Privacy Policy
Last updated: 17/08/2026We reserve the right to update this policy, but we will always keep it simple and honest. Any changes take effect when we publish them here.
We only collect data that is essential for our services to work:
Your Discord account: Signing in is the only way to get an account here. We ask Discord for the identify scope, which gives us your Discord ID, username, display name, and avatar. We store exactly those four things.
What we never receive: Your email address, your password, the servers you are in, your friends, and your messages. We do not ask Discord for them, and we discard the Discord access token as soon as sign-in finishes.
Sessions: A single cookie holding a random token. The database only keeps a hash of it, so a stolen database cannot be used to sign in as you.
File uploads: The files you upload and basic metadata (name, type, size, upload date) linked to your account.
Short URLs: Unique clicks may be counted using hashed IP addresses so we cannot identify you personally.
Reports: If you report content, we store the report details and a hashed IP to prevent abuse.
Important: We do not sell your data, track you across the web, or build advertising profiles.
Accounts exist so uploads and abuse reports can be tied to a person instead of an anonymous flood. Anyone with a Discord account can have one, and there is no invite, queue, or fee. File metadata lets us serve hosted URLs, enforce the size cap, and show you your own library. Hashed IPs exist only to rate-limit uploads and reports.
Sign-in is handled by Discord, so their privacy policy applies to the authorisation step itself. Object storage for this prototype is Google Drive, accessed only from the server with an owner OAuth refresh token. Clients never see Drive links. Account and file records live in a Postgres database hosted in the EU. We may add a captcha provider later if abuse requires it.
You can ask us to delete an account, wipe files, or export the metadata we hold. Signing out removes the session immediately, on our side as well as yours. Use the Report page for content that should not be public. Self-service account deletion is on the roadmap; until it ships, ask us and we will do it by hand.