Privacy policy

Effective 1 March 2026

Short version: we store the file, the size, the expiry time and a download counter. No advertising identifiers, no behavioural profiles, no third-party analytics.

What we collect

• File name, size and SHA-256 checksum.
• Creation and expiry timestamps, download count.
• IP address of the uploader, kept 24 hours for abuse handling, then truncated to a /24 network prefix.
• For paid accounts: email, billing country and invoice records required by tax law.

What we do not collect

• File contents for any purpose other than storing and serving them.
• Browser fingerprints, cross-site identifiers or advertising cookies.
• Recipient IP addresses beyond aggregated download counters.

Cookies

The public pages set no cookies. The account area sets one session cookie, marked HttpOnly, Secure and SameSite=Lax. There is no consent banner because there is nothing to consent to.

Retention

Transfers are destroyed at the expiry time you see on the download page. Backups are rotated every 24 hours and hold nothing older than 72 hours.

Sub-processors

Object storage and bandwidth: two European providers in Frankfurt and Amsterdam. Payments: a licensed European payment institution. Transactional email: one EU-based provider. All are bound by data processing agreements.

Your rights

Write to the address in security.txt to request access, correction or deletion of account data. Transfers can be deleted from the account page at any time.