Your files go straight across. Through no one.
ZiggSend moves the file from your phone to your computer over your own network. There is no site in the middle, no account, and no server keeps what you send. Here is how that works, in plain English first and then in the technical details.
In 5 answers
Do my files go through any server?
No. They go from the phone to the computer over your home or office Wi-Fi (or, from Android to the Mac, over the cable). No file is uploaded to the cloud, and no server of ours receives or keeps what you send.
Can someone on the same Wi-Fi see what I send?
They can’t open it. Over Wi-Fi the content travels encrypted, and only the device you approved has the key. The file’s name, size and other details are not encrypted: see “What we don’t protect”.
Can someone send things to my computer?
Only a device you approved. The first time, both screens show the same security code and you click “Allow”. A device that wasn’t approved can’t write anything. If a device with a known name shows up with a different key, the app warns you, because it may be someone trying to pass as yours.
Do I need an account or to give my email?
No. ZiggSend doesn’t ask you to sign up. An email only exists for people who buy Pro or Business, to receive the key and the receipt.
What if the file arrives damaged?
It doesn’t go in. Every file is checked on arrival; if it differs from the original, it is discarded and the app tells you. You can check it yourself: see “Check it yourself”.
What leaves the app (and what never does)
- Never leaves: your files and their names.
- Leaves, as described in the privacy policy: the update check; on the computer, a random install ID each time the app opens; on Pro and Business, the license check (at most once a day, when there is internet); and, on the phone, anonymous diagnostics, only if you say yes.
What we don’t protect (and why)
- The file’s name, size, fingerprint and source, and the device’s name are visible to someone watching the same network. The content isn’t.
- The cable (Android → Mac) doesn’t go through the encryption: the file goes straight down the wire, with no network in the path.
- Anyone holding your unlocked phone can send whatever they want, as with any app.
- Malware on your computer can read what is on it, including what ZiggSend received. Keep your system up to date.
- Hotel, café or office Wi-Fi keeps the content encrypted, but some of these networks block connections between devices. If so, use your phone’s hotspot.
Check it yourself
- The security code: must match on both screens before you click “Allow”.
- The file’s fingerprint: on the phone that sent it, History shows the start of each file’s SHA-256 fingerprint. On the computer, run
shasum -a 256 file(Mac) orcertutil -hashfile file SHA256(Windows): the start must match. How we measure. - The apps: the Mac app is notarized by Apple; the Windows app comes from the Microsoft Store, signed by Microsoft; the phone apps come from the App Store and Google Play.
Under the hood (for technical readers)
What the app uses, piece by piece.
| For | How |
|---|---|
| Each device’s identity | X25519, kept in the system vault (Keychain on Mac and iPhone, Keystore on Android, DPAPI on Windows) |
| Approving a pair | by QR, proof of the 6-digit code with HMAC-SHA256 (the code never travels); from the list, the same security code on both screens and a click on “Allow” on the device receiving the request |
| Encrypting content over Wi-Fi | a key derived per transfer (X25519 → HKDF-SHA256) and AES-256-GCM in 1 MiB blocks; name, size and fingerprint are authenticated data in every block |
| Tampering and replay | an altered block invalidates the transfer; the receiver rejects a replayed send |
| Integrity | SHA-256 of the file already written to disk, compared with the original’s |
| Who can write | only an approved device, checked before anything touches the disk |
| Libraries | CryptoKit (Apple) and package:cryptography (Dart); no hand-rolled primitives |
Found a flaw?
Write to send@ziggsend.com with the subject “Security”. We reply and fix it before disclosing.
What this page is not
A certification. ZiggSend has no external audit and no compliance seal. We describe how the app works; how that fits the rules of your work is your call.