Privacy Policy

1. What We Don't Do

• We do not store Live Relay file contents as hosted uploads or retained download links, and we do not inspect decrypted file contents.
• Photon Vault stores encrypted data for files you choose to keep, but PhotonFile is designed not to have the keys needed to decrypt vault contents.
• We do not sell data, run ads inside the product, or use analytics, fingerprinting, advertising pixels, or behavioral tracking scripts. PhotonFile reports narrowly scoped paid purchase events to Google Ads or Reddit Ads from our backend. We do not use this for in-product profiling or link ad measurement events to individual transfer records.
• We do not build behavioral profiles from individual transfers. Cloud transfers associate an authenticated owner with operational records for management, access control, and usage accounting. Advertising attribution is kept separate from transfer records.
• We do not log or retain your client-side encryption keys or decrypted file contents.

2. Minimal Operational Data

We collect only what's necessary to operate and secure the Service:

• Connection metadata (session identifiers, retry counts, transfer duration, and routing diagnostics) required to operate the service.
• Error/system logs to improve reliability and detect abuse.
• Payment references (transaction IDs) from third-party processors. We do not store card data.
• Support messages you send us.

IP addresses may be processed at the network edge for security, routing, and abuse prevention (for example by CDN/WAF providers such as Cloudflare). PhotonFile is designed to avoid retaining client IP addresses in general application logs where they are not needed, but limited IP-related fields may be stored in separate abuse prevention, security, and delivery-protection records, such as email-send attempts and desktop app or component download attempts. These records may include a source IP address, derived IP prefix, and hashed user agent.

These IP-related abuse and security records are separate from Relay transfer records and Vault file storage. They do not tie your IP address to your transfers, the files you transfer or store, file contents, decryption keys, or decrypted Vault data.

Advertising attribution is associated internally with a PhotonFile account so that we can recognize the account's first paid purchase. We do not add it to operational logs or link it to transfers, files, Vault activity, recipients, or stored content.

We do not log the decryption keys used for client-side encryption, and we do not attempt to reconstruct decrypted file contents from operational logs.

Operational logs are pruned and may be anonymized on a rolling basis.

3. Relay Transfers and Vault Storage

PhotonFile streams Live Relay data between peers over TLS using an Ephemeral File Transfer relay. Limited transient data may exist in memory on relay nodes during active sessions, and is cleared when sessions end. We do not persist file contents to server storage as part of the Live Relay transfer flow, and we do not provide a hosted storage inbox or retained download link to a stored copy.

For supported web-app browser flows, client-side encryption is enabled by default during Live Relay transfers. In that mode, your file is encrypted in your browser before any bytes are sent to the relay. The decryption key is encoded into the URL fragment (the part after #...), which is not sent to our servers as part of normal HTTP requests. You can turn this layer off for extra browser compatibility. The Relay connection still uses TLS.

Cloud transfer always encrypts files and file metadata on the sending client. Temporary encrypted blocks support downloads after the sender disconnects. The link carries the decryption secret in its fragment. We cannot recover a lost link. An optional password is checked by the server as an additional access gate, and is stored only as a password hash. It does not replace the link secret or enable PhotonFile to decrypt files.

Cloud transfer records include the authenticated owner, opaque transfer and file identifiers, funding, byte counts, timestamps, and upload, delivery, and deletion status. An optional friendly name is server-visible management metadata. Do not include sensitive details in it. Account management cannot return file contents, decrypting links, or encryption keys.

File Pass backing expires after the selected download period of one to seven days from the complete upload. Seven days is the default. For File Pass funding, a confirmed full saved download prevents new downloads and starts deletion earlier. Account-funded backing remains until its selected expiry or revocation. Expiry or deletion prevents new downloads immediately. PhotonFile deletes its stored copy automatically in the background and retries automatically when storage is unavailable. Cleanup records may remain to remove delayed writes and reconcile billing, without retaining decrypted content or link secrets.

Photon Vault is different. Vault is persistent client-side encrypted storage. Files you choose to store in Vault are kept as encrypted data so authorized clients can access them later. PhotonFile stores encrypted vault data and operational metadata, but Vault is designed so PhotonFile does not have the keys needed to decrypt vault contents.

