What we keep, and for how long
Updated October 18, 2026
Everything we keep, how long, and why. Your files and their names are encrypted on your devices: we can’t read them, here or in any backup. What we can be ordered to hand over is on What we can give the police.
| What | How long | Why |
|---|---|---|
| Your account, plan and space used | Until the account is deleted | To run it |
| Your files (encrypted blocks) | Until you delete them; the trash keeps them 30 days | Your storage |
| Sign-in codes | 15 minutes | To sign you in |
| Sign-in attempts (the address you typed) | An hour after the code expires; only a scrambled counter lasts to the end of the day | To send and check the code, and slow down abuse |
| Signed-in devices | Until signed out, or 90 days unused | To keep you signed in |
| How much an account and each of its share links downloaded this month, and how many times each link was downloaded | The month’s totals until the month ends; a link’s count until the link is deleted | Your downloads allowance, and to show you which link used it |
| Payment references (accounts without an email address) | 40 days after the payment is credited (cash: 90); never paid: 40 days (cash: 120) | To credit the payment |
| Payments still waiting (underpaid or not yet matched) | Up to 120 days, then credited and closed; the reference then goes as above | To credit what arrived |
| The link between a prepaid code and the account that used it | 90 days after it’s used | Refunds and disputes |
| Counters against abuse (an address, scrambled with a key that changes each day) | To the end of the day; that day’s key is then deleted | To slow down attacks |
| Emails sent to us (support@, admin@ and our other addresses), forwarded to our Gmail mailbox at Google | Deleted within 13 months of arriving (we clear them once a month) | To answer you |
| Books, company invoices and paid code orders | 7 years after the last payment | Tax and accounting |
| Referral, affiliate and company-seat records: who invited whom, an affiliate’s application and what each payment earned, which company provides a seat | 7 years after the last payment; kept after an account is deleted, without its link to that account | Tax and accounting |
| A closed account’s customer record at Stripe | Deleted 180 days after closing. Stripe keeps its own payment records under its policy. | Refunds and disputes |
| Partner and affiliate applications never approved | 12 months | To answer the applicant |
| Reports about a share link, and copyright notices | 1 year | To deal with abuse |
| Free accounts unused for 12 months | Removed, after two emails | So we don’t keep what nobody uses |
| Database backups (encrypted, no file contents) | 30 days | To recover from a disaster |
| Our database host’s own history | 7 days (Neon’s policy) | Recovery |
| Copies of emails we send and receive | 30 days for sent email; received email under Resend’s policy | Delivery |
| Vercel’s request records shown to us (addresses included) | 1 day | Vercel’s own operation. Vercel’s security records follow its policy. |
| Visits to our download servers (OVH) | Not recorded | — |
For accounts without an email address, the books keep the day of each payment, its amount and how it was paid, but not the time and not the account. On a day with very few payments, one could still be matched to an account by its amount. Company invoices, paid code orders and the referral, affiliate and seat records say whom they belong to.