What we can give the police

An account with an email address

What exists: the email address; when the account was made and last used; its plan and payments (dates and amounts; card details are held by Stripe, not us); how much it stores; how much it and each of its share links downloaded this month, and how many times each link was downloaded; its files, as encrypted blocks no one can read without keys we’ve never had; the names the apps gave its signed-in devices, and when each was last used; which share links exist, but not what they open; whether two-factor sign-in is on, and since when; the names given to its security keys or passkeys, their public keys, and when each was added and last used; the secret its authenticator app uses, stored encrypted with a key we hold, and when it was last used; its backup codes, only in a scrambled form; a request to turn two-factor off, if one is waiting; who invited it and whom it invited, what those payments earned, and which company provides its seat, if one does; an affiliate’s or partner’s application; and any emails the member sent us in the last 13 months. If time was added with a prepaid code, which account used it is kept for 90 days. What doesn’t exist: file contents, file or folder names, passphrases, recovery keys, the keys to the vault, IP addresses, and any record of which file was opened or downloaded, or when.

After an account is deleted, its referral, affiliate and seat records are kept until 7 years after the last payment, without their link to the account.

An account without an email address

Its Account ID (a public key) and the same as above, without an email address. Payment references are deleted 40 days after a payment is credited (cash: 90), after which a payment can’t be tied to the account. A payment still waiting (underpaid or not yet matched) is credited and closed within 120 days, and its reference then goes the same way. The 12 words never reach us.

Someone who opens a share link, or visits the site

We don’t record who they are. Counters that slow down abuse keep their address scrambled with a key that changes each day. Until the day ends, an address someone already knows could be checked against them. Then the counters and that day’s key are deleted, and once our database host’s 7-day history has passed too, no counter can be matched to an address, even by us. A share link’s download count says how many times it was downloaded, not by whom.

Backups and providers

Our database backups are encrypted, leave out the counters, and are kept for 30 days. Our database host, Neon, keeps its own history for 7 days. Our hosting provider, Vercel, keeps request records, which include addresses, for 1 day, and its security records follow its policy. Resend, which sends and receives our emails, keeps copies of the emails we send for 30 days, and those we receive under its policy. Emails sent to us are kept in our Gmail mailbox at Google. Stripe keeps its own payment records under its policy. Your encrypted file blocks are stored at Backblaze. Downloads reach it only through our own download servers, so it never sees the address of anyone downloading. Uploads go to it directly for now, so it sees the uploader’s address; from November 16 they go through our download servers too. Our download servers are rented from OVH; they keep no access logs, and OVH’s own network records follow its policy. How long we keep each record is on What we keep, and for how long.