For Maximum Privacy Vaults, filenames, folder names, plaintext file hashes, and plaintext search queries are also designed to stay out of server-visible storage and logs. PhotonFile still needs limited operational metadata such as account identifiers, object identifiers, sizes, timestamps, folder relationships, permissions, and access or search patterns to operate the service.

4. Cookies and Local Storage

We do not use tracking cookies for analytics, advertising, or behavioral profiling. We may use strictly necessary cookies to maintain an active session (for example, to keep you signed in or to keep a transfer session active). PhotonFile does not load advertising scripts or pixels that set third-party advertising cookies.

We may use local storage to remember basic preferences such as your theme choice or last used settings. On eu.photonfile.com, we also use local storage to remember your advertising measurement choice for 180 days and temporarily preserve allowlisted advertising click and campaign parameters from a landing URL for up to 90 days. This first-party local record lets you make an advertising measurement choice on a later page or after restarting your browser. We do not send or use those parameters for attribution until you accept. Rejecting or withdrawing consent deletes the local record. They are not used for cross-site tracking.

Click identifiers are encrypted before database storage and used only to report the first paid purchase from PhotonFile's backend. Campaign and landing information is erased when that purchase is recorded. Click identifiers are erased after provider submission or terminal processing, and any remaining server-side click or campaign information is erased after no more than 90 days. The provider receives the applicable click identifier, purchase time, value, currency, and a random transaction identifier. We do not send email, PhotonFile account identifiers, IP addresses, user agents, or file and Vault activity to advertising providers.

Where advertising measurement requires consent, including on our EU site, consent is our legal basis. Elsewhere we process this limited attribution only where permitted by applicable law for our legitimate interest in understanding campaign effectiveness. You can withdraw EU consent using the “Privacy choices” control. We then erase stored click and campaign information and cancel unsent conversion work. A conversion already delivered to an advertising provider cannot be recalled.

5. Payments

Payments are processed by third parties such as Stripe (PCI-DSS compliant). PhotonFile does not collect or store credit card details. We may retain transaction references for confirmation and accounting.

6. Security

• TLS-encrypted connections only.
• Session tokens for peer authentication.
• End-to-end client-side encryption of file contents is on by default in supported browsers, with keys kept on the client side. Users can turn it off for extra compatibility. Relay transport remains TLS-encrypted.
• Hardened servers and monitoring for unauthorized access.

No system is perfectly secure, but PhotonFile minimizes exposure by avoiding data retention wherever possible and by keeping file data in memory only for the duration of an active transfer.

7. Data Retention

• General operational logs (non-content) generated by PhotonFile's application servers are typically retained 7-30 days and then deleted. Separate abuse prevention, security, and delivery-protection records may retain limited IP-related fields where needed, but they do not include file contents, decryption keys, or decrypted Vault data.
• Payment confirmations are retained as required by law and accounting.
• Pending EU advertising click and campaign information is erased from local storage after no more than 90 days. Server-side advertising click and campaign information is erased when it is no longer needed and in all cases after no more than 90 days. The EU advertising measurement choice is renewed after 180 days.
• Relay file contents are not retained beyond the active session lifetime.
• Vault data persists until you delete it or the applicable plan or product policy removes it, such as the cleanup window on the free Vault tier.

8. Your Rights

You may request deletion of support communications and ask what operational data relates to your usage. Contact [email protected].

On eu.photonfile.com, use “Privacy choices” in the footer to accept, reject, or withdraw advertising measurement.

9. Third-Party Services

We rely on limited providers for specific functions, including Stripe for payments; Cloudflare for CDN, WAF, security, and abuse prevention; and Google Ads and Reddit Ads for the single paid conversion measurement described above. Their policies apply to their services. We aim to choose providers that are aligned with a privacy-respecting, low-retention approach.

PhotonFile operates an EU region (Frankfurt, Germany) for EU users who create accounts to purchase File Passes. Account and billing records for EU accounts are processed and stored within the EU. File contents are not stored as hosted uploads as part of the transfer flow. See the Account Region Move guide for the documented workflow used to change an account's home region when supported by the product.

10. Updates

We may update this policy. Continued use after changes constitutes acceptance. The current version is posted at /privacy.

11. Contact

Email: [email protected]

12. GDPR

You can find GDPR-specific information here: GDPR.