Policy · v1.0
Metadata Policy
Encryption protects file content. Metadata is everything around it — sizes, timestamps, IDs. We minimize what we collect, encrypt what we can, and tell you exactly what remains.
Operating principle
We collect the minimum metadata needed to operate the service safely (deliver files, enforce quotas, detect abuse, comply with legal obligations). When a field can be encrypted client-side without breaking that, we encrypt it. When it must remain in the clear for the system to function, we keep it as opaque as possible.
The full list
What we never store
- Your password, in any form.
- Your master key or any unwrapped file key.
- Plaintext file content, including Rooms messages, attachments, Notes, Docs, Flowboard, Calendar, and Tasks.
- Decrypted file names, ever.
- Decrypted API or webhook payload bodies — only metadata and lifecycle events are exposed.
- Anonymous-viewer IP addresses (only short-lived SHA-256 hashes for rate limiting).
- Behavioral telemetry on what you store, view, or share.
Size is metadata too
Encryption hides what a message says, not how long it is — and an exact byte count is a surprisingly good fingerprint. A one-word reply, a pasted contract, a specific document sent to several people: all of them are identifiable by length alone, without decrypting anything. Most encrypted products simply accept this leak.
We do not. Message content is padded into size buckets before it is encrypted and stored, so what we hold reveals a range rather than a precise length, and many different messages become indistinguishable from one another. The padding is inside the encryption, so it costs you nothing in privacy and only a small percentage in storage.
File sizes are approximate rather than hidden: a large video cannot be padded into looking like a small one without wasting your quota. Timing — when something was written — is also inherent to running a live service. We would rather state those limits plainly than let a padding claim imply more than it delivers.
Retention defaults
We update this page whenever we change what we collect. See the security changelog for diffs.