Privacy Policy • Fileport

This Privacy Policy describes how Fileport Inc., a Delaware corporation registered in the United States (“Fileport”, “we”, “us” or “our”), collects, uses, shares and protects information when you use the Fileport website at https://fileport.io, its download pages, its paste pages, the custom domains that account holders use for their download pages and all related services (together, the “Service”). It applies to everyone who uses the Service, including guests, account holders and the recipients of download links and pastes. Terms that are not defined in this policy have the meaning given to them in our Terms of Service.

Fileport is committed to maintaining robust privacy protections for its users. We collect only the information that we need to provide, secure and improve the Service. We do not display advertisements, we do not use third-party analytics or tracking services, and we do not sell your personal information.

1. Information we collect

Information you provide

Account details. When you create an account, we collect your name, your email address and, unless you sign up with Google or Apple, a password. We store passwords only as salted cryptographic hashes. If you sign up with Google or Apple, we receive your email address and an account identifier from that provider, and we store the identifier only as a hash.
Billing details. When you subscribe to a paid plan, your payment details are collected and processed by Stripe, and we never receive or store your full card number. We store the identifiers of your Stripe customer, subscription and payment method, your plan, your billing dates, your invoices and the reason for any failed payment. We obtain the brand, last four digits and expiration date of your card from Stripe in order to display them to you.
Security settings. If you enable two-factor authentication, we store the secret key needed to verify your codes.
Your content. The files and folders that you upload, together with their names, sizes, folder structure and last modified dates, and any name, description, tags or password that you add to an upload. We store upload passwords only as hashes.
Your pastes. The text and title of each paste that you create, whether it is plain text or Markdown, and any tags, expiration, password or other settings that you choose. We also store its size, its number of lines and the domains of the links it contains, which we derive from its text. We store paste passwords only as hashes.
Your QR codes. The name, tags and logo of each QR code that you create, and the PDF or images that it shows. We also store pictures of their pages, and the text of PDF pages for screen readers, which we derive from the files.
Your requests. The title and instructions of each request that you create, the name that you sign it with, and any tags or other settings that you choose. When you send a request by email, we also store the email address that you last sent it to.
Files you send to requests. When you send files to a request, we store them as an upload of the account holder who created it, together with the name that you enter and your message, if you add one. We also store a one-way hash of a random key that your browser keeps, so that the request's page can show what you have sent from that browser.
Emails you send through Fileport. When you send a download link or a paste by email, we collect the email addresses of its recipients and your message.
Invitations. The email addresses of the people you invite to join your account.
Customizations. The logo, title, link and custom domain that you add to your download pages.
Messages to us. When you use our contact or support forms, we collect your email address, your message and the address of the page you came from. When you report abuse, we collect the link, the reason and the details that you give, your email address if you give it, and the address of the page you came from.
Preferences. Your default upload settings, and whether you have agreed to receive product update emails.

Information we collect automatically

IP address and country. Like any website, our servers receive the IP address of every device that connects to them. We determine the country associated with an IP address through Cloudflare. We store IP addresses, and in some cases countries, only in the following records:
- Each upload, with the IP address and country it was uploaded from and the IP address of its most recent download
- Each paste, with the IP address and country it was created from
- Each QR code, with the IP address and country it was created from
- Each request, with the IP address and country it was created from
- Each account, with the IP address used to create it and the IP address and country of its most recent activity
- Each email we send at your request, such as a download link, a paste or a request sent to your recipients, a verification code or a password reset, with the IP address and country it was requested from
- Records used to enforce rate limits, to count unique visitors, to block abuse and to measure the results of our promotional links
- Error reports and technical logs
Referrers. When you open a download page or a paste, or start an upload, your browser may tell us the address of the page that linked to it. We store the most recent referring address of a download page with its upload and of a paste with the paste, and we keep a count of the external websites that link to Fileport, with the most recent address from each.
Device and browser. Your browser sends us a user agent string that describes your browser and operating system. We store it only in error reports and technical logs. For download, paste and QR code statistics, we store only the type of device derived from it.
Error reports. If an error occurs while you use the Service, your browser may send us a report with technical details of the error, the page on which it occurred and the page you came from, to which we add your IP address and user agent.
Usage information. Counts of uploads, downloads, pastes, paste views, transferred data, errors and the use of certain features, which we keep as aggregated statistics that do not identify you.

