Privacy Policy

Secure Channel lets you create private channels so partners can upload documents to you. We collect only what is needed to run the service: your account details, the files your partners upload, and technical audit records. Content is encrypted at rest, and file content is inspected for malware before storage. We do not sell your data, and we do not use it for advertising.

Account information. When you create an account we store your email address, a salted hash of your password (we never store the password itself), and — if you add them — a Google account identifier (when you sign in with Google) and passkey credentials (when you add a passkey).

Channel and submission data. For each channel you create we store its name, description, and settings. When a partner submits items we store file names, sizes, MIME types, a SHA-256 content hash, malware-scan results, and the encrypted file content itself.

Technical and audit data. We log actions such as logins, uploads, downloads, and token use, together with IP addresses, timestamps, and user-agent strings. These audit records help you investigate what happened to a channel and help us detect abuse. They are retained for a limited period.

Google sign-in. When you sign in with Google, Google sends us your verified email address and a stable account identifier. We use it to identify your account. We do not store Google passwords or other Google account details.

Files submitted through a channel are decrypted on our server, scanned with ClamAV antivirus software, and re-encrypted before being stored. Text items are scanned and stored encrypted. Items found to contain malware are not stored.

We can read your content in order to provide the service (scanning, delivery, and support). We do not review the contents of submissions for our own purposes, except to operate the service, respond to support requests, detect abuse or security incidents, or comply with law.

Partner upload flows additionally use an ephemeral key exchange so that items in transit between the partner's browser and our server are protected on top of TLS.

Traffic arrives over TLS (with post-quantum-hybrid key exchange where your browser supports it). Stored file content and text items are encrypted with AES-256 using keys held in a protected server environment. Login passwords are stored only as salted scrypt hashes. Access to systems and keys is restricted, and privileged operations are logged.

We use a small number of trusted providers, each with its own privacy policy:

• Google Cloud (Platform) — object storage for encrypted files and the Google sign-in service.
• Cloudflare — delivery, DDoS protection, and the secure tunnel to our servers. Cloudflare sees traffic metadata (IP, hostname) but not decrypted content.
• Email provider — sending verification and notification email on your behalf.

We share content only with the channel owner and the partners you have invited through channel access links. We share data with the third parties listed above to operate the service. We may disclose information if required by law, a court order, or to prevent harm.

Account data is kept while your account is active. You can log out, and access links can be revoked by the channel owner at any time. To delete your account and its associated channels, contact us at the address below. Legal and audit records may be kept longer where required.

You may request access to, correction of, or deletion of your personal data at any time. If you signed up with Google, you can disconnect it by deleting your account with us. Children under 13 should not use this service.

Privacy questions: [email protected]

This summary is provided in good faith; in the event of conflict with a signed agreement you have with us, the signed agreement governs.