Privacy Policy

1. What we collect

• Account info: name, email address, hashed password (we never store your password in plain text)
• Uploaded files and their metadata (filename, size, type)
• The IP address of uploaders and downloaders, used for abuse prevention, rate limiting, and enforcing daily download limits
• Payment information for Pro subscriptions, handled entirely by Stripe. We never see or store your card number
• A session cookie to keep you signed in, and a short-lived cookie to remember that you've unlocked a password-protected link

2. Why we collect it

Uploader and downloader IP addresses are retained to detect and block abuse (e.g. repeated copyright infringement, illegal content uploads, or attempts to bypass rate limits), and are shared with law enforcement only when legally required or in response to a valid legal request. When you upload a file, its content hash (not the file itself) is checked against VirusTotal's malware database before the file is made available. Account and file data is kept for as long as your account or file exists; if a file is auto-deleted for inactivity or you delete your account, its associated data is removed from our active systems, though backups may persist for a limited time before being purged.

3. Cookies

We use a small number of strictly necessary cookies: to keep you signed in, and to remember that you've entered the correct password for a protected link. We may also show ads through Google AdSense. Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this site or other sites on the internet. You can opt out of personalized advertising by visiting Google Ads Settings. We don't sell your data to anyone.

4. Third parties we use

• Backblaze B2: file storage
• Neon: database hosting
• Vercel: application hosting
• Stripe: payment processing
• Resend: transactional email delivery (verification, password reset, notifications)
• Upstash: rate limiting infrastructure
• Cloudflare: DNS, domain, and email routing
• VirusTotal: malware hash-reputation checks on uploaded files (only a hash is sent, not the file)
• Google AdSense: displays ads on some pages and uses cookies for ad personalization

5. Your rights

You can request access to, a copy of, or deletion of your account and associated files at any time by contacting privacy@blutobox.com. If you are in the European Economic Area, the UK, or California, you may have additional rights under GDPR or CCPA/CPRA, including the right to correct inaccurate data and the right to object to certain processing. Contact us at the address above to exercise any of these rights.

6. Children's privacy

This service is not directed at children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, contact us and we will delete it.

7. Contact

Questions about this policy: privacy@blutobox.com