Private file delivery

Send the file. Keep the key private.

ZipPigeon seals sensitive files in your browser before they leave your device. Send them to one person and choose when access ends. No broad shared folders. No files left in email threads.

Send a private file See how it works

Encrypted before upload Recipients don’t need an account Access expires on your schedule

Dispatch manifest ZP-7F2K-0N1H

From Amara Osei counsel@osei-law.com

To One verified recipient account-bound · key fingerprint pinned

Contents

settlement-agreement-v4.pdf2.1 MB exhibit-index.xlsx340 KB signature-pages.zip5.8 MB

Access Expires in 72 hours 1 download · revocable until opened

key a4:9f:1c:7e:b2:6d · raw key not sent to the server Sealed

Sealed in the sender’s browser · server stores ciphertext only

Encrypted before uploadYour browser seals each file with XChaCha20-Poly1305 before upload. ZipPigeon stores locked data, not plain file contents. It handles delivery, status, expiry, and audit events.

Hybrid post-quantum recipient protectionV3 can protect account and service recipients with X-Wing draft-10 HPKE. It combines X25519 with ML-KEM-768 to protect the file key. V3 records also use Ed25519 + ML-DSA-65 dual signatures. Availability follows deployment controls and recipient migration. Older transfers stay readable.

Delivered to a personInvite an account you know or give a guest a secure link. You choose who gets in. There is no folder access to manage.

Over when it is overSet an end date for each transfer. Links can end after one use. You can also close future access early.

How it works

Three steps. One controlled handoff.

STEP 1

Seal in your browser

Drop in your files. Your device seals them before upload. The raw file key is not uploaded with them.

encrypting locally… XChaCha20-Poly1305

STEP 2

Send to the right person

Invite an account you know. You can also give a guest a secure, one-time link. You decide who gets access.

share granted → 1 recipient

STEP 3

Let it expire

Choose the access window when you send. Let it close on time, or end future access early.

expired · future access closed

The honest security model

What we can’t read — and what we still see.

Many tools say “secure” and stop there. We show you the exact boundary.

Out of our reach

Account-bound file contentsYour browser seals them for the authorized recipient. We store locked chunks.
Account-bound file keysYour device wraps each key for the recipient. The server stores the encrypted envelope.
Your account private keysYour password protects them with Argon2id. We hold the lockbox, not the key.
Manually delivered link secretsThe unlock part lives after the # and stays out of ordinary navigation requests. Copy and deliver the link yourself to keep that boundary.

Still visible to us

Delivery metadataWe see who sent to whom, when, file sizes, and transfer status. Delivery needs this data.
Account & audit recordsEmails, sign-ins, download events, and abuse-prevention signals.
Public workflow labelsAccount and session labels remain visible. Filenames, private transfer titles, and notes are encrypted in the manifest.
Automatic guest-email linksSending a guest invitation by email relays the complete link, including its unlock secret, through our backend and email provider.
Completed downloadsExpiry stops future access. It cannot recall a file someone already saved.

We do not use vague “military-grade” claims or badges we have not earned. Read the full security model. It also shows what is still on the roadmap.

Who it’s for

Built for the professionals who can’t just email it.

LegalMatter files & contractsSettlements, discovery, signature pages — to counsel and clients. HROffers & employee docsOffer letters, IDs, and tax forms that should not live in inboxes. FinanceStatements & returnsTax packets, payroll exports, and client books — one recipient at a time. SecurityEvidence & reportsLogs, incident artifacts, and vuln reports kept out of chat threads.

A handoff tool — not another shared drive.

WeTransfer moves big files. Dropbox syncs teams. ZipPigeon has one narrow job. It sends a private package to one person, then ends access. See where each tool fits.

ZipPigeon vs WeTransfer ZipPigeon vs Dropbox Transfer ZipPigeon vs Google Drive

Coming soon · Nearby sharing

The person is beside you. The file should be easy to hand over.

A client meeting, a site visit, a creative review: sometimes you need to share a file with the person in front of you. Nearby will let signed-in people find participating devices, remember a connection, and approve each incoming handoff.

Coming to compatible ZipPigeon iOS apps. Internet access is required; browser Nearby will return after the app is available in stores.

Explore Nearby · coming soon A practical guide to in-person file handoffs Remember the device. Approve each file.

Frequently asked questions

What is private file delivery?

It is a way to send sensitive files to the right person for a set time. It avoids long-lived copies in email and shared folders.

Is ZipPigeon end-to-end encrypted?

ZipPigeon encrypts file chunks in the browser with XChaCha20-Poly1305 before upload. V3 can also protect account recipients with X-Wing. It combines X25519 with ML-KEM-768. Older transfers stay readable during the move to V3. See the security page for the full limits.

Can ZipPigeon read my files?

During normal delivery, ZipPigeon should not receive plain files or raw file keys. It still needs details such as accounts, recipients, dates, and transfer status.

How is ZipPigeon different from cloud storage?

Cloud storage is for ongoing collaboration. ZipPigeon is for sending a sensitive package to a specific person and closing access when the job is done.

How is ZipPigeon different from email attachments?

Email files can spread through inboxes, backups, and forwards. ZipPigeon adds encryption, an end date, and clear access for each recipient.

Who is ZipPigeon for?

ZipPigeon is for teams that send sensitive files outside their usual workspace. It fits legal, finance, HR, agency, startup, security, and freelance work.

The next sensitive file deserves better than “see attached.”

Seal it. Send it. Let it expire. It is free while we can sustain it.

Send a private file