Information we receive from third parties

We receive your email address and an account identifier from Google or Apple if you sign in with them, payment status and card details for display from Stripe, and the country associated with your IP address from Cloudflare.

2. Download pages, pastes, QR codes, requests and recipients

When someone opens a download link, we record the number of times the upload is downloaded (or, for a photobook, viewed), the amount of data transferred, the date of the most recent download, the IP address of the most recent download and the address of the page that linked to it, if the browser provides one.

Download notifications. Account holders on a paid plan may choose to receive an email when their upload is downloaded. The notification includes the approximate location of the download, by city and country, which we determine from the recipient's IP address through a geolocation service.

Download statistics. For uploads made by account holders on a paid plan, we record each view of the download page and each download, with the date and time, the file concerned, the country it was made from, the type of device used (desktop, phone or tablet) and a visitor number. The visitor number is derived from the recipient's IP address, user agent and the upload through a one-way cryptographic function. It allows us to recognize repeat visits by the same person without storing their IP address or user agent, and it differs from one upload to another, so it cannot be used to follow a person across uploads.

The account holder who made the upload can see these statistics, including a list of recent views and downloads with their time, country and device. We do not record views and downloads by search engines, bots, link preview services or Fileport staff. Download statistics are deleted 13 months after they are recorded, or earlier if the upload is deleted.

Pastes. When someone opens a paste, we count the view and record the date of the most recent view and the address of the page that linked to it, if the browser provides one. Account holders on a paid plan may choose to receive an email when their paste is read, which includes the approximate location of the reader, determined in the same way as for download notifications.

Paste statistics. For pastes created by account holders on a paid plan, we record each view of the paste and each download of its text with the same details as download statistics, and the account holder who created the paste can see them. Paste statistics are deleted 13 months after they are recorded.

QR code statistics. For QR codes on every plan, we record each visit to a code's page as a scan, with the same details and exceptions as download statistics. We record only scans, not downloads of the file behind the code. The account holder who owns the code can see its scans per day and a list of recent scans with their time, country and type of device. QR code statistics are deleted 13 months after they are recorded, or earlier if the code is deleted.

Requests. Anyone who has the link of a request can see its title, its instructions, the name that it is signed with and the email address of the account holder who created it. When someone opens a request, we count the view. The account holder who created a request can see the files sent to it, with the name, the message and the country of the person who sent them and when they arrived, and can choose to be emailed when files arrive. Files sent to a request cannot be opened through a link, and people who send files to a request cannot see what others have sent.

3. How we use information

We use the information described above for the following purposes:

To provide the Service: to store and deliver uploads and pastes, to list your uploads and pastes, to operate accounts, subscriptions and invited users, and to apply the features and limits of your plan, including limits that depend on your region.
To communicate with you: to send verification codes, password resets, security alerts, billing and account notices, the download and read notifications you have asked for, and the emails you send through the Service.
To send product updates, only if you have agreed to receive them.
To secure the Service and prevent abuse: to enforce rate limits and usage limits, to detect connections from VPNs, proxies and anonymizing networks, to block network addresses and websites used for abuse, to check uploads and pastes automatically for malware and abuse, to check pastes for phishing and for links to websites used for abuse, to lock accounts whose payments are reported as fraudulent or disputed, to investigate reports and to enforce our Terms of Service.
To maintain and improve the Service: to diagnose errors and to measure its performance and usage through aggregated statistics.
To comply with the law: to keep financial records, to respond to lawful requests from authorities and to protect our rights and the rights of others.

