Privacy notice

Version 1.0.5 — Effective September 15, 2026 at 04:00:23 UTC

This correction was authored September 14, 2026 and updated September 15, 2026; version 1.0.5 became effective September 15, 2026 at 04:00:23 UTC. Version 1.0.4 took effect September 14, 2026 at 20:43:59 UTC with the connection-discovery release and remained effective until version 1.0.5 took effect.

This notice explains how Exist.Dev LLC, legally registered in Florida as EXIST.DEV LLC, handles information when you use WolfP2P. For questions or privacy requests that need human handling, use Contact Us.

WolfP2P's coordination server does not receive, store, or relay the file bytes streamed through the direct browser-to-browser data channel. It also does not receive file metadata, including filenames, folder names, relative paths, file extensions, per-file sizes, manifests, or content-derived verification information, from that channel.

The WolfP2P browser client running locally in each participant's tab necessarily processes the file bytes and file metadata it sends or receives. That local processing remains subject to the browser's permissions and is separate from the coordination data processed by the coordination server.

When receiving through browser-download mode, the browser stages received file bytes in browser-private storage before you save them as downloads. Verified receipt in that storage is not confirmation that a download was saved. WolfP2P currently provides no automatic cleanup, fixed retention period or in-app deletion control for these staged files. Clearing site data or browser eviction can remove them. Save and verify needed downloads first. See Cookies and similar technologies for local records and storage controls.

WolfP2P is not a zero-data service. Its coordination server processes limited coordination data needed to operate, secure, and diagnose the service. What WolfP2P's Server Sees explains the complete categories and purposes.

WolfP2P uses information only as reasonably necessary to provide and secure the service, enforce the Terms, measure and improve the product when optional analytics is accepted, document choices, respond to requests, meet legal obligations, and establish or defend legal claims.

Exist.Dev does not sell transferred-file information and does not provide transferred file bytes to advertisers.

WolfP2P uses Cloudflare to serve and protect the public site, proxy application requests and verify online forms through Turnstile. It uses Microsoft Azure for application hosting, the PostgreSQL operational database, Application Insights monitoring and the first-party product-analytics destination. Azure Communication Services sends operational intake notifications containing the submission reference and category, not the submitted message or reply contact details. These notifications are separate from optional analytics and are not proof that a case has been decided or an email delivered.

Provider handling depends on the service used and applicable terms; these descriptions do not assert an identical legal role for every provider service or a provider-specific retention guarantee. Information may also be disclosed when required by law, to protect people or the service, or in connection with a corporate transaction subject to appropriate safeguards.

WolfP2P uses Cloudflare's STUN service to help your browser find a direct connection to the other participant. Your browser sends connection-discovery requests to Cloudflare, exposing its public IP address, network port and request timing. WolfP2P does not send file contents, filenames, tunnel codes or analytics identifiers in these requests. File contents continue to travel directly between the two browsers; WolfP2P does not configure a TURN relay. This connection service operates independently of your optional analytics choice. Cloudflare's handling of service and network information is described in its privacy policy.

The receiver obtains the files and transfer information you intentionally offer. WolfP2P does not verify that person's real-world identity; confirm the intended receiver separately before offering sensitive files.

• Temporary tunnel state, connection credentials, and rate-limit windows expire according to their short operational lifecycles.
• Ordinary essential operational and security records are retained for no more than 30 days.
• Raw optional product-analytics events are retained for no more than 90 days.
• A pseudonymous analytics profile and its governed summary are retained for no more than 395 days after relevant profile activity.
• Minimal consent evidence is retained for no more than five years after the relevant decision or withdrawal.
• Terms acceptance records are retained for no more than six years after acceptance.
• A minimized closed privacy-request record is retained for no more than three years after closure.
• Closed correspondence about contact, accessibility, copyright, security, disputes and privacy appeals is kept for no more than three years after closure, with earlier minimization or deletion when no longer needed. Open cases are reviewed annually and closed when handling is complete.
• We keep only the restricted evidence needed to honor a valid arbitration opt-out while we may rely on the agreement it covers and for no more than six years after we permanently cease relying on that agreement. We review continued need annually. Site visits or later Terms acceptance do not restart this period or automatically withdraw an earlier opt-out. Ancillary opt-out correspondence follows the three-year closed-case schedule.

A restricted record may be held longer when reasonably necessary for a documented dispute, investigation, security incident, preservation duty, or other legal obligation. The hold is limited to necessary records, with its reason and scope documented and reviewed; it is released when no longer needed. Properly deidentified aggregate statistics may be retained longer when they cannot reasonably be linked to a person or device.

The periods above govern records controlled by Exist.Dev; browser-local storage has the separate lifecycles described in Cookies and similar technologies. Provider service records may be governed separately by the applicable provider terms and privacy information. This distinction does not extend the retention promises above for records controlled by Exist.Dev.

