The direction
ZipPigeon should stay focused on private handoffs: one package, a clear recipient path, and honest limits. The roadmap extends that idea in two directions. Enterprise teams should be able to bring ZipPigeon into their own operating model. Occasional senders can use the constrained anonymous flow for a short-lived handoff without creating an account.
Enterprise private delivery
The enterprise direction is for organizations that need more control over the experience and the infrastructure behind it. Planned capabilities include custom logo and theme support, branded recipient pages, administrative policy controls, stronger organization onboarding, exportable audit evidence, and clearer controls for retention, expiration, and allowed recipient patterns.
Bring your own storage and database
Some organizations will want ZipPigeon to run against their own cloud storage bucket and database rather than a shared service-managed environment. The planned model is bring-your-own encrypted object storage, bring-your-own PostgreSQL-compatible database, deployment-specific configuration, and documented rotation and backup practices. File contents should remain browser-encrypted before storage either way.
Anonymous sharing without accounts
The anonymous flow lets a person send an encrypted file to another person without signing in. It does not place the file in a sender dashboard, keep a durable send history, or provide account-level audits. The sender receives a one-time link to share. Losing that link means losing the practical ability to manage the handoff.
- Anonymous one-time sends: 50 MB total, 5 files, 80 encrypted parts, one download, and a 24-hour maximum expiry by default.
- Anonymous default expiry: 6 hours unless the sender chooses a shorter or longer allowed window.
- Anonymous file policy: high-risk executable, script, installer, and active-content extensions are blocked before upload.
Short lives by default
Anonymous sharing is intentionally narrow: smaller file limits, shorter expiration windows, one-time download access, and aggressive cleanup of incomplete uploads. The right default is measured in hours, not weeks. Signed-in workflows remain the better choice when audit history, recipient identity, revocation management, or repeat business relationships matter.
Browser encryption still comes first
Anonymous sharing uses the same principle as the rest of ZipPigeon: protect the file in the browser before upload and keep the raw file key out of normal server requests. The one-time link carries the information needed by the recipient, while the server stores encrypted file data and enforces expiration and download limits.
File safety without breaking privacy
File validation has to be designed carefully because server-side malware scanning conflicts with a strict unreadable-file model. The roadmap should start with browser-side file checks before encryption, extension and MIME mismatch warnings, archive-bomb and script-risk heuristics where practical, blocked dangerous file categories for anonymous sends, and clear user warnings. Deeper scanning would need an explicit privacy tradeoff, not a hidden exception.
Humans before bandwidth
Anonymous sharing should be protected before upload capacity is spent. Human verification, rate limits, upload quotas, abuse reporting, and suspicious-download challenges should work together so anonymous sharing is usable by people and expensive for automated abuse.
What anonymous sharing will not do
Anonymous sharing should not be described as an enterprise audit trail, a shared workspace, a recoverable inbox, or verified recipient delivery. It is a narrow convenience path for a short-lived encrypted handoff. People who need identity, records, receipts, team controls, or long-term accountability should use account-bound sharing instead.