Reporting abuse

Last updated 17 October 2026

BlazingFiles is built so that we cannot read the files people share. That is a real constraint rather than a promise: files are encrypted in the browser before upload, and the key needed to decrypt one lives in the part of the share link after the #, which browsers never send to a server. So in normal use we hold ciphertext we cannot open.

That is also the problem with moderating it. A report saying "someone is sharing malware at /f/a7K2xQ" cannot be acted on by anybody who cannot decrypt /f/a7K2xQ. The alternative to being sent the key is not a more private report — it is no moderation at all.

How to report a file

Open the share link you were sent and use Report file at the foot of the page. That is currently the only reporting channel, and it exists on every share page.

You do not need an account and we do not ask who you are. No email address, no name. The only thing recorded about you is a salted, irreversible hash of your IP address, which exists so that one person cannot file thousands of reports; the address itself is never stored.

What reporting sends us

These are the exact words shown on the report form before you submit it:

Reporting this file sends the full share link, including its decryption key, so our moderation team can review this specific file. Normally that key never reaches our servers. It will be used only to review this one file, and it gives us no access to anything else. We keep it with your report while the report is open, and for up to 90 days after it is resolved, so the decision can be reviewed — then we delete it.

You have to tick a box confirming you understand that before the submit button becomes active. Three things are worth spelling out:

The key only opens the file you reported. Each share link has its own key. It is not an account credential, it reveals nothing about any other file, and it cannot be escalated into anything else.
It is the one exception to "keys never reach our servers in normal use". Every other path through this product is built so a key cannot arrive here. This one sends it on purpose, because you chose to.
We do not tell you whether the file existed. Every submitted report gets the same answer, whether the link is real, expired or invented. Answering differently would turn the report form into a way of testing whether a guessed link exists.

What happens to the key you send

While the report is open: Kept, so a moderator can review the file. A report stays reviewable until someone has actually acted on it — nothing expires it for being old.
After the case is resolved: Kept for 90 more days, so the decision can be re-examined if you, the uploader or a reviewer disputes it, and so the case can be reopened with the evidence still intact.
After those 90 days: Deleted automatically. The key is erased from the report and cannot be recovered by us or by anyone else.
What is kept after that: The report itself: what was reported, when, which category, what we decided, who decided it, and the record of every action taken. Only the decryption key has the guaranteed 90-day deletion — the ticket and its history are retained for as long as we need them to run the service and answer questions about past decisions.

Access to a submitted key is restricted to moderator accounts, requires an explicit action rather than being shown on screen, and is recorded: every retrieval writes an entry naming the moderator and the time. If a case is reopened before its 90 days are up, the scheduled deletion is cancelled while the case is active.

What we do about reports

A moderator reviewing a report can:

Dismiss it, if there is no violation.
Disable the reported share link, which stops it working immediately and permanently. This affects only the link that was reported.
Remove the file, which takes it out of service, kills every link to it and queues the stored data for deletion. This cannot be undone.
Escalate it for a second opinion, which keeps the case open.

Several people reporting the same file produces several separate reports, each reviewed and decided on its own. We do not merge them, because four independent accounts of the same file are four pieces of evidence.

What we cannot do

We cannot find other copies of a file. We can act on what was reported. We cannot search encrypted storage for similar content, because we cannot read it.
We cannot open a file without its key. A report that arrives without a usable key cannot be reviewed, which is why the report form requires the full link.
We cannot restore a removed file, for anybody, including its uploader.

Legal requests and other channels

A dedicated abuse and law-enforcement contact address is not published yet. Until it is, the in-product Report file button is the only channel we can act on, and rightsholders and authorities needing a different route should expect this page to be updated with one. We would rather say that plainly than publish an address nobody monitors.