Privacy Policy

1. What we collect

• Account data — username, email, password hash, timezone, optional 2FA secrets, profile bio, website link, avatar, branding settings
• Service content — folder inventories (names/sizes/metadata), share links, posts, comments, likes, bookmarks, lists, DMs, notifications
• Technical data — IP address, user agent, session tokens, login audit events, approximate activity timestamps
• Optional integrations — webhook URLs, Discord/Telegram notify settings, API keys you create

We do not upload or store the binary contents of your files when you browse a local folder for inventory; only the metadata you publish is stored.

2. How we use data

• Operate accounts, authentication, and security (including abuse prevention and rate limiting)
• Provide folder lists, share links, social features, and admin moderation tools
• Send transactional email (activation, password reset, optional notification emails) when mail is configured
• Improve reliability and investigate abuse reports

3. Sharing

We do not sell your personal data. Content you mark public (or share via link) is visible to others as designed. Site administrators may access account and content data to operate and moderate the Service. Processors such as your hosting provider or SMTP provider may process data solely to deliver the Service.

4. Cookies, sessions, and analytics

We use session cookies (and related session storage) to keep you logged in and protect forms with CSRF tokens. If Cloudflare Turnstile is enabled, Cloudflare may process a challenge token for bot protection on login/register.

If the site operator enables Google Analytics 4 (GA4), Google may receive page-view and related usage data on public pages (not the admin console). GA4 measurement is controlled in Admin → Site settings and can be disabled at any time. We do not use advertising remarketing pixels by default.

5. Retention

We keep account and content data while your account is active. Soft-deleted items may remain until purged. Login audits, rate-limit records, and mail logs may be retained for security and operations. You may request account deletion by contacting the site operator; some records may be retained where required for abuse prevention or legal obligations.

6. Your choices

• Edit profile, privacy (public/private), notification preferences, and branding in the panel
• Export your data from the panel export tool where available
• Delete posts, comments, lists, and folders you control (subject to soft-delete rules)
• Block or mute other users; report abuse via the report forms

7. Security

We use industry-common practices such as password hashing, CSRF protection, session controls, and optional 2FA. No method of transmission or storage is perfectly secure.

8. Children

The Service is not directed to children under 13 (or the minimum age in your jurisdiction). Do not register if you are under that age.

9. International users

The Service may be hosted in a single region. By using it, you understand your data may be processed where the server is located.

10. Changes & contact

We may update this policy; the “Last updated” date will change when we do. For privacy questions, contact the site operator through the channels published on the Service.