Privacy Policy

Last updated: [DATE]

This policy explains what personal data Files.ge ("we", "us") handles when you use files.ge (the "Service"), why, and what rights you have.

Controller: [LEGAL ENTITY NAME], [REGISTERED ADDRESS], Georgia. Contact: [PRIVACY CONTACT EMAIL].

1. The short version

• Your files never reach our servers. They travel directly from the sender's browser to the recipient's browser. We do not store, read, or scan them.
• Our servers do not keep data that identifies you. They do not keep IP addresses or records of individual transfers.
• We use Google Analytics to count visits to our website. Google's tool sets cookies in your browser and receives some information about your visit (section 6). We never send Google your link names, file names, or file contents.
• We show ads on some public pages through the advertising network Adsterra (section 7): banners, a floating bar, and on the privacy policy and terms of use pages a pop-under window that may open after you click. Ads are never shown on download pages. We do not sell your data.
• The person you exchange files with can see your IP address. This is how direct peer-to-peer connections work (see section 5).

2. How the Service works

Files.ge uses WebRTC to connect two browsers directly. Our servers help the two browsers find each other (signaling). To work out how to connect, your browser also asks a STUN server for its public address (section 10). When a direct connection is impossible and a relay server has been set up for the Service, traffic may pass through it (a TURN relay); relayed traffic remains encrypted between the two browsers, and neither we nor the relay can read it. The sender must keep the page open while the transfer runs.

3. What we store

Website visit statistics collected by Google Analytics are described separately in section 6. They are held by Google, not on our servers.

Abuse reports. When someone reports a link, we disable that link. We do not record who made the report or who sent the files. To stop the same share from reappearing straight away, we also remember the random, temporary connection ID of the reported sender's browser for a limited time (by default one hour, at most a day) and refuse to create a new link for it. That ID is generated randomly by the sender's browser, is not linked to a name, IP address, or device, and is deleted automatically.

4. How we use IP addresses

Your IP address necessarily reaches our servers whenever your browser contacts them. We use it only in memory and only to protect the Service from abuse, for example to limit how fast someone can try to guess links. These counters are discarded automatically within at most one hour.

Our own software does not write IP addresses to logs, databases, files, or backups. The hosting provider that runs our servers, and any network device your traffic passes through, may keep their own network-level records; we do not control those (section 10).

If a relay server is set up and your connection is relayed through it, your encrypted traffic passes through it, and like any network device it sees the two IP addresses involved.

This section is about our own servers. Google Analytics (section 6) is separate: when it is active, your browser contacts Google directly.

5. What we do not collect

• File names, file contents, or file hashes.
• Passwords you set on a share. A password is checked in the sender's browser and never sent to us.
• On our own servers: IP addresses (beyond the in-memory use in section 4), browser or device details, or any per-transfer record.
• Timestamps more precise than a calendar day.
• Advertising identifiers on our own servers. Ads are provided by Adsterra (section 7); we do not use data from Google Analytics for advertising, and we have switched off Google's advertising features in Google Analytics (section 6).

Important: in a direct transfer, your browser and the other person's browser exchange network information, which reveals each side's IP address to the other. We do not record it, but the other person's browser can see it. If this is a concern, do not use the Service on that network or use a VPN.

6. Google Analytics

We use Google Analytics 4, a web analytics service provided by Google (Google Ireland Limited for visitors in the EEA and Switzerland; Google LLC elsewhere), to understand how our website is used and to improve it. It runs only on our public pages (the home page, this privacy policy, the terms of use, and the reported-link page). It is switched off on download pages and on any page we do not recognise, so it never sees share links.

What Google Analytics receives from your browser. Which public page you viewed, described only in general terms such as "home page" or "privacy policy"; the date and time of your visit; the site you came from; your approximate location (country and city, worked out by Google from your IP address); your browser, operating system, device type, screen size, and language; and a random identifier stored in a cookie so that returning visits can be recognised. Your browser sends this directly to Google. Google receives your IP address because that is how internet connections work; Google states that Google Analytics 4 does not log or store individual IP addresses.

What we never send to Google. Google Analytics does not run on download pages at all, so the address of a share link (which contains a secret link name) is never sent to Google. We also never send file names, file sizes, file contents, or passwords, and we do not pass any identifier of yours to Google.

Settings we use. Google's advertising features (Google signals and ad personalization) are switched off. Data retention in Google Analytics is set to [RETENTION PERIOD].

Cookies. Google Analytics sets the cookies _ga and _ga_<container ID> in your browser. They hold a random identifier and are kept for up to about two years.

Your choices. You can block or delete these cookies in your browser settings, use a browser extension that blocks Google Analytics, or install Google's Analytics Opt-out Browser Add-on. The Service works the same without Google Analytics.

Transfers outside Georgia and the EEA. Google may process this data in the United States and other countries, under safeguards such as its data processing terms and standard contractual clauses.

