AFAIK, those codes don’t need to be kept private, but I think they only do that verification once, so you can probably just delete the file at this point. (After all, you can also use a TXT record to store the verification code for a domain with Google, and those are definitely not private; anyone can dig
your domain’s TXT records.)
KDE Connect should fit the bill; despite the name, you don’t need to be using KDE (or Linux even) since there are clients for every major OS, even mobile.
Among many other cool features, it lets you easily and simply just send a file from one device directly to another on your local network. I use it all the time to send photos from my phone to my desktop without plugging anything in, for example.