Privacy Policy

1. Introduction

This Privacy Policy describes how Qopy ("we," "our," or "us") collects, uses, and protects your personal information when you use our enterprise-grade secure text and file sharing service (the "Service"). Qopy is a web-based, open-source text and file sharing platform that prioritizes privacy and security through zero-knowledge client-side encryption with hybrid security architecture.

2. Information We Collect

2.1 Shared Content

• What we collect: Qopy allows you to share text content and files temporarily through our web service.
• Enterprise-grade client-side encryption: All content is encrypted in your browser using AES-256-GCM with PBKDF2 key derivation before being transmitted to our servers.
• Zero-knowledge architecture: We literally cannot see your plain text content - only encrypted data is stored in our database.
• Hybrid security: URL secrets and passwords are combined for defense in depth protection.
• Duration: Content is automatically deleted after your chosen expiration time (5 minutes to 24 hours).
• Quick Share mode: 6-character codes with zero-knowledge encryption and URL secrets for instant sharing with peers. Uses the same AES-256-GCM encryption as Enhanced Security, with shorter codes and a fixed 5-minute expiry.

2.2 Service Usage Data

• Anonymous statistics: We collect basic, anonymous usage statistics (number of clips created, access patterns) to improve our service.
• No content analysis: We never analyze, read, or mine the content you share.
• Rate limiting data: We temporarily process IP addresses for rate limiting purposes to prevent abuse and ensure fair service usage. This data is not stored permanently and is only used to enforce usage limits.
• Error reporting: In the event of service errors, anonymous diagnostic information may be collected to help resolve issues.

2.3 What the Server Never Sees

Due to Qopy's zero-knowledge architecture, the following data never reaches the server:

• Plaintext content: All content is encrypted client-side before upload. The server only stores ciphertext.
• Real filenames: Replaced with a random hash (e.g. a7f3b2c9) on the client before upload.
• Real MIME types: Encrypted inside the file payload. The server only sees application/octet-stream or text/plain.
• Plaintext access codes: Your access code is hashed with PBKDF2-SHA-512 (600,000 iterations) in your browser before being sent to the server. Only this irreversible hash is transmitted and stored — the plaintext access code never leaves your browser.
• URL secrets: Kept in the URL fragment (#), which browsers never transmit to the server.
• Decryption keys: Generated and used exclusively in your browser.
• IP addresses: Processed in-memory for rate limiting only. Never stored in the database.
• Browser information: Not collected or stored. No user-agent logging.

3. How We Use Your Information

3.1 Primary Functions

• Secure text and file sharing: To provide the core functionality of sharing text content and files securely and temporarily.
• File upload processing: To handle chunked file uploads up to 100MB with automatic assembly and cleanup.
• Client-side encryption: To encrypt your content in the browser before transmission to our servers.
• Automatic expiration: To automatically delete content after your chosen time period.
• Password protection: To provide optional password protection for sensitive content.

3.2 Service Improvement

• Performance optimization: To identify and resolve performance issues and improve application speed.
• Feature development: To understand user needs and develop new features that enhance the user experience.
• Bug fixes: To identify and resolve software bugs and technical issues.

3.3 Communication

• Updates and notifications: To inform you about important updates, security patches, and new features.
• Support requests: To respond to your support inquiries and provide technical assistance.
• Legal compliance: To fulfill legal obligations and respond to lawful requests from authorities.

4. Data Storage and Security

4.1 Encrypted Storage

• Client-side encryption: All content is encrypted in your browser using AES-256-GCM before being stored in our database.
• Zero-knowledge architecture: We never see your plain text content - only encrypted data is stored on our servers.
• Automatic deletion: Encrypted content is automatically deleted after your chosen expiration time.
• No content access: Even if our servers were compromised, attackers could not read your content without the encryption keys.

4.2 Security Measures

• AES-256-GCM encryption: Advanced encryption algorithm for all content.
• PBKDF2 key derivation: 600,000 iterations (OWASP 2025 compliant) with per-clip random 256-bit salts.
• Hybrid security system: URL secrets and passwords combined for defense in depth.
• Random IV generation: Cryptographically random 96-bit IV per encryption operation.
• Binary storage: Encrypted content stored as BYTEA for efficiency and security.
• HTTPS transmission: All data is transmitted over encrypted HTTPS connections.
• Rate limiting: Multi-layered IP-based rate limiting system to prevent abuse and ensure fair usage for all users.
• In-memory IP processing: IP addresses are processed in-memory only for rate limiting. They are never written to the database or any persistent storage.
• Browser extension blocking: Chrome extensions and other potentially malicious origins are blocked.

