Plain-language summary. Legal review required before launch — translation to Hungarian is a follow-up.
§ 01
What we collect
- Account email and a one-way password hash (bcrypt) — for registered users.
- Uploaded file content and the text of pastes, original filename or paste title, size in bytes, and SHA-256 fingerprint.
- Uploader IP address for every upload and every paste (anonymous and authenticated).
- Downloader / page-viewer IP address for every successful file download, every share-page resolution, and every view of a collection page or a portal page. Stored append-only in the analytics event tables that power the owner's Feed dashboard rollups and the popularity ranking of public collections and portals (see § 02 for retention).
- Password attempts on a protected share or Collect link: the time, whether the attempt succeeded, and a one-way hash (SHA-256) of the visitor's IP address — never the IP itself. The link owner sees the time and the result, so they can spot someone guessing their password; the hash is never shown to them.
- Security log: for security-relevant actions (for example creating or revoking an API key, or creating or editing a paste — also as a guest) and for every moderation action, the IP address and the browser's user-agent string of the person who performed it.
- Abuse reports and counter-notices: the reporter's IP address, the email address they give (optional), and the text of the report; for a counter-notice, the contact email address and the message of the person who files it.
- Recipient email addresses for share-by-email links — supplied by the file owner when sharing a file via email (see § 04c).
- Guest uploader name and email address for Collect-mode submissions — supplied by a visitor when they submit files through an owner-created Collect link (see § 02 for retention).
- If you sign in with Google or Facebook (when that option is offered, see § 04i): the email address the provider confirms for you. We use it to find or create your account; we do not store your name, picture or any other profile data from the provider.
§ 02
How long we keep it
- Account-owned files: until you delete them or your account.
- Deleting a file or paste from your Drive first moves it to the trash, where you can restore it. Items in the trash are permanently deleted when you delete them from the trash, and automatically 30 days after you deleted them at the latest.
- Anonymous file uploads: stored until the uploader deletes them (after claiming them into an account) or an administrative / abuse action removes them. There is no automatic time-based expiry for files.
- Guest pastes (created without an account): these do expire. The link stops working after the period chosen when the paste was created — 30 days unless another period, or "never", was chosen. The text of the paste is then permanently deleted 7 days after the link expired. A guest paste whose link was set to never expire is kept like an anonymous file upload. Pastes created with an account stay in the owner's Drive after their link expires, like any other file.
- Forensic record (uploader IP, SHA-256 hash, original filename, size): kept for as long as the file exists. The uploader-IP record of an anonymous upload is not erased on a timer — because a share link never expires on its own, an abuse report or a lawful request can arrive at any point in the file's lifetime, and the IP is the only record that lets us investigate it (GDPR Article 6(1)(f), see § 03). The record is deleted together with the file: once the uploader, an administrator, or an abuse action has removed the file, its leftover forensic record is swept as soon as the upload is older than 180 days (immediately, if it already is).
- Analytics events (download events, share-page views, collection and portal page views): raw rows are retained for 90 days, after which a scheduled retention sweep deletes them; download events and share-page views are first aggregated into monthly summaries that contain no IP address.
- Password-attempt records (share and Collect links): 180 days, then deleted automatically.
- Security log (IP address and user-agent of security-relevant and moderation actions): 365 days, then deleted automatically.
- Email delivery log (which kind of email was sent to which account, and whether it was delivered — not the email's content): 90 days, then deleted automatically.
- Data-export archives (the download you can request under your right of access): deleted from our servers 7 days after you requested them.
- Share-email recipient addresses: retained for the share's lifecycle — purged automatically when the share is revoked by the owner, the share link expires, the file is deleted, or the owner's account is deleted.
- Abuse reports (DMCA, ILLEGAL, SPAM, OTHER), including the reporter's IP address and email address and any counter-notice with its contact email address: retained indefinitely for legal record-keeping.
- Collect-mode guest uploader name and email: retained for as long as the Collect link owner's account exists. There is no separate retention window — the data is hard-deleted together with the rest of the owner's account data when the owner deletes their account.
§ 03
Why we collect IP addresses
Two purposes. Fraud and abuse prevention (rate limits, abuse-report investigation, protection from automated abuse) under GDPR Article 6(1)(f) — legitimate interest. Owner-side analytics for the Feed dashboard (the file owner sees aggregate download / share-view counts on their own files); event rows carry the IP for forensic continuity but the dashboard itself only shows totals, never IPs. Neither use case involves selling or sharing data with marketing partners.
