 days is reasonable for abuse prevention. "Indefinitely" or no stated retention period is a red flag. IP logs retained indefinitely and linked to user accounts create a permanent record of your activity.

"Can you access file content?" If the answer is "yes, for safety and policy enforcement," they can read your files. This is incompatible with genuine content privacy regardless of what else the policy says.

"What happens to user data if the service is acquired?" Acquisition routinely invalidates privacy commitments. WhatsApp's 2014 acquisition by Facebook resulted in substantial changes to how user data was handled. The policy commitment made by the original company may not survive ownership change.

Check third-party scripts independently. Privacy policies don't always fully disclose third-party data flows. Open the file sharing service in a browser with uBlock Origin's network log active. Every domain that receives a request is a potential data recipient. Google Analytics, Facebook Pixel, Hotjar — these are visible in the network log even when they're not prominently disclosed in the privacy policy.

Practical Steps to Reduce Tracking on Any Service

Beyond choosing the right tool, these steps reduce tracking on whatever service you use.

Use a VPN. A reputable no-log VPN (Mullvad, ProtonVPN) replaces your real IP address with a VPN exit node IP in server logs. That IP is shared among potentially thousands of users and not linked to your account. Your ISP sees traffic to the VPN server, not to the file sharing service. The service logs the VPN IP, which is not attributable to you.

Block third-party scripts. uBlock Origin (free browser extension) prevents analytics and fingerprinting scripts from loading. Most file sharing sites function correctly without them — the scripts serve the service's data collection interests, not yours. Blocking them doesn't break the transfer functionality.

Choose accountless services. No account means no persistent profile to attach transfer metadata to. Zapfile, WeTransfer (free tier), Wormhole, and Smash all operate without accounts on the recipient's side. Zapfile and Wormhole require no account from the sender either.

Avoid mobile apps for sensitive transfers. Mobile apps have broader device permission access than browser-based services. Apps may collect device identifiers (advertising IDs, device serial numbers), location data, and contact information depending on granted permissions. Browser-based tools — Zapfile, WeTransfer, Wormhole — access only what the browser allows, which is significantly more limited.

What Tracking-Minimal Transfer Looks Like in Practice

Using Zapfile through a VPN, with uBlock Origin active in the browser, for a transfer to a recipient who also uses a browser-based approach, with no accounts on either side: the data collected is a VPN exit node IP in a connection log, a session timestamp, and nothing else. The file content was never on any server. There are no user profiles. There's nothing linking the transfer to either party's real identity beyond network-level metadata that requires legal process and ISP cooperation to attribute to a person.

That's as close to genuine privacy in online file transfer as practical technology currently provides — achievable with free tools that require no technical expertise to use. The gap between this and the default of "open Google Drive and share a link" is enormous, and the friction difference is minimal.