4.3 Data Retention

• Automatic expiration: Content is automatically deleted after your chosen time (5 minutes to 24 hours).
• One-time access: Content can be set to self-destruct after first read.
• Database cleanup: Expired content is permanently removed from our database.
• No manual deletion: Once shared, content cannot be manually deleted before expiration.

5. Data Sharing and Disclosure

5.1 No Third-Party Sharing

We do not sell, trade, or otherwise transfer your personal information to third parties for commercial purposes. Your shared content remains private and is not shared with advertisers, marketers, or other third parties.

5.2 Service Providers

• Hosting services: Your encrypted data is stored on Railway.app infrastructure (EU West — Amsterdam). The hosting provider cannot decrypt your content due to our zero-knowledge architecture.
• No analytics providers: We do not share data with any third-party analytics providers.

5.3 Legal Requirements

• Law enforcement: We may disclose information if required by law or in response to valid legal requests.
• Court orders: Information may be disclosed in response to court orders or subpoenas.
• Protection of rights: We may disclose information to protect our rights, property, or safety, or that of our users.

6. Your Rights and Choices

6.1 Control Over Your Data

Qopy has no user accounts. You control your data through the following mechanisms:

• Expiration time: Choose when your content is automatically deleted (5 minutes to 24 hours).
• One-time access: Set content to self-destruct after a single read.
• Password protection: Add an access code for an additional layer of security.
• Quick Share mode: Use zero-knowledge encrypted 5-minute shares for quick, instant sharing with peers.

6.2 Data Minimization by Design

• No accounts: No registration, login, or profile data is collected.
• No tracking: No cookies, analytics scripts, or tracking pixels are used.
• Automatic deletion: All content is permanently deleted after expiration. There is no way to recover expired content.
• No manual deletion needed: Since there are no accounts and all data auto-expires, there is nothing to manually delete.

7. Children's Privacy

Qopy is not intended for use by children under the age of 13. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately.

8. International Data Transfers

Qopy stores encrypted data on Railway.app infrastructure located in EU West (Amsterdam, Netherlands). If you access the service from outside the EU, your encrypted content is transferred to and stored on these servers. Due to our zero-knowledge architecture, the stored data cannot be decrypted by anyone without the encryption keys, which never leave your browser.

9. Data Breach Notification

In the unlikely event of a data breach that affects your personal information, we will notify you promptly in accordance with applicable laws. We will provide information about the nature of the breach, the data affected, and the steps we are taking to address the situation.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable laws. We will notify you of any material changes by posting the updated policy on our website and updating the "Last Updated" date. Your continued use of Qopy after such changes constitutes acceptance of the updated policy.

11. Contact Information

If you have any questions about this Privacy Policy or our data practices, please contact us:

12. GDPR Compliance

For users in the European Union, this Privacy Policy is designed to comply with the General Data Protection Regulation (GDPR). You have the following additional rights under GDPR:

• Right to be informed: You have the right to be informed about how your data is collected and used.
• Right of access: You have the right to access your personal data and information about how it is processed.
• Right to rectification: You have the right to have inaccurate personal data corrected.
• Right to erasure: You have the right to have your personal data deleted in certain circumstances.
• Right to restrict processing: You have the right to restrict the processing of your personal data.
• Right to data portability: You have the right to receive your personal data in a structured, machine-readable format.
• Right to object: You have the right to object to the processing of your personal data.
• Rights related to automated decision making: You have rights related to automated decision making and profiling.

13. California Privacy Rights

For California residents, you have additional rights under the California Consumer Privacy Act (CCPA):

• Right to know: You have the right to know what personal information is collected, used, shared, or sold.
• Right to delete: You have the right to request deletion of your personal information.
• Right to opt-out: You have the right to opt-out of the sale of personal information.
• Right to non-discrimination: You have the right to not receive discriminatory treatment for exercising your privacy rights.

14. Rate Limiting and IP Processing

14.1 Rate Limiting System

Qopy implements a multi-layered IP-based rate limiting system to prevent abuse and ensure fair service usage for all users. This system helps protect against spam, automated attacks, and service overload.

