Privacy Policy

What data we process

Account data: your name, your email address, (if you registered with email) a hash of your password, and, if you enabled it, your two-step verification information.

Your files: the content, name, folder structure, size, content hash (SHA-256), versions and sharing settings of the files you upload. We do not use the content of your files for advertising or model training.

Device and API data: the device name, operating system and last-seen time of the desktop apps you connect; the name and monthly request count of your API keys. Keys and session refresh codes are stored only as irreversible hashes.

Activity data: a record of actions on your files (upload, move, delete, share) and whether the action came from the web, the desktop app or the API.

Payment data: subscription and invoice records. Your card details never reach us; Stripe processes the payment.

Technical data: your IP address. It is processed to prevent abuse and to enforce request limits; no profile is built from your IP address.

Why we process it

To provide the service (storing, syncing and sharing your files, managing your subscription), to ensure security, and to fulfil our legal obligations. Legal basis: performance of the contract and legitimate interest.

Who we share it with

Your files are stored with an S3-compatible object storage and content delivery provider (DigitalOcean Spaces); files you make public are served over this network.

Payments are handled by Stripe, and email delivery by the configured mail provider. Apart from these, we do not sell your data to third parties or share it for advertising purposes.

How long we keep it

Your files are kept until you delete them or close your account. Items in the trash and old versions are permanently deleted at the end of the retention period of your plan.

When you delete your account, your files, versions, share links, devices, API keys and your customer record at Stripe are deleted together.

Incident and activity logs are deleted after 180 days, and payment provider and email logs after 90 days. Payment records are kept in non-personalized form because of accounting obligations.

Your rights

You have the right to access, correct, delete and object to your data. You can send your request to ltd.bilgisam@gmail.com.

You can download a copy of your account data from the account page, download your files at any time, and delete your account yourself there; this directly fulfils access and deletion requests.