What I collect and why

• Account. When you sign in with Discord I receive your Discord user ID, username and avatar, nothing else. I also store your display name, the invite code you used, who invited you, when you registered and your upload token. Needed to provide your account (contract).
• Email. Optional, but needed for a supporter plan. It's only used for verification, important messages about your account and plan, and the email notifications you turn on. You can change it in your settings (contract, and consent for optional notifications).
• Profile. Anything you add to your public profile, such as a bio or links, and your privacy settings for it (contract).
• Your files. The files you upload with their names, sizes, types, dimensions, video length, upload times and the folders and albums you organise them in (contract). Before a photo or video leaves your device, I remove its location (GPS) tags, though telemetry that some action cameras record in their own format stays as recorded. Photos also lose their other camera metadata, such as device details, camera settings, captions and any preview image stored inside that metadata, but keep their orientation so they display the right way up. Videos only lose their location tags and keep their other details, such as the recording device and date. This covers JPEG, PNG, WebP, HEIC and AVIF photos and MP4 and MOV videos. If a file can't be cleaned, the upload shows a warning and the file is uploaded as it is. JPEG, PNG and WebP images sent through ShareX are cleaned when they arrive, and turned away if that isn't possible.
• View and download counts. When someone opens an image or file page, starts playing a video, or downloads a file with one of the site's download buttons, a keyed hash of their IP address is saved with that view or download, only so each visitor is counted once. The hash is different for every file and for views and downloads, and can't be turned back into the address. Your own visits to and downloads of your files while you're signed in, and requests that look like bots or link previews, aren't counted. Older view records were anonymised (legitimate interest in accurate counts).
• Supporter plans. Your Polar customer and subscription IDs, plan size, billing interval, status and renewal dates. Polar handles the payment itself, so I never see your card details. I can see the name and email you give Polar in its dashboard (contract).
• Notifications. The notifications you get and your settings for them. Security notices about a new sign-in include the browser, operating system, approximate location (city and country, worked out from your IP address) and time, but not the IP address itself. When your email changes, the previous address gets a short notice too. Security, plan and service notices can't be turned off (legitimate interest in keeping your account secure and informed).
• Technical data. Server logs and short-lived rate limit records with your IP address, browser details or user ID, to keep the service running and secure (legitimate interest).
• Error reports. When something breaks, an error report with technical details like your browser and the page you were on is sent to Sentry, without your IP address or account details. For a sample of visits where an error happens, Sentry also records a replay of the page interaction with all text, inputs and media masked, to help me reproduce bugs (legitimate interest).
• Analytics. Vercel Web Analytics and Speed Insights count page views and measure loading speed without cookies or tracking you across sites (legitimate interest).

What is public

Every file you upload can be opened by anyone with its link, and albums you make public can be browsed. Your profile page shows your display name, avatar, bio, links, Discord username and upload stats. You can hide your profile or your Discord username in your profile settings.

Cookies and local storage

The only cookies are the ones that keep you signed in and protect forms, which the service can't work without. Your browser also stores preferences like sort order and view mode, and which notices you dismissed. There are no advertising or tracking cookies, which is why there's no cookie banner.

Services that process data for me

• Vercel: hosting and analytics.
• Neon: the database, in Frankfurt, Germany.
• Amazon Web Services: file storage, in Stockholm, Sweden.
• Cloudflare: delivering and resizing files.
• Upstash: short-lived rate limit and upload records.
• Discord: sign in and keeping avatars up to date.
• Resend: sending emails.
• Sentry: error reports and masked replays, in Germany.
• Polar: payments for supporter plans. As the merchant of record, Polar is responsible for the payment data it collects, see polar.sh.

Some of these companies are based in the United States. Transfers there rely on the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.

How long data is kept

• Account and profile data: until you ask me to delete your account.
• Files: until you delete them or your account. View and download records are deleted together with their file.
• Notifications: read ones after 90 days, all of them after a year.
• Logs, rate limit records and error reports: a limited time, from minutes for rate limits up to about 90 days for logs and error reports.
• Supporter plan records: as long as your account exists. Polar keeps payment and tax records as long as the law requires.
• Deleted data can stay in database backups for a short time before it's gone for good.

Your rights

You can ask for a copy of your data, have it corrected or deleted, restrict or object to how it's used, take it with you, and withdraw consent you gave. You can delete your files yourself at any time in Your Files. For anything else, I'll respond within a month to requests sent to contact@dyl.blue. You can also complain to the Dutch data protection authority, Autoriteit Persoonsgegevens, or the one where you live.

Children

The service is not meant for anyone under 16.

Changes

If this policy changes in a way that matters, I'll let you know in the app or by email before it applies. The rules for using the service are in the terms of service.