Privacy Policy

Our Service allows users to upload files, generate download links, send download links by email, restrict access to specified recipients, and optionally protect transfers with passwords.

By using the Service, you acknowledge the data practices described in this Privacy Policy. If you do not agree with this Privacy Policy, please do not use the Service.

1. Information We Collect

We collect only the information reasonably necessary to provide, secure, maintain, troubleshoot, and improve the Service.

1.1 Transfer Data

When you create, upload, send, receive, or access a file transfer, we may collect and process the following information:

• Uploaded files: The files, images, documents, archives, or other data that you choose to upload to the Service.
• File metadata: Information such as the file name, file size, file type, and MIME type.
• Transfer information: Transfer identifiers, download links, transfer creation time, expiration time, transfer size, file count, transfer status, and related technical information required to operate the Service.
• Recipient email addresses: Email addresses are collected only when you choose an email delivery feature or a restricted-access feature that requires recipient email addresses. These addresses are used to provide the requested transfer functionality, including sending or controlling access to download links.
• Transfer passwords: If you enable password protection, the password is processed to create a cryptographic hash before storage. We do not store the transfer password in readable plaintext form. Our staff cannot view or recover the original password from the stored hash.

File Content Privacy: We do not routinely read, inspect, scan, analyze, or access the contents of uploaded files. File contents may be accessed only when reasonably necessary to investigate a valid abuse report, comply with applicable law, respond to a lawful request, protect the security or integrity of the Service, or address an immediate threat to users or others.

2. Usage and Technical Data

When you access or use the Service, we may automatically collect technical and usage information, including:

• IP address;
• Browser type and browser version;
• Device type;
• Operating system or similar device information, where available;
• Pages visited;
• Request and activity timestamps;
• Error logs and diagnostic information;
• Security, rate-limiting, and abuse-prevention information; and
• Other technical information necessary to operate and secure the Service.

We use this information for security monitoring, abuse prevention, troubleshooting, fraud prevention, rate limiting, service operation, and maintaining the reliability of the Service.

3. Analytics Event Data

We collect limited first-party analytics and operational event data to understand whether file transfers are working correctly and to diagnose technical issues.

This information may include:

• Upload lifecycle events: Whether an upload was started, cancelled, failed, or completed.
• Download events: The download method used, such as downloading a single file, downloading a ZIP archive, or using a direct link, together with the total number of files and total transfer size associated with the transfer accessed.
• Network connectivity events: Information indicating when a network connection is lost or restored during an active upload, together with the upload progress at that time.
• Operational information: Error events, performance information, and technical events necessary to diagnose and improve upload and download reliability.

We do not use this analytics event data for third-party advertising or cross-site tracking.

4. Communications

If you contact us through our contact form, support email address, or another support channel, we may collect the information you provide, including:

• Your name, if provided;
• Your email address;
• The content of your message;
• Attachments or screenshots you voluntarily provide; and
• Other information you choose to include in your communication.

We use this information to respond to your request, investigate reported problems, provide customer support, and protect the Service from misuse.

5. How We Use Your Information

We use information collected through the Service for the following purposes:

• Transfer data: To store uploaded files temporarily, create and manage transfers, generate download links, allow recipients to access files, enforce transfer restrictions, and provide other requested transfer functionality.
• Recipient email addresses: To send requested transfer notifications and download links and, where applicable, to enforce restricted-access functionality.
• Technical and usage data: To operate the Service, prevent abuse, detect suspicious activity, enforce rate limits, investigate security incidents, troubleshoot problems, and maintain Service reliability.
• Analytics event data: To monitor upload and download performance, understand failures, diagnose network-related problems, improve reliability, and fix technical issues.
• Communications: To respond to inquiries, support requests, complaints, and abuse reports.
• Legal and security purposes: To comply with applicable law, respond to valid legal requests, enforce our terms and policies, protect our rights and users, and prevent fraud, abuse, or security threats.

6. File Storage, Expiration, and Retention

Uploaded files are temporarily stored on servers and storage infrastructure used to provide the Service.

Each transfer has an expiration period. After the transfer expires, uploaded files are scheduled for automatic deletion and are deleted within 24 hours after the applicable expiration period ends.

Related transfer information, including stored password hashes, is deleted or anonymized according to our applicable retention schedule when the transfer expires or is deleted, except where temporary retention is reasonably necessary for security, fraud prevention, abuse investigations, backup rotation, dispute resolution, or compliance with applicable law.

Files may be deleted earlier when a user deletes a transfer, when deletion is necessary to enforce our policies, when we receive a valid legal request, or when continued storage could create a security or legal risk.

Because deletion processes, distributed storage systems, and backup systems may operate asynchronously, residual copies may remain temporarily in backups or system logs until they are overwritten or deleted according to our normal retention cycles.

7. File Content Access and Abuse Investigations

We do not routinely monitor, inspect, or scan uploaded file contents.

We may access, preserve, review, or disclose uploaded files or related transfer information when reasonably necessary to:

• Investigate a valid abuse, malware, fraud, or security report;
• Enforce our Terms of Service or other applicable policies;
• Protect the rights, safety, and security of our users, the public, or the Service;
• Respond to a valid legal process or lawful government request; or
• Comply with applicable legal obligations.

