Know what you share.

Files and access.

Cloud uploads pass through the service into private object storage. The service processes the file and information needed to deliver it, such as its name, size, and expiry. Anyone with a valid share link can download it. Treat that link as an access credential.

Private storage does not make standard uploads end-to-end encrypted. Do not upload sensitive material on the assumption that the service operator or storage provider cannot access it.

Expiry is not instant erasure.

An expired link stops allowing new downloads. Physical deletion is a separate scheduled cleanup (cron) operation; stored files can remain after expiry until cleanup succeeds. Delayed or failed cleanup can extend that interval.

Expiry cannot recall copies that recipients already downloaded, and should not be relied on to interrupt a download already in progress.

Browser preferences and infrastructure.

Your color-theme preference is saved in this browser’s local storage. Choosing System follows your device’s appearance setting. Clearing site data resets the saved choice.

Hosting and storage infrastructure may process request information, including IP addresses and operational logs. These notes do not promise zero logging or specify a retention period for infrastructure logs.

Optional encryption and local transfers.

Optional browser AES-256-GCM encryption protects the file and original filename before cloud upload. The service stores ciphertext under a generic filename, but still sees size, expiry, and request metadata. The 32 MiB encrypted-envelope cap includes overhead, not total browser memory. Ordinary cloud uploads do not gain this protection automatically.

The decryption key is in the complete link’s #key= fragment, not the HTTP request. Anyone with that complete link can decrypt. Keep it private: clipboard tools, extensions, browser history, or scripts on the page may access it. The service cannot recover a lost key. This protection relies on a trusted browser and the code delivered by the operator; it is not protection against a compromised page or device.

Experimental P2P sends files up to 32 MiB over a WebRTC DTLS-encrypted data channel without storing them in the cloud. It is local-network only: manual offer/answer exchange, no STUN/TURN servers, no automatic resume or cloud fallback. Both tabs must stay open. Exchange signals through a trusted channel; peers can learn network information such as IP addresses. Transport encryption does not verify a person’s identity or make the transfer anonymous.

Choose appropriately.

These are product notes, not a compliance certification or a guarantee of GDPR compliance. Check the operator’s terms and your own legal or organizational requirements before sharing regulated or confidential data.

For practical questions, read the FAQ.