§ 04
Cookies and advertising
The cookie banner asks for two separate consent choices: analytics measurement and advertising / marketing. Your choice for each category is recorded in your browser's localStorage under the key consent_prefs. Rejecting either category does not affect downloads or any other functionality. You can reopen this choice at any time via the footer's "Sütibeállítások" link.
What the advertising / marketing choice actually controls today is two things: the Google Ads conversion measurement described in § 04g, and the Facebook page widget described in § 04h. We do not currently display advertisements on FileMv: Google AdSense is configured but switched off, so no advertising script is loaded and no ad is rendered, on share pages or anywhere else — regardless of what you choose here. Should we begin displaying advertisements, they would run only for visitors who have given advertising / marketing consent, and we would publish a new version of this policy before that happens.
Separately from those two choices, the site uses a few cookies and browser-storage entries that are strictly necessary for something you asked for. They need no consent, are never used for measurement or advertising, and are never shared with third parties:
auth_token — keeps you logged in. It is set only when you log in, cannot be read by scripts on the page (HttpOnly), lasts as long as your login session and is deleted when you log out.filemv_session — a companion of auth_token that only tells the page that a login session exists (its value is always "1"). Same lifetime as auth_token.filemv_locale (lifetime: 1 year) — remembers the language you switched to, so the next page is served in that language. Set only when you change the language.- Browser storage (
localStorage / sessionStorage) — your cookie choices (consent_prefs, above), your light / dark theme, your last choice for the "Show in search engines" upload option, and — for the current browser tab only — the proof that you have already entered the password of a protected share, paste or Collect link. These stay in your browser; only the password proof is sent back to us, with the requests for that share.
§ 04b
Payment processing
When you upgrade to the paid tier, payment is processed by Stripe, a contractually-bound subprocessor (PCI-DSS Level 1 certified). Your account email is shared with Stripe at checkout time as part of payment processing — Stripe needs it to issue receipts and to match returning customers to their existing payment methods. Card and bank-account details are entered on Stripe-hosted pages and never reach our servers. We only store the resulting Stripe customer and subscription IDs alongside the period-end timestamp so the app knows whether your subscription is currently active.
The legal basis for sharing your email with Stripe is GDPR Article 6(1)(b) — performance of the subscription contract you entered into when upgrading.
§ 04c
Share-email recipients
When a file owner uses the share-by-email feature, share links are emailed to the recipient addresses the owner supplies. Those recipient email addresses are stored by us to power per-recipient open/download tracking — so the owner can see which recipients have accessed the shared file.
The legal basis for processing recipient addresses is GDPR Article 6(1)(f) — legitimate interest of the file owner in knowing whether their shared content was received and accessed.
Recipient addresses are retained for the share's lifecycle and are purged automatically when the share is revoked by the owner, the share link expires, the file is deleted, or the owner's account is deleted. Recipients may contact us to request erasure of their address at any time (see § 06 for contact details).
§ 04d
Collect mode
Collect mode lets a file owner create a password-protected drop-box link (/collect/<token>) so visitors can upload files directly into one of the owner's Drive folders. When a visitor submits files through a Collect link, we store the name and email address they provide alongside the submission.
The legal basis for processing the guest uploader's name and email is GDPR Article 6(1)(f) — legitimate interest of the link owner in knowing who submitted the files.
This data is retained for as long as the link owner's account exists and is hard-deleted together with the rest of the owner's account data when the owner deletes their account (see § 02). Guest uploaders may contact us to request erasure of their name and email at any time (see § 06 for contact details).
§ 04e
Public shares and search engines
When you upload a file, the upload screen shows a "Show in search engines" option, which is switched off by default.
- If you switch it on, the share is public. Anyone can open it. It can appear in FileMv's own search. Search engines such as Google or Bing may also index the share page. The file or folder name, the preview image and the file itself can then show up in their search results.
- If you leave it off, the share is unlisted. Only people who have the link can open it. We tell search engines not to index it.
A share is never offered to search engines, even if it is public, while it is password-protected, has expired, or has been blocked or removed by moderation. Files uploaded before 2026-10-05 are not affected: they stay unlisted.
Pastes follow the same rule. A public paste can appear in FileMv's own search, and search engines may index its page, including its title and text. Unlisted, password-protected and private pastes (private ones need an account) are kept out of search engines: we tell search engines not to index their pages (noindex), and an unlisted paste is not listed anywhere by FileMv — only people who have the link can open it.
Changing your mind.
- If you have an account, you can switch a public share to unlisted at any time in its share settings. From then on, we tell search engines not to index it.
- If you uploaded without an account, write to us at the contact address below with the share link, and we will make the share unlisted or remove it.