8. Session Identifier and Browser Local Storage

The Service generates a random UUID and stores it in your browser's local storage under the key uploadwings_session_id.

This identifier is used to group operational and analytics events generated by the same browser or Service session. It helps us understand transfer reliability and diagnose technical issues.

The identifier is not intended to directly identify you and is not linked to a registered user account.

You can remove this identifier at any time by clearing your browser's local storage or website data. Clearing the identifier may cause the Service to generate a new random identifier when you use the Service again.

9. Password-Protected Transfers

When you enable password protection for a transfer:

• The transfer password is processed using a cryptographic password-hashing method before storage;
• The original password is not stored in readable plaintext form;
• Our staff cannot retrieve or recover the original password from the stored hash;
• The password hash is used only to verify attempts to access the protected transfer; and
• The stored password hash is deleted according to the retention schedule applicable to the transfer.

Users are responsible for sharing transfer passwords securely with intended recipients. We cannot recover forgotten transfer passwords.

10. Cookies and Similar Technologies

UploadWings uses the following cookies and similar browser technologies:

• Analytics cookies (Google Analytics 4): We use Google Analytics 4 to understand how visitors use the site — pages visited, session duration, and device type. These cookies are only set after you give your consent via the cookie banner shown on your first visit. You may decline at any time; if declined, Google Analytics will not run.
• Consent cookie: We store your cookie preference in a browser cookie so we remember your choice. This cookie expires after a short period, after which we will ask again.

We do not use third-party advertising cookies or cookies for cross-site behavioral advertising.

11. Third-Party Service Providers

We use third-party service providers to operate and maintain parts of the Service. These providers may process information on our behalf only to the extent necessary to provide their services.

Our infrastructure providers include Cloudflare R2, which we use for object storage and related infrastructure services.

We require service providers that process personal information on our behalf to protect that information and process it in accordance with applicable contractual obligations, our instructions, and applicable law.

We do not sell uploaded files, recipient email addresses, or personal information to third parties.

12. When We May Share or Disclose Information

We may share or disclose information in the following circumstances:

• Service providers: With infrastructure, hosting, storage, email, security, and other vendors that process information on our behalf.
• Legal obligations: When disclosure is required to comply with applicable law, regulation, court order, subpoena, or another valid legal process.
• Security and protection: When reasonably necessary to investigate fraud, abuse, malware, security incidents, threats, or violations of our policies.
• Business transactions: In connection with a merger, acquisition, financing, restructuring, bankruptcy, or sale of all or part of our business or assets, subject to applicable legal requirements.
• With your direction or consent: When you ask us to share information or otherwise authorize the disclosure.

13. International Data Transfers

Our Service and service providers may process or store information in countries other than the country where you live.

Where required by applicable data protection law, we use appropriate safeguards for international transfers of personal information.

14. Your Privacy Rights

Depending on where you live and applicable law, you may have rights concerning your personal information, including the right to:

• Request access to personal information we hold about you;
• Request correction of inaccurate or incomplete personal information;
• Request deletion of certain personal information;
• Object to or request restriction of certain processing activities;
• Request portability of certain personal information;
• Withdraw consent where processing is based on consent;
• Lodge a complaint with an applicable data protection authority; and
• Exercise other rights available under applicable privacy law.

To submit a privacy request, contact us using the information provided in the “Contact Us” section below.

We may need to verify your identity and your relationship to the relevant transfer before fulfilling certain requests. Because the Service may not require users to create accounts, there may be circumstances where we cannot identify or locate information associated with a particular person without sufficient transfer information.

15. Children's Privacy

The Service is not directed to children under the minimum age required to consent to the processing of personal information in their jurisdiction.

We do not knowingly collect personal information from children in violation of applicable law. If you believe that a child has provided personal information to us unlawfully, please contact us so that we can investigate and take appropriate action.

16. User Responsibilities

Users are responsible for ensuring that they have the necessary rights, permissions, and lawful basis to upload, transfer, and share files and personal information through the Service.

You should not upload or distribute content that is unlawful, infringes the rights of others, contains malicious software, or violates our Terms of Service or applicable law.

If you provide a recipient's email address or other personal information, you are responsible for ensuring that you are permitted to provide that information to us for the requested transfer.

17. Do Not Sell or Share Personal Information for Advertising

We do not sell personal information.

We do not share personal information with third parties for cross-context behavioural advertising or use uploaded files, recipient email addresses, or transfer activity for targeted advertising.

18. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to the Service, our data practices, legal requirements, or security practices.

When we update this Privacy Policy, we will revise the “Last Updated” date at the top of this page. Where required by applicable law, we will provide additional notice of material changes.

We encourage you to review this Privacy Policy periodically.

19. Contact Us

If you have questions, concerns, complaints, abuse reports, or requests regarding this Privacy Policy or our privacy practices, you can contact us at:

20. Governing Privacy Laws

This Privacy Policy is intended to describe our privacy practices transparently and should be interpreted in accordance with the data protection and privacy laws applicable to the operation of the Service and the individuals who use it.

Nothing in this Privacy Policy limits any rights that cannot be waived or restricted under applicable law.