Privacy Policy
This policy explains what [LEGAL ENTITY NAME] ("we") collects when you use HashBin.org and 256t.us, why, and who can see it. We collect as little as we can: we don't run advertising or behavioral analytics, and we don't sell personal data.
1. Content you upload is public
Anything you upload can be downloaded by anyone who has its content identifier (CID). We don't publish a list of stored content, but CIDs are shared freely and can't be revoked. Don't upload personal information you don't want to be public.
2. What we collect
| Data | Why | How long |
|---|---|---|
| Account identity: an account ID from our authentication provider and the sign-in methods you link (Google, Apple, Microsoft, GitHub). Your email and profile details are held by the authentication provider. | To sign you in and secure your account | Until you delete your account; afterward a deleted-account marker is kept so payment records stay attributable |
| Balance and transactions: deposits, uploads, extensions, rate-limit purchases, donations, deletions | To provide the paid service and keep financial records | Kept after account deletion, for accounting and legal obligations |
| Uploads: CID, size, content type, upload and expiration times, download count, and which account uploaded it | To store, serve, bill for, and expire content | Until the content is deleted; your upload list is cleared when you delete your account |
| API keys and authorized apps: a hash of each key (never the key itself), its name, what it may do (scopes and limits), usage counts, last use; apps you authorized, the access you granted them and their spending limits | To authenticate API use and enforce limits you set | Revoked keys are kept for up to 5 years as a security audit trail |
| Reports you file: the CID, reason, your explanation and links (public); your contact email or URL (not public, see Section 3); a one-way hash of your IP address | To review reports and prevent abuse | Kept indefinitely as part of the public dispute record |
| IP addresses | Processed transiently for rate limiting and abuse prevention. Stored only as a one-way hash with reports. | Not stored in identifiable form by us; see Cloudflare below |
We don't collect payment card details; Stripe processes payments and gives us only the result and a transaction reference.
3. Who can see what
- Everyone can see stored content (by CID), public deletion records (CID, time, reason, size, content type, and a one-way hash of the uploader's account ID), and reports (CID, reason, explanation, links, status, and resolution).
- Reporter contact details are visible to administrators and to signed-in HashBin users, not to anonymous visitors.
- Administrators can see account, transaction, and report data to operate the Service and resolve disputes.
- We disclose data when the law requires it, for example in response to a valid court order, and to report child sexual abuse material to the relevant authorities.
4. Service providers
- Cloudflare hosts the Service and stores content and data (Workers, Durable Objects, R2). Cloudflare processes request data, including IP addresses, to deliver and protect the Service.
- Clerk provides sign-in and holds your email and linked sign-in accounts.
- Stripe processes payments.
These providers process data on our behalf under their own security and privacy terms. Data may be processed in the United States and other countries where they operate.
5. Cookies and local storage
We use only what's needed to keep you signed in: cookies and browser storage set by our authentication provider. We don't use advertising or analytics cookies. Content served from 256t.us never sets cookies.
6. Backups
Account, transaction, and content records are backed up nightly. Backups are kept for 30 days, so deleted data can persist in backups for up to 30 days.
7. Your choices and rights
- You can delete content you uploaded, revoke API keys and authorized apps, and delete your account from your account page.
- Depending on where you live (for example under the GDPR or CCPA), you may have the right to access, correct, delete, or export your personal data, and to object to or restrict processing. Email [PRIVACY EMAIL] to make a request. Records we must keep for legal or financial reasons, public dispute and deletion records, and content others hold copies of may be exempt.
- [IF APPLICABLE: name of EU/UK representative, and the right to complain to a supervisory authority.]
8. Children
The Service is not directed to children under [AGE, e.g. 13 / 16], and we don't knowingly collect their personal data.
9. Changes
We'll post any changes here with a new "Last updated" date, and give notice on the site for material changes.
10. Contact
[LEGAL ENTITY NAME], [POSTAL ADDRESS]. Privacy questions: [PRIVACY EMAIL].