- Removing a page from a search engine's results is done by the search engine operator, and it can take days or weeks. To speed it up, you can use the operator's removal tool, such as Google's "Remove outdated content" form.
Making a share public is your choice. We process the share's name and content to provide the publication you asked for (Article 6(1)(b) GDPR). Please do not make files public that contain personal data of other people without their consent, or anything you would not want to be found.
§ 04f
Google Analytics
We use Google Analytics 4 for traffic statistics — how many people visit, which pages they open, and which features they use. Google Analytics is operated as a processor by Google Ireland Limited (Ireland). Measuring which advertising click led to a signup is a separate process with its own consent category, described in § 04g.
The measurement tag is loaded on every page by default, in Google's Consent Mode with every consent signal set to "denied" until you make a choice. In this default state no cookie is set and no identifier is assigned to you; the tag sends cookieless technical pings to Google — carrying the visited page address, coarse browser and device information and the fact of the visit — which Google uses solely for aggregated, modelled statistics. The legal basis for this cookieless measurement is our legitimate interest in aggregate service statistics, GDPR Article 6(1)(f).
Cookie-based measurement — the cookies listed below — is activated only after you have given prior consent; its legal basis is GDPR Article 6(1)(a) — consent. You can withdraw your consent at any time via the footer's "Sütibeállítások" link — withdrawing stops cookie-based measurement (your later visits are again counted only through cookieless pings) and does not affect downloading or sharing files.
We use the following cookies for measurement:
_ga (lifetime: 2 years) and _ga_<container> (lifetime: 2 years) — visitor-distinguishing measurement identifiers that are not, on their own, sufficient to directly identify you.
Measurement data is transferred to Google LLC (United States) under the EU-US Data Privacy Framework as the transfer basis.
Event data stored in Google Analytics is automatically deleted after 14 months.
Google Signals is switched on for our Google Analytics property. Only if you have given analytics consent, and only if you are signed in to a Google account whose settings allow ad personalisation, Google may link the measurement data of your visit to that Google account, so that we can see aggregated reports about the demographics and interests of our visitors and about visits from more than one device. We never see which Google account visited. For this, gtag.js also contacts stats.g.doubleclick.net. Without analytics consent no Google Signals data is collected.
Only if you have given analytics consent, the share, file and collection pages also report which item was viewed, once it has loaded: the internal identifier of a publicly listed file, or of a public collection, together with the number of files shown. For a link-only (unlisted) share and for an unlisted collection we send no identifier of the item itself, only a short pseudonymous reference derived from it by a one-way function: it is not a link, it cannot be turned back into one, and only FileMv can match it to the item. Without analytics consent none of these identifiers are sent.
We exclude file names, email addresses, share tokens/URLs, and the identifier part of collection page addresses from measurement data via technical redaction — these are never transmitted to Google Analytics.
§ 04g
Google Ads conversion measurement
We advertise FileMv through Google Ads. To learn which advertisements actually work, we measure conversions: if you arrive from one of our ads and then reach the signup page, a single conversion event is reported to Google so the ad click and the signup can be attributed to each other. Google Ads is operated as a processor by Google Ireland Limited (Ireland).
The legal basis is GDPR Article 6(1)(a) — consent. This measurement belongs to the advertising / marketing category of the cookie banner, which is a separate choice from analytics (§ 04f): you may accept one and refuse the other. You can withdraw the consent at any time via the footer's "Sütibeállítások" link — withdrawing does not affect downloading or sharing files.
Once you have given advertising consent, the following cookies may be set on the filemv.com domain:
_gcl_au (lifetime: 90 days) and _gcl_aw (lifetime: 90 days) — conversion-linker identifiers that store the advertising click information needed to attribute a later signup to the ad that produced it. They do not, on their own, identify you by name.
Conversion measurement contacts additional Google domains beyond those used for analytics: googleadservices.com, doubleclick.net and google.com. Conversion data is transferred to Google LLC (United States) under the EU-US Data Privacy Framework as the transfer basis.
If you refuse advertising consent — or simply never answer the banner — Google Consent Mode v2 keeps the ad_storage, ad_user_data and ad_personalization signals set to denied. In that state no _gcl_* cookie is written and no advertising identifier is read; Google receives at most cookieless, aggregated signals from which individual visitors cannot be singled out.
The conversion event carries no information about what you do with the service. It reports only that the signup page was reached. The same technical redaction described in § 04f applies here: file names, email addresses, and share tokens/URLs are never transmitted.
