Privacy Policy
This is a plain-language description of what this Send Shed instance actually does with your data, written by the person who built it — not a lawyer. It isn't a substitute for legal advice, and the operator running this instance should have it reviewed before relying on it for compliance purposes (GDPR, CCPA, or otherwise).
What we collect
Quick Share (no account): the file itself, its name and its size. We also record the IP address the file was uploaded from, so we can deal with abuse (blocking repeat offenders) and respond to valid legal requests. Only the site operator can see it, we don't share or sell it, and it's deleted 30 days after the last file uploaded from that address is gone, unless that address has been banned for abuse. For rate-limiting, other visits are tracked only by a one-way hash (HMAC-SHA256) of the IP, never the address itself.
Abuse reports: when you report a file, we need your email address so we can follow up, and the report sent to the site operator includes the IP address you sent it from, to help spot fake or bulk reports. The stored report keeps your email and only a one-way hash of the IP.
Encrypted Share (account): your email address and a hashed password (or, if you sign in with Google, nothing but the account identifier Google gives us — we never see a Google password). Files are encrypted in your browser before upload, so we store only ciphertext, its size, and its expiry/download settings. We also record the IP address you signed up from and the addresses you sign in from, so we can spot and block bulk or abusive sign-ups and stolen accounts. We also look up which country and which network (internet provider) those addresses belong to, using a database kept on this server, so no outside service is told your address; the operator may block sign-ups, uploads or access from a country or network that's a source of abuse. Only the site operator can see it, and it's deleted with your account. We keep a record of the emails we send you (the address, subject, time and whether it was delivered, never the message itself) for 90 days, to sort out delivery problems. When you use the video and image downloader, we record the link, your account or IP address, and whether it worked, for 180 days, to deal with abuse. When someone downloads a file you own, we note the time, their browser and device type (for example "Safari on iPhone") and a short code that tells repeat visitors apart, so you can see your file's download history. The file's owner never sees downloaders' IP addresses, and that history is deleted with the file. Separately, so we can deal with abuse, we record the IP address of every download (and the account, if the downloader is signed in); only the site operator can see it, and it's deleted after 30 days. We never see the filename, the file's contents, or the decryption key — that key lives only in the share link's URL fragment, which browsers never transmit to any server.
Files limited to certain people: if you list who can download a file, we store those email addresses with the file and delete them when the file is deleted. We use them only to email each person a one-time code when they ask for one on the download page, and we don't add them to any list.
Visit statistics
We count visits with Cloudflare Web Analytics (no cookies) and Google Analytics, to see which pages people use. Neither runs on Encrypted Share download pages, so the decryption key in those links is only ever read by this site's own code. On Quick Share download, folder and request-link pages, Google Analytics receives only the type of page (for example "a download page"); Cloudflare Web Analytics receives the page address, which for a Quick Share link includes the file's name. Google Analytics sets its own cookies to tell returning visitors apart; you can block both with any content blocker without losing any feature of this site.
What we don't do
No advertising, no ad trackers, no selling or sharing of your data. Apart from the analytics above, cookies on this site are strictly functional: one keeps you signed in, one unlocks a password-protected file you've already entered the password for, and one remembers your theme choice.
Automated screening
Every Quick Share upload is checked against a known-CSAM hash database before its link goes live, using only the file's hash — the file itself isn't inspected or reviewed by a person unless it's reported. Encrypted Share files can't be screened this way by design (we don't have the key), which is part of why that tier requires an account.
How long we keep it
Quick Share files are deleted automatically once nobody has downloaded or viewed them for 45 days, or sooner if the uploader chose a shorter expiry (1 hour to 7 days) or a download limit. Encrypted Share files follow the same rule with a longer expiry ceiling (up to 30 days), or you can delete any of them immediately from your dashboard. Deleting your account removes your files and account record.
Where files are stored
Files are held by whatever storage backend this instance is configured to use (which may be local disk or a third-party object storage provider) and served either directly by this application or through a content-delivery network in front of it. Either way, the encryption and access-control rules above apply the same way.
Questions or requests
To ask about your data or request deletion, use the contact address in the FAQ's abuse & takedown section.
Last updated: October 2026.