1.The short version
PeerPie is a file-sharing service operated by PeerPie LTD (referred to here as “PeerPie”, “we”, or “us”), the data controller for the personal data described in this policy. To do our job, we have to hold your files for a little while and, if you sign in, connect them to your email. We don't sell your data, we don't look at what's in your files, and we don't keep them past their expiry. To improve the site, we measure basic traffic with Google Analytics, but only if you allow it in the cookie banner (see Analytics below).
The sections below spell out exactly what data we collect, why, where it lives, who we share it with, and how to get rid of it. If you have questions, email us.
2.What we collect
Email address, only if you verify your email (to unlock 3 GB uploads) or buy Pro tokens. The free anonymous tier doesn't require any personal info.
File details, filename, size, file type, when you uploaded it, and when the link expires. Needed to serve the file and delete it on time.
File contents, the actual bytes you upload, held until the link expires. Files travel from your browser straight to storage; our servers never see what's inside.
IP address and browser info, used to prevent abuse and enforce fair-use limits (one anonymous upload per device per day). We keep it briefly to enforce rate limits and log it if someone reports a link for abuse.
Session cookie, if you verify an email, we set one cookie so you stay signed in. It's a random ID, we can revoke it any time, and logging out clears it on our side too.
Payment info, handled entirely by our payment processor if you buy Pro tokens. We store the purchase amount, email, and the processor's reference, never your card number.
3.What we do NOT collect
Explicit list, because “implicit” is where privacy policies rot:
- No advertising cookies, no ad networks, no retargeting pixels.
- No Meta Pixel, no Segment, no marketing trackers.
- No cross-site or cross-device tracking.
- No demographic profiling or ad-targeting audiences (Google Signals stays off).
- No content inspection or automated scanning of your files.
- No automated decision-making that has a legal or similarly significant effect on you.
- No sharing or selling of your email to marketers, data brokers, or affiliates.
4.How we use what we collect
Every collected data point maps to one of:
- Delivering the service, storing, expiring, and serving your files.
- Authentication, verifying that you own the email address you claim to own.
- Payment, processing Pro token purchases through our payment processor.
- Operational email, expiry warnings (24 h before file / token expiry), verification codes, upload completion notifications, and a link sent to a recipient when you ask us to. No marketing email.
- Abuse prevention, enforcing rate limits, detecting and taking down illegal content on report.
5.Our legal basis for using it
Where data-protection law such as the GDPR applies to you, here is why we are allowed to process your data:
- To provide what you asked for, storing, serving, and expiring your files, and verifying your email, are necessary to deliver PeerPie to you.
- Our legitimate interests, keeping the service secure and reliable, enforcing fair-use limits, and preventing abuse.
- Your consent, where you choose to add a recipient's email so we send them a link, or otherwise opt in to something.
- Legal obligation, keeping payment records for tax and accounting.
6.How long we keep it
Retention is capped by tier, we don't hold files past their advertised expiry:
- Anonymous files, 12 hours from upload, then hard-deleted.
- Verified email files, 7 days from upload, then hard-deleted.
- Pro-token files, 30 days from upload (extendable in 30-day blocks by consuming another token), then hard-deleted.
- Verified account emails, kept while the account is active; ask us to delete and we delete.
- Payment records, transaction id + email + amount, kept 7 years for tax + accounting compliance.
- Server logs, request logs (path, status, latency, no request body) kept 30 days. Rate-limit counters live in memory only, reset on process restart.
Storage cleanup runs every 30 minutes and hard-deletes expired files from storage, not just soft-deleted in the database.
7.Where your data lives
PeerPie relies on a small set of specialist providers, each with a specific role:
- Cloud storage, where your uploaded files are held.
- A managed database, for account and file metadata (never file contents).
- Application hosting, which runs the service.
- A PCI-compliant payment processor, for one-time token purchases. Your card details go straight to them and never touch our servers.
- An email delivery service, for verification codes and notifications.
- A CDN and DDoS protection layer, which sits in front of the service.
All of these providers store data in the United States. If you are outside the US and this matters to you, please consider that data will be transferred to and stored in the United States.
8.When we share or disclose your data
We are not in the business of sharing your data, but there are a few specific situations where we do:
- Service providers, the vendors listed above process data on our behalf to run the service, and only for that purpose.
- Legal requests and law enforcement, we may disclose data where the law requires it, or in response to a valid legal request such as a subpoena, court order, or warrant. We review every request and provide only what we are legally obligated to.
- Safety and abuse, we may use or disclose data where we reasonably believe it is necessary to detect, prevent, or address fraud, security issues, abuse of the service, or illegal activity, or to protect the rights, property, or safety of PeerPie, our users, or the public.
- Business transfers, if PeerPie is ever part of a merger, acquisition, or sale of assets, your data may transfer as part of it. This policy keeps applying, or you will be told of any change.
We do not sell your data, and we never share it with advertisers or data brokers.
