What a court order gets from your file transfer service

This piece looks at what a file transfer service could hand over if a court ordered it to. A production order in England and Wales and a subpoena in the United States work differently, but both can only reach what the service holds.

Everything below comes from the services' own published documents, checked on 10 October 2026. Where we couldn't confirm something, we say so.

Whose key

Every service here says your files are encrypted, and they all are. The difference is who holds the key.

Some services encrypt your file on their own servers, with a key they keep. They can open the file when they need to: to scan it, to show a preview, or because a court tells them to.

Others encrypt the file on your own device, before it leaves. The key stays with you and the person you send it to. The service stores something it can't read. This is what security people call end-to-end encryption.

WeTransfer's privacy policy is clear about which kind it is. It says it may share "your information, including User Content" with law enforcement in response to a subpoena, warrant or government request. WeTransfer and Smash also record your IP address and email address, by their own policies.

None of this is hidden. A service that can open your files can preview them, scan them for malware and recover them if something goes wrong. It can also produce them.

What the record shows

The clearest public examples come from Proton, which builds end-to-end encrypted email and storage in Switzerland.

In 2021, French police wanted to identify a climate activist who used Proton Mail. Their request went through Europol to Swiss authorities, who issued a binding order. Proton began logging the IP address used to sign in to the account (the number that identifies an internet connection) and handed it over. The emails stayed unreadable, because Proton doesn't hold the keys.

In 2024 it happened another way. Spanish police asked for the recovery email on a Proton account: the backup address used to reset a password. Proton gave it. It was an Apple address, and Apple's records led police to the person.

In both cases the encryption held. What reached the police was the information around the messages: when an account was used, from where, and what other accounts it was linked to. Security people call this metadata.

Proton publishes the numbers, which most services don't. In 2025 it received 9,301 orders for Proton Mail, contesting 988 of them. Whatever it hands over, it says it has no means to decrypt the emails or files.

Proton VPN shows the same rule from the other side. In 2025 it received 59 orders and handed over nothing, because it keeps no connection logs. A service can only produce what it keeps.

Ten services side by side

Two of these share a name. Magic Wormhole is an open-source tool, first released in 2016, that moves a file directly between two computers using a short spoken code. Nothing is stored, and both people need to be online at once. wormhole.app is a separate website, run by WebTorrent, LLC in California. It works much like Refueler Share: the key travels in the link, files are kept for 24 hours, and the recipient can start downloading before the upload has finished.

OnionShare runs on your own computer over Tor, which hides both people's IP addresses; the recipient needs Tor Browser. Proton Drive needs an account to send. Tresorit Send needs none and suggests sending the password separately from the link. crypt.fyi is built for passwords, notes and small files rather than large transfers.

Our own row has gaps. You can't yet run Refueler Share on your own server, though the code is public under the Apache 2.0 licence. Its encryption isn't post-quantum yet. Both are planned for 2027. It also hasn't had an independent security audit of its code; that will follow once the payment and timestamp work is finished.

Ownership can change the terms and conditions

A privacy policy describes a company as it is today. Companies change hands.

Bending Spoons bought WeTransfer in July 2024. A year later, WeTransfer's terms gained a licence to use uploaded files for "improving performance of machine learning models that enhance our content moderation process". After public concern, WeTransfer rewrote the clause within days and said it doesn't use customer content that way. Its current list of sub-processors, dated April 2026, includes Bending Spoons and its affiliates, AWS and two AI companies.

All of this is in WeTransfer's own documents. It is a reminder that the terms you agreed to can be rewritten by whoever owns the service next. That matters less when the service never held the key.

What jurisdiction does

Switzerland, the Netherlands, France and the UK each set their own bar for when data must be handed over, but those rules decide how an order is made, not what the service holds. WeTransfer and Smash both store files with AWS, a US company, and the US CLOUD Act lets American authorities require US companies to hand over data they control, wherever it is stored. The same law applies to Cloudflare, which Refueler Share runs on.

Architecture is what protects you; jurisdiction just determines how long the paperwork takes.

What a court order gets from Refueler Share

This is the full list of what we, or the companies we run on, could be made to produce.

• The encrypted file. Without the key it is unreadable, to us as well.
• The file's exact size. We stopped keeping it in our own records in October 2026; it now travels in the link. But the stored, encrypted parts are only slightly larger than the original (16 bytes per 32 MiB part), so their size gives the exact figure away.
• Timing and settings. When the file was uploaded and when it expires, how many parts it has, which plan it used, and whether delete-after-download or a download window was set.
• A fingerprint of the password, if you set one. Today this is a plain SHA-256 hash, and the password reaches our server as typed when the recipient unlocks the file. A weak password could be guessed from the hash. The password only gates the download: it is not part of the key, so the file stays encrypted either way. A fix is designed and on our roadmap. The password will be strengthened on your device and become part of the key, and our server will never see it. We'll update this page when it ships.
• A record that each upload pass was used, so none can be used twice. It doesn't name you.
• A note when a step fails, for a day. The step, the error's name and the first eight characters of the transfer's ID. Never the file name, which we can't see.
• IP addresses, for about a month. Our own code keeps a scrambled (hashed) form of a visitor's IP address for up to 10 minutes, to slow down abuse. Cloudflare, which runs our servers, also keeps a sample of requests for our account for about a month: the IP address, the time and the web address asked for, which can include the transfer's ID. That covers people opening a link as well as people sending one.

Cloudflare runs the servers your browser connects to, between you and our code. Those servers see your IP address and the web address you asked for, including the transfer's ID. They never see the key: that sits after the #, and browsers don't send that part. If you'd rather Cloudflare didn't see your IP, use a VPN, ideally one with multi-hop.

Updated 21 October 2026. Added the error notes, now kept for a day, and how long our own code keeps a scrambled IP address: up to 10 minutes.

Corrected 20 October 2026. This page said our systems keep IP addresses for about a minute. That was true of our own code, but it left out Cloudflare's sampled records, which we found on 20 October. The table and the list above now say so.

There are no payment records, because paid plans haven't opened yet. When they do, there will be two ways to pay. Paying by card means the card company and our payment processor hold your name and email, linked to your plan. Paying with bitcoin over Lightning goes through our own node, which sees an amount, a payment ID and a time, but not who paid. Once that route is live, upload passes will be bought separately from transfers, so a payment can't be matched to a file.

What no order can get from us: the key, the real file name, or the contents. All three live after the # in the link, and that part never reaches us.

If you sent a file yesterday and deleted the link, the encrypted file is still in our storage: the link works until its expiry date, and the stored data is cleared no later than 92 days after upload. It stays unreadable to anyone without the link, including us.

What we can't protect yet

Each time you open Refueler Share, your browser downloads our code from Cloudflare. If Cloudflare were forced or hacked into sending altered code, that code could copy the keys of people who send files afterwards. Files already sent would stay safe. Every service that encrypts in the browser shares this weakness, including Proton's web apps, wormhole.app and crypt.fyi. We plan to publish a fingerprint of every version of our code, lock the page to it, and offer ways to send that don't load fresh code on each visit.

No service on this page can protect a device that is already compromised. If someone controls your computer or phone, they can read the file before it is encrypted. End-to-end encryption protects you from the server. It doesn't replace looking after your own device.

We'll update this page when any of this changes. From January 2027 we'll also publish a transparency report twice a year, including when there is nothing to report.