Legal bases

Where the General Data Protection Regulation (GDPR) or a similar law applies, we process personal information on the following legal bases:

Performance of a contract, to provide the Service and to manage your account and subscription
Legitimate interests, to secure the Service, to prevent abuse and fraud, to give account holders statistics about their uploads, pastes and QR codes, and to maintain and improve the Service, where these interests are not overridden by your rights
Consent, to send you product updates, which you may withdraw at any time
Legal obligation, to keep the records required by tax and accounting laws and to respond to lawful requests from authorities

4. Your uploads, pastes, QR codes and requests

Uploads, pastes, QR codes and requests are private by default. They are not listed publicly, and only someone in possession of their link can access them. Account holders on a paid plan can also protect uploads and pastes with a password.

Files are transferred over encrypted connections and are encrypted at rest on our upload servers with AES-256, using keys derived for each upload. Fileport manages these keys in order to deliver your files to your recipients, so this is not end-to-end encryption.

We process uploads automatically in order to provide the Service, for example to show previews, to create photobooks and their thumbnails, and to package folders as ZIP files for download. Photobook images are resized copies that do not contain the metadata of the original files, such as their location data. Uploads by guests and free accounts that consist mostly of photos and are downloaded frequently may be converted into photobooks automatically.

Automatic checks. To protect recipients, we check each upload when it is complete, and each paste when it is saved, against rules that describe known abuse. The rules may look at the names, sizes and types of the files, at their contents, including the text inside documents and the names of the files inside archives, at whether a file is a copy of a file we removed before, and at the network address, country and account that an upload or paste comes from. To recognize copies, we keep a fingerprint of each file that we remove for abuse, made from its size and samples of its contents.

Certain files uploaded by guests and free accounts, such as executable files, scripts, web pages and archives that contain executable files, may be submitted to a third-party malware scanning service. The scanning service may share the files submitted to it with its security partners, in accordance with its own terms. For the files of paid accounts, we only ask the scanning service whether it already knows a file, by a one-way fingerprint of its contents, and never submit the file itself. We may also ask a third-party IP reputation service about the network address that an upload or paste comes from. Fileport staff may check a file from any upload in the same way when investigating a report or a suspected violation of our Terms of Service.

When a check finds abuse, we may delete the upload or paste, block the network address it came from for a period, lock the account and keep the fingerprints of its files, and we keep a record of what the check found and did. We may also lock an account when our payment processor reports one of its payments as fraudulent or disputed.

Pastes. The text of a paste is transferred over encrypted connections. We process pastes automatically in order to display them, for example to format Markdown. To protect readers, we check the links in pastes against websites that we have identified as sources of abuse, and we check pastes by guests and free accounts for signs of phishing. Depending on the result, a paste may be refused, or its links may be shown as plain text and the paste flagged for review by Fileport staff.

Access by Fileport staff. Fileport staff do not access the contents of uploads or pastes as a matter of course. We access the contents of a specific upload or paste only when necessary to investigate a report of abuse or a suspected violation of our Terms of Service, to respond to a lawful request from authorities, to protect the security of the Service, or to help you when you ask for support. To find and remove phishing and other abuse, Fileport staff may also search the text of pastes for specific words or links. When there is a request by law enforcement, there are procedures to allow selective access to certain data in order to assist law enforcement with their investigation. Read more about our Acceptable Use Policy in the Terms of Service.

5. Cookies and local storage

We do not use advertising or analytics cookies, and we do not set any cookies when you visit our home page, open a download link or read a paste. We set cookies only for the following functions, which require them:

Session. Set when you make your first upload or paste as a guest, so that we can list your uploads and pastes when you return, and when you log in, to keep you logged in. It remains in your browser until you log out or clear it, and we end login sessions that have not been used for 720 days.
Login protection. Set when you open the login page, to protect the login form against forged requests. It is deleted when you log in or close your browser.
Sign up. Set while you create an account, to keep your progress between steps. It expires after 24 hours and is deleted once your account is created.
Google and Apple sign in. Set when you choose to sign in with one of these providers, to protect the process. It expires after 10 minutes.
Invitations. Set when you open an invitation, so that we can apply it when you sign up. It is deleted when you close your browser or once you sign up.
Messages. Set to carry a confirmation or welcome message from one page to the next, and deleted as soon as the message is shown.

