How does android transfer with bump apps work? I've come across several apps which allows the user to transfer data (like files, photos, contacts) when they "bump" their phones.

An example is Bump, which use the the bump to transfer files and add friends. The FAQ stated that this app uses various sensors and algorithms to "feel" the bump and the server will find matching bumps according to the sensor reading and algorithms. The FAQ also says that this app was designed with personal and data security in mind.

How exactly does it work? How does it know that I am toasting/bumping with another person? I mean I don't think GPS can track the phones that accurately. And how does it transfer the contacts and photos? And how can it correctly determine who is toasting with whom if there are multiple users in the same room? How is the security and confidentiality protected?
Q: How does Bump work?
A: There are two parts to Bump: the app running on your device and a smart matching algorithm running on our servers in the cloud. The app on your phone uses the phone's sensors to literally "feel" the bump, and it sends that info up to the cloud. The matching algorithm listens to the bumps from phones around the world and pairs up phones that felt the same bump. Then we just route information between the two phones in each pair.

Q: No way. What if somebody else bumps at the same time?
A: Way. We use various techniques to limit the pool of potential matches, including location information and characteristics of the bump event. If you are bumping in a particularly dense area (ex, at a conference), and we cannot resolve a unique match after a single bump, we'll just ask you to bump again.

http://bu.mp/faq

Your phone has some idea of where you are using cell phone cells or wifi networks, the are several applications that use that. GPS would only work outdoors. So using time of the bump and somewhat accurate location provided by either cell phone cells or wifi networks it can see which two phones are bumping.