Privacy Policy
This is a plain-language description of what this Send Shed instance actually does with your data, written by the person who built it — not a lawyer. It isn't a substitute for legal advice, and the operator running this instance should have it reviewed before relying on it for compliance purposes (GDPR, CCPA, or otherwise).
What we collect
Quick Share (no account): the file itself, its size, and — only if you type one in — an email address to notify when it's downloaded. Your IP address is hashed (HMAC-SHA256, one-way) before it's stored, purely to rate-limit abuse; we don't keep or share the raw address, and the hash can't be reversed back into an IP.
Encrypted Share (account): your email address and a hashed password (or, if you sign in with Google, nothing but the account identifier Google gives us — we never see a Google password). Files are encrypted in your browser before upload, so we store only ciphertext, its size, and its expiry/download settings. We never see the filename, the file's contents, or the decryption key — that key lives only in the share link's URL fragment, which browsers never transmit to any server.
What we don't do
No ad trackers, no analytics scripts, no third-party pixels. Cookies on this site are strictly functional: one keeps you signed in, one unlocks a password-protected file you've already entered the password for, and one remembers your theme choice. None of them are used for advertising or cross-site tracking.
Automated screening
Every Quick Share upload is checked against a known-CSAM hash database before its link goes live, using only the file's hash — the file itself isn't inspected or reviewed by a person unless it's reported. Encrypted Share files can't be screened this way by design (we don't have the key), which is part of why that tier requires an account.
How long we keep it
Quick Share files are deleted automatically once their chosen expiry (up to 7 days) or download limit is reached, whichever comes first. Encrypted Share files follow the same rule with a longer expiry ceiling (up to 30 days), or you can delete any of them immediately from your dashboard. Deleting your account removes your files and account record.
Where files are stored
Files are held by whatever storage backend this instance is configured to use (which may be local disk or a third-party object storage provider) and served either directly by this application or through a content-delivery network in front of it. Either way, the encryption and access-control rules above apply the same way.
Questions or requests
To ask about your data or request deletion, use the contact address in the FAQ's abuse & takedown section.
Last updated: September 2026.