Privacy policy

We store account email addresses, transfer filenames and sizes, uploaded content, recipient addresses and messages, and requests to start downloads. Activity through a recipient link is attributed to that link, which can be forwarded; it does not prove who downloaded or that a download completed. Anonymous monthly upload allowances are shared by IP address. Billing is currently simulated, with no payment provider collecting card details.

File contents are permanently deleted at expiry. Transfer metadata, recipient details and download history are retained for 90 days after expiry, then purged. Quota totals and billing records are stored separately without filenames or recipient details; deleting files does not reset the monthly upload allowance.

[Draft for legal review.] We use Stripe (Stripe Payments Europe, Ltd., Ireland) to take payments, run subscriptions, work out VAT and send invoices. You type your card details only on Stripe's pages; we never see or store your whole card number. We share your name, email, billing address, country, VAT number (if you give one) and plan with Stripe, and get back your payment history, the card type and its last four digits. We do this to keep our agreement with you (GDPR article 6(1)(b)), and keep accounting records for seven years after the end of the financial year, as the Swedish Bookkeeping Act (Bokföringslagen) requires (article 6(1)(c)). Stripe also uses some of this data itself, as an independent controller, to prevent fraud and meet its own legal duties, and may transfer it to the US under the EU-US Data Privacy Framework or Standard Contractual Clauses. Read more in Stripe's privacy policy. [How long other billing data is kept.]

[Name each cookie and tool, such as Google Analytics, what it does, and how to change your choice. Also the cookies Stripe sets on its own checkout page.]

[How people can see, correct, export or delete their data, and how to complain to the Swedish Authority for Privacy Protection (IMY).]