14.2 How Rate Limiting Works

• IP Address Processing: When you access our service, we temporarily process your IP address to enforce rate limits.
• Usage Limits: The system enforces different limits for different types of requests:
  • Burst protection: 30 requests per IP per minute
  • General API protection: 100 requests per IP per 15 minutes
  • Share API protection: 20 share requests per IP per 15 minutes
  • Retrieval API protection: 50 retrieval requests per IP per 15 minutes
• Temporary Storage: IP addresses are only processed in memory for the duration of the rate limiting window and are not permanently stored.
• No Tracking: Rate limiting data is not used for user tracking, analytics, or any other purpose beyond preventing abuse.

14.3 Rate Limit Exemptions

• Health Checks: Health check endpoints (/health, /api/health, /ping) are exempt from rate limiting.
• Admin Endpoints: Admin endpoints are protected by authentication rather than rate limiting.

14.4 Rate Limit Responses

When rate limits are exceeded, the service returns a 429 "Too Many Requests" status code with information about the limits and when they reset. This helps users understand and adjust their usage patterns.

15. Cookies and Tracking Technologies

Qopy is a web application that does not use cookies, local storage for tracking, analytics scripts, tracking pixels, or any other tracking technologies. No third-party scripts are loaded. QR codes are generated locally in your browser without external API calls.

16. Third-Party Services

Qopy may integrate with third-party services for specific functionality. These services have their own privacy policies, and we encourage you to review them. We are not responsible for the privacy practices of third-party services.

17. Data Minimization

We follow the principle of data minimization, collecting only the information necessary to provide our services. We do not collect unnecessary personal information and regularly review our data collection practices to ensure compliance with this principle.

18. Security Best Practices

To protect your privacy and security when using Qopy:

• Keep the application updated: Regularly update Qopy to ensure you have the latest security patches.
• Use strong passwords: If you enable password protection, use strong, unique passwords.
• Be mindful of sensitive data: Be cautious about sharing sensitive information and choose appropriate expiration times.
• Use access codes: For sensitive content, always add an access code for an additional layer of protection.
• Respect rate limits: Be aware of usage limits to avoid service interruptions.

19. Open Source Transparency

Qopy is open-source software, which means the source code is publicly available for review. This transparency allows the community to verify our privacy and security practices. You can review the source code at our GitHub repository.

20. Data Protection Officer

For data protection inquiries, you can contact us at the email address above. We will respond to your inquiries within the timeframes required by applicable law.

21. Complaints and Dispute Resolution

If you have concerns about our data practices, we encourage you to contact us first. If you are not satisfied with our response, you may have the right to lodge a complaint with your local data protection authority.

22. Data Transparency

In the interest of full transparency, the following table lists every piece of data the server stores for each shared clip. This information can be independently verified by reviewing our open-source code.

22.1 Server-Side Stored Metadata

Data	Actual value stored	Purpose	Lifetime
Encrypted content	Binary blob (BYTEA)	Core functionality	Until expiration
Anonymous filename	Random hash (e.g. a7f3b2c9)	File reference	Until expiration
Generic content type	text or file	Routing logic	Until expiration
Generic MIME type	application/octet-stream or text/plain	Response headers	Until expiration
Padded file size	Size after padding (not original)	Chunk assembly	Until expiration
Expiration time	Unix timestamp	Auto-deletion	Until expiration
Access code hash	PBKDF2-SHA-512 hash (128 hex chars)	Authentication	Until expiration
Feature flags	one_time, quick_share, has_password	Feature logic	Until expiration
Aggregate statistics	Total clips, total accesses (no per-user data)	Admin dashboard	Permanent

22.2 Data the Server Never Sees

The following data is protected by Qopy's zero-knowledge architecture and never reaches the server:

Data	How it's protected
Plaintext content	Encrypted client-side before upload
Real filename	Replaced with random hash on client
Real MIME type	Encrypted inside file payload; server only sees generic type
Access codes	Only PBKDF2-SHA-512 hash stored (600k iterations), plaintext never leaves browser
URL secrets	In URL fragment (#), never transmitted to server
Decryption keys	Generated and used only in browser
IP addresses	Processed in-memory for rate limiting only, never stored in database

23. Conclusion

At Qopy, we are committed to protecting your privacy and ensuring the security of your data. This Privacy Policy reflects our commitment to transparency and user control. We believe that privacy is a fundamental right, and we design our products with this principle in mind.

Last Updated: February 2026