Our website also keeps your settings in your browser's local storage, such as the upload location you chose, the response times of our servers, the tips you have already seen and the email addresses you recently sent files to, so that it can suggest them again. This information is used only by our website on your device and is cleared when you log out.

Stripe may set its own cookies on our payment pages, and Cloudflare may set cookies that it needs to protect our website, in accordance with their own policies.

6. Service providers

We rely on the following service providers to operate the Service. They process information on our behalf, only as needed to provide their services to us, and in accordance with their own privacy policies:

Cloudflare protects and accelerates our website as a caching accelerator and security and anti-DDoS provider, and determines the country of each visitor. It also stores copies of frequently downloaded uploads in order to deliver them faster, stores the logos of custom download pages and provides the certificates of custom domains.
Hosting providers operate the upload servers on which uploads are stored, in several regions around the world.
Bunny.net stores and delivers photobook images and the pictures made from the files of QR codes, and hosts and streams photobook videos.
Stripe processes payments and manages subscriptions, invoices and taxes. Stripe receives your name, your email address, your payment details and the IP address you subscribed from, which it uses to determine the taxes that apply.
A malware scanning service checks certain files for malware, and an IP reputation service checks the network addresses of some uploads and pastes, as described in section 4.
Google and Apple verify your identity if you choose to sign in with them.

7. How we share information

We do not sell, rent or trade your personal information, and we do not share it with third parties for their own marketing or advertising purposes. We share information only in the following cases:

With the service providers listed above, for the purposes described in this policy
With the uploader, when you open or download an upload, with the creator of a paste, when you read it, with the owner of a QR code, when you open its page, and with the account holder who created a request, when you send files to it, as described in section 2
With the account holder who invited you, if you joined an account by invitation. That account holder can see your email address, the status of your account and when you last used it, and can remove your account.
With your recipients, when you send a download link, a paste or a request by email through Fileport. The email includes your email address, and replies to it are sent to you. The page of a request also shows your email address to anyone who has its link.
When we believe in good faith that disclosure is required by law, by a court order or by a lawful request from authorities, or is necessary to report unlawful content, to prevent harm, to investigate abuse or to enforce our Terms of Service
If Fileport is involved in a merger, an acquisition or a sale of assets, in which case your information may be transferred as part of that transaction and will remain subject to this policy

8. Analytics

Fileport does not use any external analytics services, and our pages do not load scripts, fonts or other resources from external domains, with the following exceptions:

The payment pages load the payment form of Stripe, and invoices are shown on pages hosted by Stripe.
Photobooks that contain videos load video thumbnails and the video player from Bunny.net.
Signing in with Google or Apple takes you to the sign in page of that provider.

The emails we send do not contain tracking pixels or tracked links.

9. Ads

Fileport does not display advertisements anywhere on its platform. We will never sell your data to advertising companies.

10. Search engines and AI crawlers

Download links and pastes are private by default, but even if you share a download link or a paste in a publicly accessible manner (such as a website or social media app):

We instruct search engine crawlers (referred to as bots or spiders) not to index your data and metadata, and take technical measures to prevent them from doing so.
We take technical measures to prevent AI crawlers from ingesting your data and metadata for AI training purposes.
Fileport does not use your content to train AI models.

11. Data retention

We keep personal information only for as long as we need it for the purposes described in this policy:

