Privacy policy

Data controller

Hopfile, a service published by Koruma Studio (Kevin Ragonneau EI), 38, rue des Mathurins, 75008 Paris, France.

For any question about your data: contact@gethopfile.com.

Our two roles

• For your account, support and visits to the Hopfile website, Hopfile is the data controller.
• For the files you send or receive, your recipients' addresses, the statistics of your transfers and the notifications you set up, you are the data controller. Hopfile processes this data on your behalf, as a processor, only to provide the service.

Data processed and purposes

Your account

Email address, name, password (stored hashed, never in plain text), language, time zone and preferences. If you sign in with Google or Apple, we receive your name and email address from that service. With Apple, this may be a relay address if you choose to hide yours: our emails then reach you through Apple. This data is used to create and manage your account (performance of the contract).

Account security

A sign-in log (IP address, browser, system, device type) helps detect suspicious access. It is kept for 90 days (legitimate interest: security of the service).

Your transfers

The files you send, their name and size, as well as the title, message and settings of the transfer (password, expiry date). They are only used to make your files available to the people you give the link to. We do not open your files, except to handle a report or at the request of an authority.

No artificial intelligence tool accesses your files: we do not analyze them, we do not hand them to any artificial intelligence service and they are never used to train any model.

Without an account, a fingerprint of your IP address is stored with the transfer, so you can find and manage it right after sending.

If you send a transfer by email, your recipient's address is stored with the transfer. We send them a single email, with your name, your message and the download link. We do not add it to any list and send them nothing else.

File requests

When you create a file request, the people you give the link to drop their files there without creating an account. We store the dropped files, a fingerprint of the uploader's IP address (so they can manage their upload right after sending) and the same statistics as for downloads, described below.

Notifications

If you turn on notifications, we send a message for each visit or download of your transfer, to the services you choose: your email address, Slack, Discord, Microsoft Teams, Telegram or the web address (webhook) you provide. This message contains the name and link of the transfer, along with the visitor's country, city, device and browser. You can delete a notification at any time from your account.

Support

Messages sent through the contact form are used to answer your requests and to handle reports.

Emails

We send you the emails required for the service to work: sign-up, account security and important information about the service (incident, changes to the terms). They are sent as long as your account exists. On top of these come the emails you ask for: your notifications, and the transfers you send by email to your recipients.

Transfer statistics (on behalf of users)

For each visit to a download or drop page, each download and each drop, we record: country, region, city and time zone (derived from the IP address using a geolocation database installed on our servers), browser, system, device type, language, referring website and UTM parameters. The IP address is not stored. A 24-hour cookie is used to count unique visitors. These statistics are kept as long as the transfer is online, and deleted with it.

Recipients

Your data is never sold. It is accessible to Hopfile and, where relevant, to our providers:

• OVH SAS (France): hosting of the website and data;
• Cloudflare, Inc. (storage located in the European Union): storage of the transferred files and making them available to the people who have the link, and bot protection (Turnstile) on the sign-up, sign-in and contact forms;
• Resend, Inc. (sending from the European Union): sending of the service's emails;
• Google Ireland Limited (Ireland): sign-in with Google, if you choose this option;
• Apple Distribution International Ltd. (Ireland): sign-in with Apple, if you choose this option;
• the services you connect yourself for your notifications (Slack, Discord, Microsoft Teams, Telegram or your webhook address): they only receive the content of the notifications you turned on, and process it under their own terms.

We may disclose data to authorities when required by law.

Transfers outside the European Union

Your files are stored, and our emails sent, from the European Union. As Cloudflare and Resend are American companies, their teams may access this data from the United States to run the service. This access is covered by the safeguards provided by the GDPR (EU–US Data Privacy Framework or standard contractual clauses).

Google and Apple may transfer data to the United States. These transfers are covered by the safeguards provided by the GDPR, such as the EU–US Data Privacy Framework or the European Commission's standard contractual clauses.

The messaging services you choose for your notifications (Slack, Discord, Microsoft Teams, Telegram) may also process these messages outside the European Union. You decide to use them: check their terms before connecting them.

Retention periods

• Files: until the expiry date of the transfer (7 days without an account, 15 days with a free account, unless the sender chose a shorter date), then deleted automatically. The sender can delete them earlier. To save time, files start uploading as soon as they are chosen: if they end up attached to no transfer, they are erased within 12 hours.
• File requests: until the end date of the request (15 days at most with a free account). The request and the dropped files are then deleted automatically.
• Email recipient's address: deleted with the transfer.
• Account: as long as it is open. You can delete it at any time from your account settings: its data and transfers are then deleted.
• Sign-in log: 90 days.
• Transfer statistics: as long as the transfer is online; they are deleted with it. No detailed statistics are kept for transfers sent without an account.

Cookies

Hopfile uses cookies that are required for the service to work:

• session: keeps you signed in while browsing;
• user_id, token_code, user_password_hash: "Remember me" option, 30 days;
• set_language: chosen language;
• transfer_password_…, transfer_request_password_…: remembers access to a password-protected transfer or file request, 30 days;
• transfer_statistics_…, transfer_downloads_…: counting of unique visitors and downloads of a transfer, 24 hours;
• al_download_started: tells the page that the download has started, 5 minutes;
• announcement_…: remembers that you closed an announcement shown at the top of the site, up to 1 year;
• theme_style: chosen light or dark theme, 90 days;
• rate-limiting cookies: protection against repeated sign-in or sign-up attempts.

The website shows no ads and sets no advertising cookies.

Security

Exchanges with the website are encrypted (HTTPS), passwords are hashed and access to data is limited to what the service needs.

Your rights

You have the right to access, rectify, erase, restrict, object to and port your data, as well as the right to set instructions for its use after your death. To exercise them, write to contact@gethopfile.com. We reply within one month.

If you believe your rights are not respected, you can lodge a complaint with the CNIL (cnil.fr).

Changes

This policy may change along with the service. The date of the last update is shown at the top of the page. In case of a significant change, we will inform you by email or on the website.