Privacy policy
What Snapfile knows about you, and for how long
In short
- No accounts, no email addresses, no tracking, no cookies.
- Your file is deleted within minutes of being downloaded, or after 24 hours if nobody fetches it.
- We keep a salted hash of your IP address for about an hour, only to limit how many files one connection can upload.
- Everything is hosted in Norway. Nothing is shared with, or sold to, anyone.
Who is responsible
Snapfile is a privately run, open-source service. The person who maintains the Snapfile project on GitHub operates this instance and is the data controller for the processing described here. The service runs on privately hosted servers located in Norway and is governed by Norwegian law, including the Personal Data Act and the EU General Data Protection Regulation (GDPR).
Snapfile is sponsored by ArktIQ IT AS. The sponsor does not host the service, does not operate the servers and has no access to any uploaded file or other data.
Questions about privacy, or requests concerning your data, can be raised by opening a ticket in the GitHub repository. Please do not include personal details or file contents in a ticket, since tickets are public.
What we process
The file you upload
The file is stored on the server until it is downloaded once, or until it expires 24 hours after upload, whichever comes first. It is then deleted within minutes. A background job runs every 5 minutes to remove anything that has expired. We do not open, scan, index or analyse the contents of your files, and the file name is shown only to whoever holds the download link.
Traffic between your browser and this site is encrypted (HTTPS). There is one deliberate exception: the download page also offers a direct IP download for recipients who are on the same local network as the server. That link points at the server's internal address over plain HTTP, because a private network address cannot carry a public certificate. The traffic never leaves that local network, but it is not encrypted, so use the ordinary link whenever you are anywhere else.
The download link contains a random code that cannot be guessed. Anyone who has the link can download the file once, so treat the link like the file itself.
A hash of your IP address
To stop a single connection from flooding the service, we count uploads per IP address. We never store the address itself. Instead we store a salted SHA-256 hash of it, together with a counter and a timestamp. The salt is a random secret that exists only on this server, which means the hash cannot be reversed by simply trying every possible address. The record is deleted about an hour after your last upload. It is not linked to any file.
Technical server logs
Like every web server, ours writes an access log line for each request: the requesting IP address, the time, the request method and path, the response status, the referring page if your browser sends one, and the browser's identification string. Download codes are removed from the logged path before the line is written, so a log entry cannot be tied to a particular file or download. The logs are kept for security and abuse prevention only and are not combined with any other data.
Nothing else
There are no user accounts, and we never ask for your name or email address.
We count visits with anonymised web analytics, loaded from plausible.remim.com. It uses no cookies, stores nothing in your browser, does not record your IP address in a form that can identify you, and cannot follow you to other sites. It tells us how many people use Snapfile and which pages they view, nothing about who they are. See the cookie policy.
Fonts and all other assets are served from our own server.
Why we are allowed to do this
Storing your file is necessary to provide the service you asked for (GDPR article 6(1)(b)). Counting uploads per hashed address, keeping server logs and measuring anonymised usage is our legitimate interest in keeping a free service available and secure (article 6(1)(f)). We process nothing beyond that.
Who receives your data
Nobody. We do not share, sell or transfer any data to third parties, including the sponsor, and no data leaves Norway. The only exception is a legal obligation, such as a valid order from a Norwegian court, in which case we could hand over only what we still hold at that moment, which is usually nothing.
How long we keep things
| Data | Kept until |
|---|---|
| Uploaded file and its name | Minutes after the first download, or 24 h after upload |
| Salted hash of your IP address, upload counter | About an hour after your last upload |
| Server access logs (without download codes) | Kept for security and abuse prevention |
| Theme preference | Only in your own browser, until you clear it (see the cookie policy) |
Your rights
Under the GDPR you have the right to access, correct, delete and restrict the processing of your personal data, and to object to it. Because we hold no identity and only a salted hash of an address, we are normally unable to tell which data, if any, belongs to you. You can delete a file yourself at any time by downloading it, or simply by letting the link expire. You also have the right to complain to the Norwegian Data Protection Authority, Datatilsynet.
Changes
If this policy changes, the new version is published here with a new date. The service is open source, so you can also verify what it does rather than take our word for it.