Uploads are kept until they expire or are deleted. Their files are then permanently deleted from our servers and our storage providers, and their records, including their IP addresses and file names, are removed from our database.
QR codes are kept until you delete them or your account is deleted, and QR codes of free accounts are deleted after 12 months without a scan. A deleted QR code's file and pictures are permanently deleted from our servers and our storage providers, and its records, including its IP address, are removed from our database.
Requests are kept until you delete them or your account is deleted. Files sent to a free account's request are deleted 7 days after they are sent, and deleting a request permanently deletes the files sent to it.
Uploads, photobooks, pastes and requests of suspended accounts, including the files sent to those requests, are deleted 30 days after the subscription ends unless it is resumed before then, and each account then keeps only its most scanned QR code, as a free QR code.
Account information is kept for as long as your account exists. Invoices and billing records are kept for as long as tax and accounting laws require.
Login sessions end after 720 days without use.
Download, paste and QR code statistics are deleted after 13 months, or earlier if the upload or QR code is deleted.
Unique visitor records and promotional link records are deleted after 30 days.
Referring website records are deleted 180 days after they were last updated.
Rate limit records are deleted after one day, or after 7 days when they include a temporary ban. Blocked network addresses are kept until their block expires.
Copies of the emails we send, including their recipients, their text and the IP address they were requested from, are kept for as long as we need them to investigate delivery problems, spam and abuse.
Unsubscribed email addresses are kept on our unsubscribe list for as long as needed to honor your choice.
Records of automatic checks that acted on an upload or paste, including the IP address and country it came from, and the fingerprints of files removed for abuse are kept for as long as we need them to prevent and investigate abuse.
Error reports and technical logs are kept for as long as we need them to diagnose problems and investigate abuse.
Aggregated statistics, which do not identify anyone, may be kept indefinitely.

12. How we protect information

We implement security measures designed to protect your information from unauthorized access, including encryption in transit and at rest, hashed passwords, rate limits, firewalls and restricted access to our systems. Your account is protected by your account password and we urge you to take steps to keep your personal information safe, such as using a strong and unique password and enabling two-factor authentication.

However, these measures do not guarantee that your information will not be accessed, disclosed, altered or destroyed by a breach of security. By using the Service, you acknowledge that you understand and agree to assume these risks.

13. International transfers

Fileport is based in the United States, where our website, application servers and database are located. Each upload is stored on an upload server in the region selected for it, which by default is the fastest region for you, or the upload location that you choose. Our upload servers and service providers are located in several countries, so your information may be transferred to and processed in countries other than your own, including the United States, whose data protection laws may differ from those of your country. Where the law requires it, we rely on appropriate safeguards for these transfers, such as the standard contractual clauses approved by the European Commission.

14. Your rights and choices

Your uploads, QR codes and requests. You can edit and delete them at any time from your upload, QR code and request lists.
Your account details. You can update your name, email address and password from your Account page.
Deleting your account. You can ask us to delete your account and the personal information associated with it through the Contact Support form. We will do so unless we need to keep certain information to comply with legal obligations, to resolve disputes or to enforce our agreements.
Product updates. You can withdraw your consent to receive product update emails at any time by contacting us.
Emails sent through Fileport. Recipients can unsubscribe from emails sent through Fileport with the link included in each email.
Cookies and local storage. You can delete cookies and local storage through your browser settings. Doing so logs you out and removes the lists of your guest uploads and pastes.

Depending on where you live, you may also have the following rights:

In the European Economic Area, the United Kingdom and Switzerland, you have the right to access your personal information, to have it corrected or erased, to restrict or object to its processing, to receive it in a portable format and to withdraw your consent at any time. You also have the right to lodge a complaint with your local data protection authority.
In California and other US states with comprehensive privacy laws, you have the right to know what personal information we collect, use and disclose, to access it, to have it corrected or deleted, and not to be discriminated against for exercising these rights. Fileport does not sell personal information and does not share it for cross-context behavioral advertising.

To exercise any of these rights, please contact us through the Contact Support form. We may need to verify your identity before we respond, and we will respond within the time required by applicable law.

15. Children's privacy

Our Service is not directed to anyone under the age of 13. The Service does not knowingly collect or solicit information from anyone under the age of 13, or allow anyone under the age of 13 to use the Service. If we learn that we have collected personal information from a child under the age of 13, we will delete it.

16. Changes to this policy

Fileport reserves the right to update this policy at any time. Changes take effect when they are published on this page, and the date at the top of this page shows when the policy was last updated. We may also notify account holders of material changes by email.

17. Contact

You may contact us regarding our services or this policy by using the Contact Form.