This Privacy Policy describes how we collect, use, and protect your personal information when you use our secure file sharing service. Our commitment to privacy is built into our architecture: we use end-to-end encryption to ensure that we cannot access your files or their contents.

1. Information We Collect

1.1 Account Information

When you create an account, we collect:

Email address
Password (hashed using industry-standard bcrypt)
Optional profile information (name, profile image)
Subscription and billing information (processed by our payment provider)

1.2 Usage Information

We collect information about how you interact with our Service:

Link creation and management activity
File metadata (encrypted filenames, file sizes, MIME types)
Download and view counts
IP addresses (hashed for privacy)
Browser type and version
Access times and dates

1.3 What We Do NOT Collect

Due to our zero-knowledge architecture, we explicitly do not collect or have access to:

Your file contents (files are encrypted before upload)
Encryption keys (stored only in your browser and link URLs)
Unencrypted filenames (all filenames are encrypted client-side)
Passwords for protected links (stored as secure hashes only)

2. How We Use Your Information

We use the information we collect to:

Provide, maintain, and improve our Service
Authenticate users and secure accounts
Process payments and manage subscriptions
Send service-related notifications (link expirations, security alerts)
Monitor and analyze usage patterns to improve user experience
Detect, prevent, and address technical issues and security threats
Comply with legal obligations

3. Data Storage and Security

3.1 Encryption

All files are encrypted using AES-256-GCM encryption in your browser before being uploaded to our servers. The encryption keys are generated locally and never transmitted to our servers. This means:

We cannot decrypt or access your file contents
We cannot recover your files if you lose the sharing link
Only recipients with the complete link (including the fragment) can decrypt files

3.2 Data Retention

We retain your data for as long as necessary to provide the Service:

Active links: Files are retained until the link expires or is deleted
Expired links: Files and associated metadata are automatically deleted
Account information: Retained until you delete your account
Activity logs: Retained for 90 days, then automatically purged

3.3 Data Location

Encrypted files are stored in Cloudflare R2 object storage. Account data and metadata are stored in secure databases provided by Neon, LLC, an affiliate of Databricks, Inc. All data is processed and stored in accordance with applicable data protection laws.

4. Information Sharing and Disclosure

We do not sell, trade, or rent your personal information to third parties. We may share information only in the following circumstances:

Service Providers: We work with trusted third-party providers (payment processors, hosting services) who assist us in operating our Service. These providers have access to your information only to perform specific tasks on our behalf and are obligated not to disclose or use it for any other purpose.
Legal Requirements: We may disclose your information if required to do so by law or in response to valid requests by public authorities (e.g., a court or government agency).
Protection of Rights: We may disclose information to protect the security or integrity of our Service, to protect our rights or property, or to protect the safety of our users or the public.

Important: Due to our end-to-end encryption, even if we are legally compelled to provide information about your account, we cannot provide the contents of your files or the encryption keys needed to decrypt them.

5. Cookies and Tracking

We use cookies and similar tracking technologies to:

Maintain your session and authentication state
Remember your preferences
Analyze site traffic and usage patterns

You can instruct your browser to refuse all cookies or to indicate when a cookie is being sent. However, if you do not accept cookies, you may not be able to use some portions of our Service.

6. Your Data Rights

Depending on your location, you may have the following rights regarding your personal data:

Access: Request a copy of the personal data we hold about you
Correction: Request that we correct inaccurate or incomplete data
Deletion: Request deletion of your personal data and account
Portability: Request transfer of your data to another service
Restriction: Request limitation of processing of your data
Objection: Object to processing of your personal data

To exercise these rights, please contact us at privacy@usesecuresend.com. We will respond to your request within 30 days.

7. Children's Privacy

Our Service is not intended for use by children under the age of 16. We do not knowingly collect personally identifiable information from children under 16. If you are a parent or guardian and you are aware that your child has provided us with personal information, please contact us so we can take steps to remove that information.

8. International Data Transfers

Your information may be transferred to and processed in countries other than the country in which you reside. These countries may have data protection laws that are different from the laws of your country. We take appropriate safeguards to ensure that your personal information remains protected in accordance with this Privacy Policy.

9. Security

The security of your data is important to us. We implement appropriate technical and organizational measures to protect your personal information, including:

End-to-end encryption for all files
TLS/SSL encryption for all data in transit
Secure password hashing
Regular security audits and penetration testing
Limited access to production systems

However, no method of transmission over the Internet or method of electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your personal information, we cannot guarantee its absolute security.

10. Changes to This Privacy Policy

We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date. You are advised to review this Privacy Policy periodically for any changes. Changes to this Privacy Policy are effective when they are posted on this page.

11. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us at:

Email: privacy@usesecuresend.com