Privacy Policy

1. Who we are

FileFish is operated by Squared Lemon, registered in the Netherlands. We are the data controller for the personal data described in this policy.

2. What we collect

FileFish collects the minimum data needed to run the service:

• Sender details. When you email a file to bucket@file.fish, we receive your email address, the name shown in your From: header, the email subject and body, and the technical metadata included in the inbound email payload.
• Files. The attachments you send to FileFish, stored for the lifetime of the access code plus a short post-expiry window. Section 7 covers the timing.
• Access code activity. The 5-digit codes we generate, when each code expires, and when each file is downloaded.

Senders and recipients do not need an account. FileFish does not ask you for a password.

3. How we use your data

We use your data to:

• deliver your file to the person who enters the access code
• email you the access code, and warn you when a code is about to expire
• operate, monitor, and improve the service

We do not sell, rent, or share your personal data with third parties for marketing purposes. We do not read your files, and we do not use your files for anything other than delivering them via the access code.

4. Cookies and analytics

FileFish does not use cookies for analytics or advertising. We do not track you across other websites.

The only cookies set by FileFish are strictly functional session cookies (filefish_session and XSRF-TOKEN). These are required for the site to work and are not used for tracking.

We use Fathom Analytics for anonymous, aggregate website statistics. Fathom does not use cookies, does not collect personal data, and is fully GDPR-compliant. No cookie banner is required.

Disclosure: the Fathom link above is a referral link. If you sign up after clicking it, we receive a small discount on our own Fathom plan. It does not change the price you pay.

5. Third-party services

FileFish uses the following services to operate:

• Mailgun. Inbound and outbound email delivery. Mailgun processes the emails you send to bucket@file.fish and the emails we send to you, under their own privacy policy.
• Fathom Analytics. Cookieless website analytics. No personal data is collected or shared.
• EU cloud storage. Your files are stored on EU-based cloud infrastructure for the lifetime of the access code.

Each service operates under its own privacy policy. We select services that align with EU data protection standards.

6. Where your data is stored

Your files are stored on infrastructure in the European Union. FileFish itself runs on EU-based servers. Database records (sender details, message metadata, access codes) live on the same EU infrastructure.

Limited operational metadata may transit through non-EU infrastructure operated by our email provider. These transfers are covered by Standard Contractual Clauses and other appropriate safeguards under GDPR Article 46.

7. How long we keep your data

Files. Access codes expire one hour after we generate them. File binaries are deleted from storage within roughly one hour after code expiry. The post-expiry window is intentional: it lets senders postpone expiry from a one-time signed link we email shortly before the code expires. If a sender postpones, the file persists for the extended validity period plus the same post-expiry deletion window.

Sender records. Your email address and the name from your From: header are kept while you remain active. If twelve months pass without you sending a new message, we anonymize these fields. The email subject and body, and the raw inbound email payload, are cleared within roughly 48 hours after the access code expires. You can request earlier deletion at any time (see "Your rights" below).

Access code and download activity. Records of which codes were generated and when files were downloaded are kept for operational and abuse-detection purposes.

8. Your rights

Under GDPR, you have the right to:

• access the personal data we hold about you
• correct inaccurate data
• request deletion of your data
• export your data in a portable format
• object to or restrict certain processing
• lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens)

To exercise any of these rights, email us at squeeze@squaredlemon.com. We will respond within 30 days.

9. Changes to this policy

We may update this policy from time to time. The "last updated" date at the top reflects the most recent revision.

10. Contact

Privacy questions? Reach us at squeeze@squaredlemon.com.