Privacy policy

What we store about account holders

• Email address, and whether it has been verified. If you sign in with Google, also your Google account ID. We use these to sign you in and to send service email such as sign-in links, receipts and takedown notices.
• Sign-in sessions. A cookie on our website identifies your session. On our side we store only a hash of it, with its expiry, so a session can be revoked.
• Your uploads. The files you publish and every version of each site, plus the scan results for each upload.
• Usage records. When uploads happened, so we can apply daily limits.
• Billing. Your plan and the customer and subscription IDs our payment provider gives us. Card details go straight to the payment provider; we never see or store them.
• Audit log. A record of security-relevant actions on your account and sites, such as publishing, holds, takedowns and restores.

What we store about visitors to hosted sites

• View counts. We count how many times a site's main page is opened, per day. The count is a number; it isn't linked to who visited.
• Abuse reports. If you report a site, we store the reason and details you give, and a one-way hash of your IP address. The hash lets us tell whether reports come from different people without keeping the address itself. If you add your email, we use it only to follow up on the report.
• Request logs. Our hosting and network providers keep standard request logs (IP address, time, URL, browser) for security and troubleshooting.

We don't set cookies on hosted sites, except one that remembers you entered the right password on a password-protected site. Site owners may add their own scripts and cookies to their pages; that is between them and their visitors.

Why we use it

To provide the service you signed up for, to bill paid plans, to meet legal obligations, and because we have a legitimate interest in keeping the service and its visitors safe from fraud, phishing and malware.

Who processes it for us

We use a small number of providers, each only for its part of the service:

• Google Cloud: hosting, databases, file storage, and Safe Browsing checks on links in uploaded pages.
• Cloudflare: network delivery, TLS certificates, custom domains and the human check on sign-in and upload.
• Stripe: payments and invoices for paid plans.
• Our email provider: delivering sign-in links and service email.
• Google: only if you choose “Continue with Google” to sign in.

Some of these providers process data outside your country, including in the United States, under standard contractual safeguards.

How long we keep it

• Account data: while your account is open, and deleted within 30 days of closing it.
• Deleted sites: the link stops working immediately; files are removed from storage within 30 days. The site's name stays reserved so nobody else can take over your old link.
• Sign-in sessions: 30 days, or until you sign out.
• Abuse reports, hashed reporter IPs and the audit log: up to 2 years, because we need them to deal with repeat abuse.
• Request logs: around 30 days.
• Billing records: as long as tax law requires.

Your rights

You can see, correct, export or delete your data. Most of it is in your dashboard; for anything else, email us. You can also object to how we use your data or complain to your local data protection authority.

Contact

Privacy questions and requests: [email protected].