Privacy Policy.

• File contents. Encrypted on your device before upload.
• File and folder names. Sealed on your device with a key derived from your passphrase. A few older files may still have a readable name on our server until they are re-sealed.
• Your vault passphrase. It is never sent to us.

• The web app is code that our servers send to your browser. If we, or someone who broke into our hosting, shipped a malicious update, it could capture your passphrase. The desktop and Android apps bundle their code, which narrows that risk but does not remove it.
• We can see metadata: sizes, chunk counts, timestamps, folder structure, who you share with, and when you are active.
• Your wrapped encryption keys are stored on our server. Someone who obtained them could try to guess a weak passphrase offline. Use a long, unique one.
• Some features are deliberately not end-to-end private. The dead-man switch stores its contact email and message in plain text and our server emails them (see below). Text you put in a bug report or review is readable by us.

Account

• Email address, username and a bcrypt hash of your password (never the password itself).
• An optional display name and profile picture, stored as an inline image.
• If you turn on two-factor sign-in: the authenticator secret and hashed backup codes. If you sign in with Google or GitHub: the provider's account ID.
• Sessions: for each signed-in device, a hashed refresh token, a shortened IP address (the last part removed: /24 for IPv4, /48 for IPv6) and the browser's user agent. You can see these and sign devices out in Settings.

Files and sharing

• Per file: encrypted size, chunk count, timestamps, which folder it is in, the sealed name and the wrapped key that unlocks it. Per chunk: where the encrypted piece is stored.
• Spaces: who is a member and their role. Share links: view counts, expiry and an optional bcrypt-hashed password.
• Connections to storage platforms (see the next section).

Security and abuse log

• An audit log of account events (sign-ins, failed attempts, password and 2FA changes, exports, deletion requests) with the shortened IP and user agent. It is linked to your account; it does not store your email address.
• The audit log is kept for up to 365 days, and it is kept even after you delete your account (it holds your user ID, not a name).

Things you choose to send us

• Bug reports: your text, an optional screenshot, the app version, platform, the page you were on and your user agent.
• Reviews and feedback: your text, rating and display name. A review is only shown publicly if you allow it and it is approved.
• Dead-man switch, if you set one up: a contact's email and name, your message and a timeout. These are stored unencrypted and emailed to your contact by our server if you stop checking in.

Not collected

• We do not run advertising or marketing trackers. We do not use Google Analytics, Sentry, PostHog or similar tools. The website uses Vercel Web Analytics for aggregate page-view statistics.

• Your own accounts. If you connect GitHub, GitLab, Hugging Face or Telegram, your chunks are stored there, under your account. You can reach them with those platforms' own tools, and their policies apply to what they hold.
• Shared zcrypt storage. If you have not connected your own, your chunks go into storage accounts operated by zcrypt, with a 1 GiB limit per user. Anonymous Send, Pad and Transfer also use zcrypt-operated storage.

• Neon: our PostgreSQL database (AWS, us-east-1). Holds everything in the sections above, but no file contents.
• Vercel: hosts the website and web app, and provides Web Analytics.
• Our backend server, reached through Cloudflare. Cloudflare sees traffic to our API and tells us your country, which we use only to suggest a language and do not store. The server host may change over time.
• Resend: sends our emails: verification, magic sign-in links, password resets, new-device notices, account deletion notices and dead-man switch messages. They see the recipient address and message.
• Google and GitHub, only if you choose to sign in with them.
• GitHub, GitLab, Hugging Face and Telegram, as storage platforms (above).

• Send. The file is encrypted in your browser and the key stays in the link you share. The encrypted file is stored on zcrypt-operated storage for up to 24 hours, then deleted, or deleted after it is downloaded if you chose burn after read. The limit is 50 MB per file. Anonymous senders are limited to 500 MB per rolling 24 hours, counted by shortened IP address, which we store to count it. The file name is stored by us as sent (sealed if your browser sealed it).
• Pad. Encrypted text notes with an expiry or burn after read. The server stores ciphertext and the shortened IP of the creator.
• Transfer. A device-to-device relay. The key is not sent to the relay.

• Sign-in cookie. An httpOnly cookie carries your refresh token so you stay signed in. The web app does not keep your access token in localStorage.
• Preferences in localStorage: language, theme, view settings, a random device ID, and flags such as dismissed notices and what's-new seen. A minimal cached user record (ID, role, username) helps the app load.
• Your passphrase. By default it is kept in memory only and forgotten after 15 minutes or when you lock the vault. If you tick "keep me unlocked on this device" (off by default), it is stored on this device, encrypted with a key kept in the same browser profile, so anyone with access to that profile can unlock your vault. The desktop app uses the operating system keychain instead.
• The app may also cache file lists and thumbnails in your browser to load faster.

• Account data is kept while your account exists.
• Deleting your account (Settings) signs out all devices and starts a 7-day grace period; you can cancel it during that time. After that your account data is erased and your stored chunks are queued for deletion from the storage platforms, which can take time and can fail if a platform is unreachable or the token no longer works.
• Audit log entries are kept up to 365 days, including after deletion. Backups of our database may hold older copies, and we have not set a fixed period for them. Bug reports you sent stay, without a link to your account.
• Expired Send transfers and download tickets are cleaned up automatically (Send by 24 hours, with usage counters kept 48 hours).
• Deleting a file moves it to trash; purging it queues its chunks for removal from the platform.

• Export your account data as a JSON file from Settings (file contents download separately, as ever).
• Delete your account from Settings.
• Sign out any device from Settings.
• Correct your profile details in Settings.
• Ask us by email about anything else: access, correction, restriction, objection, or a complaint. If you are in the EU or UK you can also complain to your data protection authority.