whispers

Privacy

Last updated 24 October 2026

whispers lets people share files directly between their browsers. This page explains what information that involves, who can see it, and how long it’s kept. To reach whoever runs whispers, use the contact page.

Files

Files you share go directly from your browser to the browsers of the channel’s other members. They’re encrypted end to end with keys that come from the channel’s link, so the whispers server never receives them, their names or their contents. That depends on the code your browser gets from the whispers server each time it opens a page: whoever runs the server, or anyone who broke into it, could change that code to read your channel’s link. Anyone with a channel’s link, and its PIN if it has one, can join it and download its files, so share them only with people you want to have the files.

The channel link

The part of a link after the # is the channel’s secret. Browsers never send it to the server. whispers derives a separate code from it to admit you to the channel, which lets the server bring a channel’s members together without being able to read their files. A channel can also need a six-digit PIN. Your browser then sends another code, derived from the link and the PIN, which lets the server check the PIN without learning it. Your browser keeps the PIN, like the channel’s other settings, until it deletes the channel’s data.

What the server receives

whispers’ server is in Helsinki, Finland. As with any website, it receives your IP address:

• when your browser loads whispers;
• when it connects to the signaling server, which introduces your browser to the channel’s other members;
• when it asks the server for your public address, so that browsers can connect directly (STUN);
• when you send a message from the contact page.

The signaling server also receives the code derived from each channel’s link, the code derived from its PIN if it has one, and which files each member holds, identified by codes computed from their encrypted contents, never by name. It gives each open page a random ID, and passes on, without keeping them, the connection details browsers swap to reach each other, which include their IP addresses. Each time you open whispers, your browser also asks the server whether the channels it has files for have ended, so it can delete their files. That tells the server which channels those are, though not their links.

• The web server’s logs keep, for each request, your network rather than your full IP address (the first three parts of an IPv4 address, or the first three groups of an IPv6 one), the time, the page asked for, the response, and what your browser says about itself: its name and version, and usually your operating system. They’re deleted after about two weeks.
• The signaling server keeps each open channel, with the IDs of the pages in it, so they can reconnect after a restart. For a channel with a PIN, it also keeps a code computed from the PIN’s code, which doesn’t reveal the PIN. It remembers a channel that has ended for up to three days, or for good if it was shut down after an abuse report. It logs nothing about visitors.
• For each day, the signaling server also counts how many channels were created, got their first file and ended, how many browsers joined a channel, and the most channels, browsers and files there were at once. It keeps these numbers for 30 days. They’re only totals: they don’t say which channel, file or visitor any of them came from.
• To limit abuse, the server counts connections, requests, new channels, wrong PINs and messages for each IP address or network, in memory only: messages for a day, the rest for up to an hour.

What other members see

Browsers in a channel connect to each other directly, so a channel’s members can see each other’s IP addresses. Your browser may also share your device’s address on your local network with them: some browsers do by default, and others do if you use Allow microphone and retry. That turns the microphone on for about five seconds, which lets the browser share the address. whispers never records or sends any sound.

What’s stored in your browser

whispers keeps the files you share and download in your browser’s private storage, encrypted, so you can go on sharing them. A file you download is decrypted only to save it, and the decrypted copy some browsers need for that is deleted after ten minutes, or the next time you open whispers if you close it before then. whispers also keeps your settings for each channel and the download folder you chose. A channel’s data is deleted when you leave the channel, or when it ends while you’re in it. Otherwise it’s deleted the next time you open whispers after the channel has ended or gone seven days unopened. Files you’ve saved stay where you saved them. whispers sets no cookies and shows no ads.

Messages

A message you send from the contact page is kept on whispers’ server, with the time it arrived, until whoever runs whispers reads and deletes it. Anything you put in it is kept with it, such as an email address for a reply or a channel’s link. The server doesn’t keep your IP address with the message, but sending it shows in the web server’s logs like any request, with your network and the time.

Donations

Donations to keep whispers running go through Ko-fi, on Ko-fi’s own site and under its privacy policy. If you donate, Ko-fi tells whispers’ operator the name and email address you give it, the amount and any message, and its payment provider may add more, such as part of your address. whispers’ pages load nothing from Ko-fi.

Your choices and rights

whispers needs no account. It handles the information above to run the service and to keep it safe from abuse. Depending on where you live, you may have the right to see or delete information about you, and to complain to a data protection authority. whispers keeps little that identifies anyone: its logs hold networks, not full addresses, for about two weeks. For questions or requests, use the contact page.

Changes

When this page changes, so does the date at the top.