You may accept or decline optional analytics and later change or withdraw that choice. From the browser carrying the identifier, Your WolfP2P Data can export the associated server profile record and consent decisions, or request erasure of that profile. The export includes the profile reference, whether a profile was found, its creation and last-seen times when present, and associated consent decisions. It is not an export of raw analytics events, local activity, reports, recovery records, staged files, Terms acceptance evidence, intake cases or provider records.

WolfP2P has no account or identity directory. An email address, name, tunnel code, IP address, or description of a transfer is not used to guess which browser profile belongs to a requester. If the browser identifier has been cleared or lost, Exist.Dev may be unable to locate that profile.

Depending on applicable law, you may also request access, correction, deletion, restriction, or review of a privacy decision. Exist.Dev will acknowledge a human-handled privacy request within 10 business days and respond within 45 calendar days, subject to any permitted extension and any shorter legal deadline. A requester may appeal a denial or limitation within 30 calendar days through the Privacy Appeal form. Exercising a privacy right does not reduce transfer functionality.

The browser-profile erasure control asks the service to delete the identified profile and stops analytics collection. When the service confirms the profile erasure, the browser clears its analytics identifier and privacy choices. If a request is refused or cannot reach the service, collection stays stopped and the existing identifier is kept for retry, not for resumed tracking. An unavailable service does not establish that no records exist or that deletion succeeded. A local reset alone is not confirmation of server deletion. This control does not delete local activity, reports, recovery records, remembered handles, staged received files, saved downloads or another participant's copies.

Raw analytics events, retained consent and Terms acceptance evidence, intake cases and provider records are not all deleted by this control. Raw events remain subject to the 90-day maximum above; retained evidence remains subject to its stated purpose, retention limit and any applicable documented hold. For records outside the control's scope, use Contact Us to request human review. A later analytics acceptance creates a new browser identifier.

WolfP2P is a general-audience service and is not directed to children under 13. Children under 13 may not use it. WolfP2P does not use an age gate, collect a birth date for ordinary use, or infer age from transfer or analytics activity. If Exist.Dev receives information that creates actual knowledge requiring action, it will take the steps required by applicable law.

If you believe a child under 13 has provided personal information to WolfP2P, report it through Contact Us or the direct email listed there. Describe the concern and how we can reply; do not send the child's files or unnecessary personal information.

WolfP2P uses technical and organizational safeguards appropriate to the information it processes, but no internet service can guarantee absolute security. Material incidents will be communicated through legally required channels and linked from WolfP2P Security when public notice is appropriate.

WolfP2P is operated from the United States and is currently offered and supported for the US English market. People may access it from elsewhere, which can result in information being processed in the United States.

Version 1.0.5, authored September 14, 2026; effective September 15, 2026 at 04:00:23 UTC: Corrects existing analytics scope, browser-file staging, export and erasure boundaries, provider descriptions and the child-privacy reporting route. It records the actual activation of version 1.0.4. It does not expand analytics or reduce existing retention commitments. It adds the purpose-separated correspondence and minimal arbitration opt-out evidence schedule, activated with the matching retention implementation on September 15, 2026 at 04:00:23 UTC.

September 14, 2026 (version 1.0.4): Added Cloudflare connection discovery when the release activated at 20:43:59 UTC. Discovery exposes network address information to Cloudflare; transferred files still travel directly between browsers. Optional analytics was unchanged.

September 14, 2026 correction (version 1.0.3): Removed file count and cumulative byte totals from the essential coordination inventory to match the confirmed Product data inventory. This corrects the description of existing scope; it does not add collection, activate optional outcome or volume analytics, or change connection discovery. The previous notice was version 1.0.2, effective September 4, 2026.

Material changes receive a new version, effective date, and notice where required. A material expansion of an optional purpose requires a new choice; updated wording alone does not broaden an earlier analytics grant.

Version history: Version 1.0 was effective August 19, 2026. Version 1.0.1 took effect August 20, 2026 and records that optional server-side product analytics and the associated export and erasure endpoints became operational that day. Between the first notice's effective date and activation, the optional analytics interface was visible but the server did not derive analytics subjects or accept optional browser events. No excess collection occurred during that interval. Version 1.0.1 also describes the implemented page measurement more precisely: it records the page beginning a later document load after consent, not every client-side content navigation. Version 1.0.2 took effect September 4, 2026 and corrects the connection-discovery disclosure: the deployment at that time configured no STUN or TURN servers and did not contact Google's public STUN service as previously stated. This correction removes an inapplicable third-party disclosure; it does not add a purpose or broaden collection.

Exist.Dev LLC

2769 Avalon Street

Cantonment, Florida 32533, United States

Online enquiries and direct email

+1 850-287-2235