Privacy Policy

What we collect

• Email address — if you claim an account. Used for authentication.
• IP address — recorded at token creation and in activity logs for rate limiting and abuse prevention.
• Uploaded files — filenames, file sizes, and the files themselves.
• API tokens — generated identifiers used to authenticate your requests.
• Payment information — if you subscribe to a paid plan, Stripe collects and processes your payment details.
• Usage analytics — page views, feature usage, and request metadata to improve the service.

How we store your data

All data is stored on Cloudflare infrastructure in the United States:

• Cloudflare D1 (SQLite) — account metadata, file records, tokens
• Cloudflare R2 (object storage) — uploaded file contents

Data is encrypted in transit (TLS) and at rest by Cloudflare's infrastructure.

Data retention

• Guest accounts — files and tokens expire after 30 days of inactivity and are then deleted.
• Claimed accounts — data is retained until you delete it or request account deletion.
• Deleted files — soft-deleted immediately, permanently purged from storage within 7 days.
• Rate limit records — automatically expire and are not retained.

Your rights

For all users

You can exercise the following rights at any time:

• Delete files — use the DELETE /api/v1/files/:id endpoint.
• Data export — use the GET /api/v1/files endpoint to list all your files.
• Account deletion — delete your account and all associated data from account settings.

GDPR (EU/EEA users)

If you are located in the European Union or European Economic Area, you have the following additional rights under the General Data Protection Regulation:

• Right of access — request a copy of the personal data we hold about you.
• Right to rectification — request correction of inaccurate or incomplete personal data.
• Right to erasure — request deletion of your personal data.
• Right to restriction — request that we restrict processing of your personal data.
• Right to data portability — request your data in a structured, commonly used, machine-readable format.
• Right to object — object to processing of your personal data.
• Right to withdraw consent — withdraw your consent at any time where processing is based on consent.
• Right to lodge a complaint — file a complaint with your local supervisory authority if you believe your rights have been violated.

Data controller: PutPut (US entity). Contact: support@putput.io.

CCPA (California residents)

If you are a California resident, you have the following rights under the California Consumer Privacy Act:

• Right to know — request disclosure of the personal information we have collected about you.
• Right to delete — request deletion of personal information we have collected from you.

To exercise these rights, contact support@putput.io.

Third-party processors

We use the following third-party services to operate PutPut:

• Cloudflare — hosting, CDN, database, object storage
• Stripe — payment processing (when billing is enabled)
• Resend — transactional email delivery (when email features are enabled)

Each processor has their own privacy policy.

Cookies

Cookies may be set by our infrastructure providers and analytics tools for session management, security, and performance.

Children's privacy

PutPut is intended for users aged 13 and older.

International data transfers

All data is stored in the United States on Cloudflare infrastructure. If you are accessing PutPut from outside the United States, your data will be transferred to and processed in the US.

Changes to this policy

We may update this policy from time to time. Material changes will be noted by updating the date at the top of this page. Continued use of the service after changes constitutes acceptance.

Contact

For privacy-related questions or requests, email support@putput.io.