Privacy
tosstome is built so that there is as little as possible to keep.
Files and messages
Files and text messages are never written to storage. A direct WebRTC transfer goes from one device to the other and is encrypted by the browser (DTLS). When a direct connection is not possible, the file passes through a relay running on Cloudflare, which forwards the bytes as they arrive and does not keep them. The relay connection is encrypted between each device and Cloudflare (TLS) but is not end-to-end encrypted yet.
Device discovery
To show devices on the same network to each other, the server groups connections by public IP address. The address is hashed before it is used, and the group exists only while devices are connected. Device names are random and created in your browser.
Inboxes
An inbox created with tosstome listen has two secret keys. The server stores only their SHA-256 hashes. The send key travels in the part of the link after #, which browsers do not send to the server in the page request.
Accounts, cookies and analytics
There are no accounts and no analytics. The site keeps your random device name in your browser's local storage. Cloudflare, which runs the service, processes connection data such as IP addresses as part of delivering it.
Source code
tosstome is open source, so all of this can be checked in the code.
Last checked 2026-10-28.