Privacy Policy

VeilShare is a privacy-focused file sharing service designed to minimize data collection.

Files uploaded to VeilShare are encrypted client-side before being transmitted to our servers. Encryption and decryption occur in your browser using AES-256-GCM. We never receive your encryption keys in usable form and cannot decrypt uploaded files. Even for files saved to an account, keys are only ever stored encrypted, protected by your account password to preserve end-to-end encryption.

Creating an account is optional. You can upload, share, and download files without ever signing up. An account is only needed if you want to buy a plan or manage your uploaded files.

This Privacy Policy explains what information we process, why we process it, and how long it is retained.

To operate VeilShare, we process a limited amount of technical and encrypted data.

Encrypted File Blob

Before a file is transmitted to our servers, it is encrypted locally in your browser using AES-256-GCM encryption. We store only an encrypted file blob required to deliver the file to recipients.

We don't have access to:

• The unencrypted contents of your files
• Raw encryption keys

When uploading a file, an encryption key is generated client-side in your browser. This key is used to encrypt the file before upload and is required to decrypt it upon download. The key itself never reaches our servers in usable form. Each share link carries its own key in the URL fragment, which unlocks the file's key. If you're logged in, the file is saved to your account and its key is stored encrypted behind your account password, so you can access it from any device by logging in. Either way, we have no way to decrypt your files.

File and Folder Metadata

We store minimal metadata necessary for functionality, both encrypted and unencrypted, including:

• File and folder names (end-to-end encrypted)
• Small preview images of photos and videos (end-to-end encrypted)
• File size
• Share link settings, such as expiry date, download limit, number of downloads, and when a link was deactivated
• How many times each share link has been opened, when it was last opened, and download count. These are only counts: we don't record who opened a link.
• When a file was last downloaded. Used to decide which files to remove if your storage exceeds your plan's limits (ex. if your plan expires - see Retention below for more)
• The IP address used to upload: used to handle abuse reports and enforce limits. However VPNs are allowed - read more at Section 4 in ToS.

Password Protection

We optionally allow share links to be protected with a password. Password protection is intended to prevent unauthorized access by people who have the link. It does not provide additional encryption of the uploaded files themselves.

Link passwords are always stored in a hashed form.

Account Information

If you choose to create an account, we process:

• Your email address, used for login, verification, and account-related notices
• A hashed version of your password (we never store your password in plain text)
• Session information such as your browser's user agent and when a session was created and last used, so you can view and revoke active sessions
• Short-lived verification codes (hashed) used for actions like email verification, password resets, email address changes, and account deletion

If you change your email address, we keep a record of the change for account security purposes.

When you create an account, you're shown a one-time recovery key. If you forget your password and don't have this recovery key, files you'd previously saved to your account become permanently inaccessible when you reset it - we have no way to recover them. That's why it's important to store your recovery key as a backup.

Deleting your account permanently removes this account data.

Payment Information

Paid plans can be purchased with Bitcoin or credit card.

For Bitcoin, we generate a unique deposit address for each purchase and record the amount expected, the amount received, and the payment status.

Bitcoin transactions are recorded on the public Bitcoin blockchain, which is outside of our control. If you have concerns about payment privacy, that's worth keeping in mind when choosing how you acquire and send Bitcoin.

For card payments, Stripe processes and stores your payment details directly - we never see or store your card number. We keep a record of your Stripe customer and subscription IDs and payment status to manage your subscription.

Technical & Security Data

To protect the service against spam, abuse, and automated attacks, we process technical information such as IP addresses for rate limiting and security purposes. This data is not used for advertising or analytics.

Cookies

We only use essential cookies to support authentication, security, language preferences, and core functionality. We do not use cookies for tracking, analytics, or advertising.

VeilShare is designed to minimize data collection.

We don't collect:

• Client-side tracking or analytics
• Advertising identifiers or trackers
• Content of your files (they are encrypted)
• The encryption key to your files in usable form (it stays client-side, and if saved to your account, it is protected by your account's password)
• Your payment card details (card payments are processed by Stripe - we never see or store your card number)

Even for accounts, we only ask for what's needed to run the service. We don't sell or share your data with advertisers.

Files and folders uploaded without an account: the encrypted files and their metadata are automatically deleted within an hour of the share link expiring, reaching its download limit or being deactivated. They become inaccessible immediately and cannot be downloaded.

Files in your account: these are kept until you delete them. Share links can expire or be deactivated without deleting the file. A record of each link is kept until the file or folder it belongs to is deleted. If your plan lapses and your storage exceeds your new plan's limit, we'll email a warning and give you 30 days to download your files or renew. After that, files over your limit are deleted until you're back within your limit.

Account data: retained while your account is active. Deleting your account removes your account data and your stored files.

We rely on a small number of providers to run VeilShare:

• Hetzner for server hosting
• Cloudflare for file storage and abuse protection
• Resend for email delivery
• Stripe for card payment processing

These providers only receive what's necessary to perform their function. You can read their respective privacy policies for more detail.

If you have any questions, feel free to send us an email.

Email: [email protected]