More information: Google's Privacy Policy.

7. Advertising (Adsterra)

We show advertisements on some of our public pages (the home page, this privacy policy, and the terms of use) using Adsterra, an online advertising network. We use it to help pay for running the Service. The ads appear as banners above the footer of the page and as a floating bar. On this privacy policy and the terms of use pages only, they also include a pop-under: a new browser window that may open behind the current one after you click on the page. We also show a link labelled "Sponsored link" that leads to an Adsterra partner page. It opens in a new browser tab, and your browser is asked not to tell that page which page you came from. Ads are never shown on download pages (the pages that open a share link), and the ad code is not loaded there, so the address of a share link is never sent to the advertising network through ads.

What Adsterra and its advertising partners may do. When ads are shown, your browser loads the ad code from Adsterra's servers, which include servers under the domains profitableratecpmnetwork.com and highrevenueformat.com, and contacts Adsterra and its partners directly. They may use cookies and similar technologies, your IP address, and information about your browser and device, together with the address of the public page you are viewing, to choose, show, limit, and measure ads and to prevent fraud. The ads may be based on your interests, and we do not control which pages they lead to. We do not receive this data and we do not send Adsterra your files, file names, link names, or passwords. Adsterra handles advertising data under its own policies, and acts as an independent controller for its advertising purposes.

Your choices. [CONSENT: describe how visitors in the EEA, the UK, and Switzerland are asked for consent before the ads load, or how the ads are restricted there. Write nothing here until that is actually in place.] You can opt out of interest-based ads through aboutads.info or youronlinechoices.eu, block or delete cookies in your browser, or use a browser extension that blocks ads. The Service works the same without ads.

8. Cookies and local storage

• A language preference cookie (set only when you choose a language).
• Browser local storage to remember that you accepted our Terms of Use.
• The Google Analytics cookies described in section 6, which we use only for website statistics.
• Advertising cookies set by Adsterra and its advertising partners when ads are shown (banners, the floating bar or the pop-under, section 7).

We set no other cookies. Fonts are served from our own servers, not from third parties.

9. Why we may process this data (legal bases)

• Legitimate interests in protecting the Service from abuse (the short-lived, in-memory use of IP addresses) and in understanding how our website is used through Google Analytics.
• Legal obligation, where we must retain or disclose data to comply with applicable law or a valid legal request.
• Consent, where the law requires it and we ask for it, for advertising cookies and personalised ads (section 7), and where you contact us directly.

10. Who receives data

• Google (Google Analytics), as described in section 6, and Adsterra and its advertising partners (including their ad servers under the domains profitableratecpmnetwork.com and highrevenueformat.com), as described in section 7.
• Hosting and infrastructure providers that run our servers: [HOSTING PROVIDER(S) AND SERVER LOCATION]. Such providers may keep their own network-level records under their own policies, which we do not control.
• Authorities, only where required by law or a valid legal request. Because our servers keep no IP addresses or per-transfer records, we generally hold nothing that identifies a sender or recipient to hand over.
• The other party in a transfer, who can see the technical information described in section 5.

Public STUN server. To set up a direct connection, your browser asks a STUN server for its public address. The server we use by default is operated by Google (stun.l.google.com), so Google receives your IP address, and handles it under its own policies, whenever a transfer is started or opened. We will name our own server here, and stop using Google's, if we start running one.

11. International transfers

Our servers are located in [COUNTRY/REGION]. For Google Analytics and Adsterra (including its ad servers named in section 7), see sections 6 and 7. Google's STUN servers (section 10) are operated worldwide.

12. Security

Transfers are encrypted end to end by WebRTC (DTLS). Connections to our website use HTTPS. Because our servers keep so little data, there is little to lose, but no system is perfectly secure, so please do not share highly sensitive material unless you are comfortable with the risks described in our Terms of Use.

13. Your rights

Under the Law of Georgia on Personal Data Protection and, where it applies to you, the GDPR, you may have the right to access your data, correct it, have it erased, restrict or object to its processing, and receive a copy of it. Because our own servers do not store data that identifies you, we usually cannot look up anything about you. For data held by Google Analytics, we usually cannot identify you either, but you can delete the Google Analytics cookies in your browser at any time, and you can manage advertising choices as described in section 7. If you believe we hold personal data about you, contact us at [PRIVACY CONTACT EMAIL] and we will look into it.

You may also lodge a complaint with the Personal Data Protection Service of Georgia or, if you are in the EU/EEA, your local supervisory authority.

14. Children

The Service is not directed to children under 16, and we do not knowingly collect their personal data.

15. Changes

We may update this policy. The "Last updated" date shows the latest version, and we will give notice of material changes on the website.

16. Contact

[LEGAL ENTITY NAME] · [REGISTERED ADDRESS] · [PRIVACY CONTACT EMAIL]