Privacy Policy

1. Information we collect

We collect the following categories of information:

• Account information: your name, email address, and password (stored securely, never in plain text).
• File content and metadata: the files you upload, along with names, sizes, types, and timestamps.
• Session and security information: session identifiers, login timestamps, and device/session activity shown in your account security settings.
• Bot-protection data: sign-up and sign-in forms are protected using Cloudflare Turnstile, which may process limited technical data to distinguish humans from automated traffic.
• Email address validation: when you sign up or change your email address, we send that address (and nothing else) to our email-validation provider ZeroBounce, which processes it in the United States, to check that it can receive email and isn't a disposable or known-abusive address. This is our legitimate interest in reliable email delivery and preventing abuse.
• Basic site analytics: aggregate, privacy-respecting usage data collected via Cloudflare Web Analytics, used to understand overall site performance.
• Billing information: if you subscribe to a paid plan, our payment processor (Stripe) collects and processes your payment details directly. We receive limited billing metadata (such as plan, billing period, and payment status) but never your full card number.
• Affiliate referral data: if you arrive through an affiliate partner's link to one of our offer pages, we record the identifiers contained in that link — the affiliate network's transaction ID and the affiliate's ID — together with the offer page and the time of the visit, at most once per day per link. This record contains no cookie, IP address, or device information and is used only to account for and pay affiliate commissions (our legitimate interest in running our affiliate program). It is deleted after 12 months.

2. How we use this information, and our legal basis for doing so

• To provide and operate the Cloud Storage service, including storing and serving your files, and to process your subscription payment — necessary to perform our contract with you.
• To secure your account, including detecting suspicious sign-in activity and scanning uploaded files for malware — our legitimate interest in keeping the service safe for you and other users.
• To communicate with you about your account, such as password resets and email verification — necessary to perform our contract with you.
• To understand and improve the performance and reliability of the service — our legitimate interest in operating a reliable service.
• To investigate abuse, security incidents and support requests, and to comply with legal obligations, which may include our platform owner accessing the files in your account as described in Section 3 — our legitimate interest in keeping the service safe and lawful, or compliance with a legal obligation.

3. How we store and protect data

Your files and account data are stored using Cloudflare's infrastructure. Access to your account is protected by your password and, where enabled, additional bot-protection checks. You can review and revoke active sessions at any time from your account security settings. Uploaded files are automatically scanned for malware before being made available for sharing.

Our platform owner can access the files stored in your account — including opening and downloading them — through our internal administration tools, for example to investigate and act on illegal content, abuse or security issues, respond to legal requests, or resolve a support request. This access is limited to the platform owner, requires a recent sign-in, and every access is recorded in our internal audit log. We do not notify you of each individual access. Where we find illegal content, we may remove it, suspend the account, report it to the competent authorities, and preserve it and related account data for as long as the law requires.

4. Cookies

We use a session cookie to keep you signed in. We do not use third-party advertising or tracking cookies. Our site analytics (Cloudflare Web Analytics) operate without cookies. Because we only use strictly necessary cookies, we don't show a cookie consent banner — see our Cookie Policy for full detail.

5. Data retention

Files you delete are retained in Trash for 30 days to allow recovery, after which they are permanently deleted. Account data is retained for as long as your account is active, and for a reasonable period afterward to comply with legal, tax, and accounting obligations. When your subscription ends, uploading is paused and your files are kept for 30 days so you can download them or subscribe again; after that they are permanently deleted. We email you when it ends, 7 days before, and 1 day before deletion.

6. International data transfers

Cloud Storage is built on Cloudflare's global infrastructure, which does not pin your data to a single region. Your files and account data may be processed or stored in a country other than the one you access the service from. Where personal data is transferred outside the European Economic Area or the United Kingdom, we rely on our infrastructure providers' standard data-protection safeguards, including Standard Contractual Clauses incorporated into their data processing agreements, to ensure your data receives an equivalent level of protection wherever it is processed.

7. Your choices and rights

You can access, update, or delete your files at any time through the app. You can download a copy of your data and delete your account yourself in Settings > Privacy & data; a deletion takes effect after a 30-day recovery window, during which you can restore your account. You can also contact us at the email below.

If you are located in the EU or UK, you have the following rights under GDPR / UK GDPR in relation to your personal data. To exercise any of these, contact us at the email in Section 10; we will respond within one month of your request (extendable by a further two months for complex requests, in which case we will tell you why).

• Right of access: request a copy of the personal data we hold about you.
• Right to rectification: ask us to correct inaccurate or incomplete personal data.
• Right to erasure: ask us to delete your personal data, subject to legal exceptions (for example, data we must keep to comply with a legal obligation).
• Right to restrict processing: ask us to limit how we use your personal data in certain circumstances.
• Right to data portability: request your personal data in a structured, commonly used, machine-readable format, or ask us to transmit it to another provider where technically feasible.
• Right to object: object to processing based on our legitimate interests, including for the security/analytics purposes described in Section 2.
• Right to withdraw consent: where processing is based on your consent, withdraw it at any time without affecting the lawfulness of processing before withdrawal.
• Right to lodge a complaint: you can complain to your local data protection supervisory authority at any time (for example, the ICO in the UK, or your national authority in the EU) — you don't need to contact us first.

See our GDPR / Data Subject Rights page for a standalone summary of these rights.

8. Your right to withdraw from your subscription (EU/UK)

If you are a consumer located in the EU or UK, you may withdraw from your first subscription within 14 days, for any reason, through a dedicated request in Settings → Billing — a separate process from ordinary cancellation. Doing so stops future billing immediately; any refund owed is then calculated per the applicable rules (which may include a deduction for service already provided) and issued to your original payment method. See our Refund & Cancellation Policy for full detail.

9. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be reflected by updating the date at the top of this page.

10. Contact

Questions about this Privacy Policy, or requests to exercise your privacy rights, can be sent to support@cloudstorage.sh.