Introduction
FileGrab is operated by QUJO Corporation ("QUJO", "we", "our", or "us"). We respect your privacy and are committed to protecting personal data. This policy explains what we collect, how we use it, when service providers process it, and the choices available to you.
Information We Collect
Account Information
When you create an account, we collect:
- Email address (for authentication and account recovery)
- Authentication provider and provider account identifier when you use Google, Apple, or Microsoft sign-in
- Profile information made available by an authentication provider, such as a display name or profile image; FileGrab currently retains the account email and provider identifier needed to maintain the login
- Mobile phone number (optional, for SMS notifications)
- Account creation date
- Subscription status (free or Pro)
Usage Data
We automatically collect:
- Anonymous unique visitor counts (hashed, not tied to your identity)
- Files uploaded (metadata only: name, size, type)
- Links created and accessed
- Storage usage statistics
- IP address, user agent, request path, timestamps, and related network or device data used for authentication, fraud prevention, abuse response, rate limiting, and infrastructure security
Link statistics do not expose raw IP addresses to link owners. FileGrab derives a one-way hash for unique-visitor counts. Raw IP addresses may still be processed or retained in authentication records, contact and abuse submissions, security events, and infrastructure logs.
Contact and Support Submissions
When you contact us through FileGrab forms or support channels, we collect:
- Name, email address, subject, and message content you submit
- Submission metadata such as IP address, user agent, referrer, origin, and Turnstile verification result
- FileGrab URLs included in the message so we can investigate reported abuse, support requests, and security issues
We use this information to respond to your request, investigate abuse reports, maintain moderation records, and protect FileGrab users.
Files You Upload
We store files you upload on Cloudflare R2 infrastructure. File content is processed as needed to provide the features you request and to protect the Service. Processing may include:
- Storage, delivery, previews, thumbnails, format conversion, and other requested media processing
- User-requested audio or video transcription
- Malware protection: Eligible executable files are automatically submitted for malware scanning; scanning cannot guarantee detection of every harmful file
- When required by law
- To investigate reported violations of our Terms of Service, including phishing, malware, impersonation, or abuse reports
How We Use Your Information
- To provide and maintain our file sharing service
- To authenticate your account via magic link emails
- To authenticate your account through Google, Apple, or Microsoft when you choose social sign-in
- To process payments (Pro subscriptions)
- To enforce our Terms of Service and prevent abuse
- To respond to legal requests and prevent harm
- To send service-related communications (email and, if opted in, SMS)
SMS/Text Messaging
If you provide your mobile phone number, we may send you SMS text messages for account notifications such as new file uploads or account activity alerts. Message frequency varies based on your account activity and notification preferences.
We will never share your mobile phone number with third parties for marketing or promotional purposes. Your phone number is used solely by FileGrab for service-related notifications that you have opted into.
You can opt out of SMS notifications at any time by updating your notification preferences in your account settings or by replying STOP to any message. Message and data rates may apply. For help, reply HELP or contact us at privacy@filegrab.link.
Data Storage and Security
Your files are stored on Cloudflare's global edge network with encryption at rest. We use industry-standard security measures including:
- HTTPS encryption for all data in transit
- Secure, httpOnly session cookies
- Rate limiting to prevent abuse
- Automatic file expiration and deletion
End-to-End Encryption (Pro)
Pro users can optionally create encrypted links where supported file content is encrypted in the browser before upload using AES-256-GCM. The encryption key is stored only in the URL fragment (after the #) which is never sent to our servers. This means:
- We cannot decrypt or access your encrypted files
- Only people with the complete link (including the key) can decrypt files
- If you lose the link, the files cannot be recovered
Data Retention
- Free tier files: Scheduled for deletion after the applicable 7-day link expires
- Pro tier files: Retained until manually deleted, the applicable link expires, or the account is deleted, subject to legal and safety retention needs
- Account data: Retained while your account is active
- Abuse review records: Held file metadata, reports, hashes, and evidence may be retained as needed to investigate abuse, enforce our Terms, protect users, and respond to legal requests
- Contact and support submissions: Retained as needed to respond to support requests, investigate abuse reports, maintain moderation records, and respond to legal requests
- Server logs: Retained for 30 days for security purposes
Account Deletion
You can permanently delete your account at any time from your account settings. When you request deletion:
- You'll receive a confirmation email (security measure)
- After confirming, you have 7 days to cancel the deletion by logging in
- After 7 days, active account content is scheduled for permanent deletion, including:
- Your account information
- All files you uploaded
- All links you created
- Your subscription (no prorated refund)
- Billing, security, abuse, legal, and backup records may be retained where required for legal obligations, dispute resolution, fraud prevention, safety, or system recovery
Your Rights (GDPR)
If you are in the European Economic Area, you have the right to:
- Access: Request a copy of your personal data
- Rectification: Request correction of inaccurate data
- Erasure: Request deletion of your data ("right to be forgotten")
- Portability: Request your data in a portable format
- Object: Object to certain processing of your data
To exercise these rights, contact us at privacy@filegrab.link
Third-Party Services
We use the following third-party services:
- Cloudflare: Infrastructure, CDN, and security
- PlanetScale: Account, link, form, activity, and moderation database hosting
- Google Analytics: Marketing-site usage analytics, including pages visited, session information, device data, general location, and IP processing by Google
- Resend: Email delivery for authentication
- Stripe: Payment processing (Pro subscriptions)
- Google, Apple, and Microsoft: Optional account authentication when you choose the corresponding sign-in method
Each service has its own privacy policy governing their use of your data.
Cookies
We use the following cookies:
- Session cookie: To keep you logged in
- Theme preference: To remember your light/dark mode choice
- Analytics cookies: Google Analytics uses cookies and similar identifiers to collect marketing-site usage data such as pages visited, session information, device data, and general geographic location. This helps us understand and improve the public website.
We do not use third-party advertising cookies.
Children's Privacy
FileGrab.Link is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13.
Changes to This Policy
We may update this privacy policy from time to time. We will notify you of significant changes by posting a notice on our website or sending you an email.
Contact Us
For privacy-related questions or concerns, contact us at:
privacy@filegrab.link
QUJO Corporation, operator of FileGrab