Privacy policy
The privacy policy is a plain read of what we store, what we don't, and how we respond to legal requests. No dark patterns, no buried clauses — just the receipts.
Dashboard data
The dashboard stores the minimum data required to operate an account and bill our services. Everything below is kept against your user record — nothing is broadcast anywhere else.
User accounts
Username, NID, hashed password, TOTP secret & state, aliased email, membership expiry, staff type, ban reason, reseller status & credits, file API key, storage limit & add-ons, max email aliases, linked Discord ID & username, onboarding flags, referral code, referred-by, referral balance, created at.
Invites
Code, used-by, created-for, purchased flag, created at.
Orders
ID, type (membership / invite / reseller credits / reseller invite / email aliases / storage), quantity, receive address, USD price, crypto currency & amount, payment method, notification email, invite code, referral code, expires-at, created-at, updated-at.
Admin logs
ID, admin ID & name, action, target, detail, created-at.
Recovery codes
User ID, code.
Referral earnings & payouts
Earning / payout ID, user ID, source user ID, type, amount, crypto currency & amount, destination address, status, transaction ID, timestamp.
Reseller history
Reseller ID, user ID, NID, amount, date.
Chat messages
Message ID, user ID, message content, premium & reseller flags, private-user ID, created-at.
Discord domains
Domain ID, user ID, code, created-at, updated-at.
Email service
Mail account handler
Mailbox
Email address, password, username, mail directory, quota, creation date, last update, active/enabled flag.
Aliases
Owner email, alias, created-at, modified-at, active/enabled flag.
Mail handler (transient)
Send / receive metadata
Date of the send or receive event — used for spam monitoring and scheduled for removal.
Message IDs
Incoming and outgoing message IDs — required for filtering and bounce handling.
Peer IP
IP of the server connecting to our mail daemon — required for anti-spam. This is the SMTP peer's address, not your personal IP.
File host
We store the metadata required to serve and moderate uploads. File bytes live in object storage and, when encryption is on, can't be read by us.
Files
File ID, owner ID, filename, encrypted flag, delete-after-view, MIME type, size, folder ID, report status, upload date.
File reports
Report ID, file ID, reason, report date.
Folders
Folder ID, owner ID, parent folder ID, name, public flag, share token, encrypted flag, key-recovery mode, created-at.
Folder reports
Report ID, folder ID, reason, decryption key (only if the reporter supplied a valid one), status (pending / approved / declined / confirmed), report date.
Folder shares
Share ID, folder ID, shared-with user ID, permission, created-at.
Biolink
The biolink only persists the configuration you set — nickname, theme, links, badges, friends, socials. No personal info beyond what you type into the customizer.
Legal requests
We require a signed subpoena from a UK court before we will consider any request. We verify authenticity and this takes time. Every lawful request will appear in our transparency register unless a court explicitly bars disclosure.
IP addresses, phone numbers, and third-party email addresses are not stored — they genuinely cannot be produced. Precise timestamps may be unavailable because of how the service is built.
DMCA complaints and platform abuse reports should go through the in-product report system, not this address. That path resolves faster and is logged correctly.
Data removal
You can request removal of any data listed above, subject to any active legal holds. Email us from the address on file and we'll confirm within seven days.