§ 04h
Facebook page widget
FileMv has a page on Facebook. So that you can follow it without leaving the site, we embed Meta's Page Plugin: a small panel showing the page's name and a follow button. The panel is not our code — it is a frame served by Meta Platforms Ireland Limited (Ireland), which loads it directly from facebook.com and connect.facebook.net.
Two things follow from that, and we would rather state them plainly than let you discover them. First, loading the panel sets Meta's own cookies and, if you are logged in to Facebook in the same browser, lets Meta recognise you. Second, in order to serve the panel Meta necessarily learns which FileMv page you were viewing, because the request for the panel carries that address. Meta uses what it collects for its own purposes, under its own policy — for that processing Meta is an independent controller, not our processor, so its terms govern it and not ours. What Meta does with it is described at facebook.com/privacy/policy.
The legal basis is GDPR Article 6(1)(a) — consent. The widget belongs to the advertising / marketing category of the cookie banner, the same category as the conversion measurement in § 04g. We deliberately did not invent a separate category for it: it is one more third party that may recognise you, which is what that category already asks about, and splitting it would make the banner longer without giving you a finer decision than you already have.
If you refuse advertising consent — or simply never answer the banner — the plugin is never loaded. This is not a disabled or empty widget: no request is made to facebook.com or connect.facebook.net at all, no Meta cookie is set, and Meta is not told that you were here. In place of the panel we show an ordinary link to the page, which does nothing until you click it. Following FileMv on Facebook is therefore possible whether or not you consent — refusing costs you a click, not a capability.
You can withdraw the consent at any time via the footer's "Sütibeállítások" link. From that moment the plugin is no longer loaded anywhere on the site. There is one limit we cannot engineer around and will not pretend otherwise: cookies Meta has already set live on Meta's own domain, which we have no access to. We can stop loading the plugin; we cannot delete those. To remove them, use your browser's site-data controls, or the settings in your Facebook account.
The widget is a follow button and nothing more: we pass it nothing but the address of FileMv's Facebook page, and we report nothing to Meta about what you do with the service — not the files you upload or download, and not their names. One limit we cannot engineer around: the widget is shown on share pages, and Meta's script runs inside the page, so it can read the address of the page you are on. On a share page that address contains the share link. The technical redaction described in § 04f is ours and cannot be applied to Meta's script; if you do not want Meta to be able to see a share page's address, do not give advertising / marketing consent, or withdraw it before opening the share.
§ 04i
Other service providers
Besides the providers described above, these services process personal data when you use the parts of FileMv that need them:
- Postmark — operated by ActiveCampaign, LLC (United States) — sends every email FileMv sends: registration and password emails, notifications, share-by-email links (§ 04c) and the messages of the abuse and counter-notice process. It processes the recipient's email address and the content of the email as our processor. Legal basis: the purpose of the email itself — GDPR Article 6(1)(b) for emails that are part of the service you use, Article 6(1)(f) for share-by-email links and abuse-process messages. Transfer basis: the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.
- Cloudflare Turnstile — operated by Cloudflare, Inc. (United States) — is the bot check on forms that automated abuse targets: always on guest pastes and abuse reports, and — while we have the wider protection switched on — also on sign-up, login, guest uploads and similar forms. The check is loaded from
challenges.cloudflare.com; Cloudflare receives your IP address and technical information about your browser and device to tell people from bots. It is loaded only on those forms. Legal basis: our legitimate interest in protecting the service from automated abuse, GDPR Article 6(1)(f). Transfer basis: the EU-US Data Privacy Framework. - Sign-in with Google or Facebook — only when the login page offers these buttons (they are switched off at present). If you use one, you sign in on the provider's own page — Google Ireland Limited or Meta Platforms Ireland Limited — and the provider tells us the email address it has confirmed for you (§ 01). For that sign-in the provider is an independent controller under its own privacy policy. Legal basis: GDPR Article 6(1)(b) — you chose this way of signing in to your account.
- Google Fonts — the rest of the site uses fonts served from our own servers, but a portal page (
/p/<name>) whose owner picked one of three font styles ("Inter / Lora", "Playfair Display / Source Sans", "JetBrains Mono") loads those fonts from fonts.googleapis.com and fonts.gstatic.com. Opening such a page therefore sends your IP address and browser information to Google Ireland Limited, without a cookie being set. Legal basis: our legitimate interest in showing the portal in the design its owner chose, GDPR Article 6(1)(f).
§ 05
Your rights
- Access — request a copy of the personal data we hold about you.
- Deletion — request that we erase your account and uploads.
- Correction — ask us to fix inaccurate data.
- Complaint — lodge a complaint with your national supervisory authority.
§ 06
Contact
For privacy questions or requests under the rights above, contact privacy@filemv.com.