Privacy Policy

This policy explains what Just Send Files stores, why, where, and for how long. The short version: we store your files only as long as the link or Room lives, we use no analytics or advertising services, and we do not sell or share your data.

What we store

• Your files, exactly as uploaded, until the transfer or Room expires or is deleted. In Rooms, photo metadata (location, camera, date) is removed in your browser before upload; the image itself is untouched.
• Transfer and Room metadata: file names, sizes, content types, SHA-256 checksums, the title and description you typed, the mode, the expiry date, and a hash of the PIN if you set one. PINs are never stored in clear text.
• Account data, only if you sign in with Google to create Rooms: your Google account id and email address, so we can list what you created.
• Operational logs: IP addresses, timestamps and request details, kept for up to 30 days for security, rate limiting and abuse handling.
• Abuse reports, including the optional email address you give us, kept while the report is being handled.
• Anonymous counters: how many transfers and Rooms are created per day. No personal data is attached to them.

What we do not do

• We do not open, scan, index, compress or analyse the content of your files, except automated integrity checks (checksums) and manual review when a transfer or Room is reported.
• We do not use analytics services, advertising networks, tracking pixels or third-party cookies. The only cookies we set are a short-lived, transfer-specific cookie after you enter a correct PIN and the technical cookie needed to keep you signed in.
• We do not require an account to send or receive files.

Providers and data processing agreements

We run on two providers, each bound by a data processing agreement that meets GDPR requirements:

• Cloudflare R2 (Cloudflare, Inc.) stores the files themselves, in the European Union. Cloudflare acts as our processor under the Cloudflare Customer DPA.
• Google Firebase / Google Cloud (Google LLC) runs the website, stores metadata (Firestore, region europe-west1) and handles Google sign-in. Google acts as our processor under the Google Cloud Data Processing Addendum.

No other third party receives your data.

Encryption and protection

Files travel over HTTPS and are stored encrypted at rest by the storage provider. Download links are signed and expire within minutes; upload links expire within an hour. Links and admin tokens are generated with a cryptographic random generator and cannot be guessed. This is not end-to-end encryption: the operator can technically access stored files, for example to act on an abuse report.

Automatic deletion

Every transfer and Room has an expiry date chosen when it is created (24 hours to 7 days for transfers, up to 90 days for Rooms). When it passes, a scheduled job deletes the files and their metadata. As a safety net, the storage bucket itself removes any object that has not been touched for 9 days after the last extension, and unfinished uploads are discarded after 2 days.

Deleting content quickly

Senders can delete a transfer from its success screen or from their account. Room owners can delete a Room and all its files from the Room menu, from Settings, or from Your Rooms. Deletion is immediate and irreversible. Anyone can report a transfer or Room through the report form, and we remove reported content that breaks our rules.

Retention

Files and their metadata are deleted together, when the link expires, when the creator deletes them, or when we remove them for policy reasons. Only the anonymous daily counters remain.

Your rights

Depending on where you live you may have rights to access, correct or delete personal data. The practical way to delete your content is the delete action on your transfer or Room. To delete your account data or for anything else, contact us through the report form.

Children

The Service is not directed at children under 16.

Changes

We will update this page if our practices change.