Privacy

Last updated 17 October 2026

The short version

We can’t access your files. They are encrypted in your browser before upload, and decryption keys never reach our servers during normal use — they live in the part of a share link after the #, which browsers do not transmit.

There is one documented exception, and it only happens when somebody chooses it: reporting a file for abuse deliberately sends that file’s key to our moderation team, because a report about a file nobody can open cannot be acted on. The report form says so in plain words before it is sent, and the key is deleted automatically 90 days after the case is resolved.

What we cannot read

• Your file contents. We hold ciphertext. The key is not ours.
• Your account’s encryption vault. We store it only in encrypted form, wrapped by a key derived from your password in your browser. We never receive that password, only an Argon2id hash used to check a login — which cannot unwrap anything.
• Your recovery key. Generated in your browser and shown once. We never receive it, so we cannot send it to you again.

What we do store

Account

Your email address, a password hash, your plan, and timestamps for verification and changes.

File metadata — not encrypted

Filename, file type, size, upload time, download counts and expiry. Worth being explicit about: filenames are not encrypted, because renaming has to work and the share page shows the name before any key is applied. Do not put sensitive information in a filename.

Share links

The public 6-character link id, its expiry and download limit, and ciphertext of the file key wrapped under the link’s own secret. We also store a one-way verifier derived from that secret, which lets us check that a visitor holds a valid link without us being able to derive the key.

Sessions

A hash of your session cookie, a coarse device label (for example “Chrome on macOS”), and a salted hash of your IP address.

IP addresses

Stored only as a salted, irreversible hash, used for rate limiting and for showing you your own sessions. The address itself is not written to our database.

Abuse reports

The category, any description the reporter wrote, which link was reported, a salted hash of the reporter’s IP, and — because the reporter chose to send it — the file’s decryption key, for the retention period described in Reporting abuse.

Operational logs

Request method, path, status and timing. Deliberately never: a URL fragment, a share link secret, a password, a session token, a file key or a raw IP address. Our logger carries a deny-list for exactly these.

How long files are kept

• Guest uploads (no account) are deleted at the time the uploader chose, between one and seven days. Downloads do not extend it.
• Free accounts keep a file for 30 days, extended by 30 days each time it is successfully downloaded.
• Deleting a file closes access immediately and queues the stored data for removal. Once removed it cannot be restored, by you or by us.

Cookies and third parties

We set two cookies, both strictly necessary: a session cookie and a CSRF token. There are no analytics cookies, no advertising cookies and no tracking pixels anywhere on the site.

Two third parties are involved, and only in narrow places:

• Cloudflare Turnstile runs on the homepage’s guest upload form, to stop automated abuse of anonymous uploads. It is the only third-party script the site loads, and it loads on no other page.
• Resend delivers account email — verification, password reset, email change. They process your email address to send it.

Files are stored with Cloudflare R2 as encrypted objects. They hold ciphertext and no keys.

Your data

You can delete your account from Settings, which removes your files. Formal data-subject request handling — access, export, correction, erasure, and the contact route for making one — is part of the legal review this page is waiting on. Until that is published, account deletion in Settings is the mechanism that exists.