Privacy
In short. Your files, photos, file names and folders are encrypted on your device with keys we never have. What we can see: your handle, your billing details at Stripe, the size and number of your encrypted objects, when they move, crash reports from your devices (you can turn them off), and the technical logs any web service has. No analytics, no advertising, no sale of data.
1. Controller
Past SAS, 173 rue de Courcelles, 75017 Paris, France — [email protected]. See the legal notice.
2. What we cannot see
Every file, photo, thumbnail, file name, folder name and search index is encrypted on your device before upload, with keys derived from your passkey (WebAuthn PRF) or your recovery code. The servers store and move ciphertext only. We have no way to decrypt it, and no key escrow exists.
3. What we process
| Data | Why | Where | Kept |
|---|---|---|---|
| Your handle; the handles of household members; invitation links | Running your account (contract) | Cloudflare Durable Objects | Until the account is deleted |
| Passkey public keys, credential IDs, device labels; the encrypted key envelopes they unlock | Signing you in (contract) | With your encrypted data | Until revoked or the account is deleted |
| Encrypted objects: their size, count, timestamps, access patterns | Storing and serving your drive, measuring storage for billing (contract) | Hetzner Online GmbH, Germany; served through Cloudflare | Until deleted by you, or 14 days after the subscription ends (read-only meanwhile); server snapshots 30 days |
| Email, card details, billing address, country, invoices | Payment (contract), accounting (legal obligation) | Stripe. We see the email, the customer and subscription IDs, never the card number | Invoices 10 years (French commercial law) |
| Share links: visit count, read count, coarse device type of visitors | Showing you how your links are used (contract) | Cloudflare Durable Objects | Until the link is deleted or expires |
| Technical logs: IP address, user agent, URL, timestamp, status | Security, abuse prevention, debugging (legitimate interest) | Cloudflare | Short-lived; Cloudflare's standard retention |
| Crash reports: your handle, the app version, device model and system, memory and CPU figures, the app's own log and crash traces, cleaned on your device of paths, file names, quoted names and links before they leave. Off in Settings › History › Debug | Fixing crashes (legitimate interest) | Cloudflare Durable Objects | 30 days |
| Emails you send us | Support (legitimate interest) | Our mailbox at Google (Gmail), relayed by Forward Email | 3 years after the last exchange |
4. Cookies
Two functional cookies, no consent needed: handle remembers which drive this device opens; claim carries a one-time signup or invitation token for the first passkey. Stripe sets its own cookies on its checkout and billing pages. No analytics or advertising cookies, no trackers.
5. Processors and transfers
- Hetzner Online GmbH (Gunzenhausen, Germany) — storage of encrypted data. EU.
- Cloudflare, Inc. (San Francisco, USA) — network, application code, account state. Encrypted data transits through Cloudflare's edge; account metadata is stored in Cloudflare's Durable Objects. Transfers are covered by the EU–US Data Privacy Framework and Cloudflare's standard contractual clauses.
- Stripe Payments Europe, Ltd. (Dublin, Ireland) — payments; Stripe's own privacy policy applies to the data you enter at checkout.
- Forward Email LLC (USA) — relays email sent to [email protected] to our mailbox.
- Google LLC (Mountain View, USA) — our mailbox (Gmail). Transfers are covered by the EU–US Data Privacy Framework.
We do not sell data and we do not share it with anyone else, except when the law requires it. Since your content is encrypted with your keys, a legal request can only obtain the metadata listed above.
6. Your rights
Under the GDPR you may access, correct, delete and export your data, object to or restrict processing, and withdraw consent where it applies. Most of this is in your hands: download your files from the app; delete your account by cancelling the subscription, which deletes the encrypted data 14 days after it ends. For anything else, write to [email protected]. You may complain to the CNIL (cnil.fr) or to your local authority.
7. Security
Encryption on your device, passkeys instead of passwords, and a storage server that never talks to a client. If we learn of a breach affecting your data, we notify you and the authorities as the law requires. A breach of our servers exposes ciphertext and the metadata above, not your files.
8. Changes
We update this page when the processing changes, and tell you by email or in the app when a change matters.