9.Abuse, illegal content, and reports
PeerPie is a tool for sending files, and we take misuse seriously.
- Reporting, every download page has a Report link, so anyone can flag a link they believe is being used for illegal or abusive content. You can also email [email protected].
- Review, reports go to a human queue. Our team reviews each one and, where a report is confirmed, takes the content down, usually within hours.
- What we act on, illegal content, malware, material that infringes copyright (including DMCA notices sent to [email protected]), and anything that breaks our Terms.
- Consequences, confirmed abuse means the file is removed and the link disabled. Repeat or serious violations can lead to a permanent account suspension and, where the law requires, a report to the relevant authorities.
- How we investigate, we do not scan or inspect files as a matter of routine. If a specific link is reported, an admin may need to open it to confirm the report before acting, and may review the file's metadata, the uploader's email (if verified), and the IP or device information logged at upload.
10.Cookies, analytics + local storage
We use browser storage sparingly and only for functional purposes:
- Cookies, one sign-in cookie if you verify an email, and one for our internal admin panel. If you accept analytics in the cookie banner, Google Analytics also sets its own cookies to measure traffic. Decline and they're never set.
- Browser storage, your verified email (so we can greet you next time), delete permissions for your own files, and small UI preferences.
- Upload progress, we save what you've already uploaded so a browser crash mid-upload doesn't force you to start over. Cleared when the upload finishes.
Analytics. To see how the site is used and make it better, we use Google Analytics 4. It measures aggregate traffic: which pages get visited, where visitors arrive from, and rough country-level location. It loads only if you accept analytics cookies in the banner; decline and nothing loads. We keep it minimal: no Google Ads, no Google Signals, no cross-site advertising, and we never sell the data. You can withdraw consent anytime from the cookie banner, or opt out globally with Google's browser add-on.
No advertising cookies, no ad-network trackers, no cross-site session sharing.
Analytics is opt-in: if you decline in the cookie banner, Google Analytics never loads and no analytics cookie is set. Since we don't run advertising or cross-site tracking, nothing else is following you around. You can change your analytics choice anytime from the cookie banner.
11.Security posture
- Everything travels over encrypted connections, no plaintext hops anywhere.
- Files upload straight from your browser to storage. Our servers never see the file contents.
- Optional share passwords are scrambled with a one-way function so we can never read them back.
- Sign-in is passwordless via email code. Sessions are server-side and revocable, logging out really logs you out.
- Every public endpoint has a rate limit. Admin access sits behind Cloudflare Access, a password, and optional two-factor.
- Every admin action is logged with who did what and when.
If something goes wrong. If we ever discover a breach that affects your personal data, we will investigate and contain it, then notify affected users and any authority the law requires without undue delay (and, where the GDPR applies, within its 72-hour window to the supervisory authority).
More detail in Docs.
12.Your rights
You have the right to:
- Access, request a copy of the personal data associated with your email.
- Deletion, request full deletion of your account + all uploaded files. We honor this within 7 days.
- Correction, ask us to correct any inaccurate personal data (typically only email address).
- Portability, receive your data in a structured, machine-readable format.
- Object or restrict, ask us to stop or limit certain processing of your data.
- Withdraw consent, where we rely on your consent, you can withdraw it at any time without affecting anything we did beforehand.
- Opt out of operational email, expiry warnings and verification codes can be turned off by disabling the associated feature (Pro tokens with warnings) or deleting your account.
- Complain, if you are in the EEA or the UK, you can lodge a complaint with your local data-protection authority. We would appreciate the chance to sort it out with you first.
Send any of the above to [email protected], one request, one human response, no ticket runaround.
13.California privacy rights
If you are a California resident, the CCPA gives you specific rights, and we honor them for everyone anyway:
- Know, what personal information we collect and why (spelled out above).
- Delete, request deletion of your account and files.
- No discrimination, we will not treat you differently for exercising any of these rights.
We do not sell or share your personal information as those terms are defined under California law, so there is no sale to opt out of. To make a request, email [email protected].
14.Children
You must be at least 13 to use PeerPie. PeerPie is not directed at children under 13, and we do not knowingly collect personal information from anyone under 13. If we learn we have, we delete it.
15.International transfers
PeerPie's servers, storage, and vendors are located in the United States, so using PeerPie involves transferring your data there. If you are in a region with data-transfer restrictions (such as the EEA or the UK), you are choosing to send your data to the US in order to use the service, and for the parts our vendors handle we rely on their data-processing terms and the safeguards they provide. We apply technical safeguards (encryption in transit and at rest, access controls) across every transfer path.
16.Changes to this policy
If we materially change how we handle your data (adding a new vendor category, extending retention, etc.) we'll update this page and email verified users at least 14 days before the change takes effect. Continued use after the effective date means acceptance. This page is versioned publicly.
17.Contact
PeerPie LTD is the data controller for the personal data described here. For privacy questions or data requests, email [email protected] or use the Contact page. We aim to respond within 3 business days.