Privacy

This is the long version, and it is the honest one. The short version: your files are yours, we keep them only long enough to hand them back, nobody here reads them, and the whole service is built so that we hold as little about you as it can.

Last updated: 18 October 2026

1. Who is responsible

The controller of your personal data is Bauza.pl Maciej Bauza, ul. Wojska Polskiego 32/2, 55-100 Trzebnica, Poland, tax identification number PL9151810115 — the business behind fileflint.app. For anything in this document, write to contact@fileflint.app.

We have not appointed a Data Protection Officer. We are not required to: we do not process personal data on a large scale as our core activity, and we do not monitor anyone systematically. The address above reaches a person, not a queue.

2. Your files

This is the part most people came here for, so it goes first.

When you convert a file, it is uploaded straight from your browser to our storage, using a signed address that works once and expires. The file is then read by a conversion worker, the result is written back, and you download it. That is the whole journey.

• We do not open your files. No person reads, views or listens to them in the normal running of the service. Access to the storage is limited to the people who keep the service running, and only to the extent needed to keep it running. The administration panel deliberately has no feature for browsing anyone’s files — that was a design decision, not an omission.
• We do not train anything on them. Not a model, not a heuristic, not a “quality improvement programme”. Your files are input to a conversion and nothing else.
• We delete them. On the free plan, 2 hours after conversion. On paid plans, 30 days. You can also delete them yourself with one button, immediately, and that button really deletes the objects rather than hiding them.
• Deletion has two independent layers. A scheduled job in the application and a lifecycle rule in the storage itself. If one fails, the other still removes the file. We built it that way because a retention promise with a single point of failure is not a promise.
• Sending between computers goes straight from one browser to the other. The files never reach our servers. To connect the two computers we relay a few short setup messages, which contain network addresses; they are kept for a few minutes at most and deleted as soon as the connection is up. To find each other, the browsers also contact a public STUN server (by default Cloudflare's), which sees their network addresses but not the files. If a direct connection is impossible (a strict firewall, say), the files pass through our relay server instead, at up to 50 Mbps (less when it is busy). They stay encrypted between the two browsers, so the relay cannot read them, and it does not keep them or log their names or contents.
• Passwords for PDFs are not kept. A password you type to protect or unlock a PDF is used only to process that file, and is removed from our database as soon as the job finishes — and in any case within 24 hours. It never goes into a log.
• Location data comes out of photos by default. EXIF metadata, including GPS coordinates, is stripped unless you turn that off yourself.

If your file contains personal data — a CV, a contract, a scan of a document — then for as long as it sits with us we process it on your behalf. We do it to perform the service you asked for (Article 6(1)(b) GDPR). We do not look at what is inside, which is also why we cannot help you find a specific file by its contents.

Please do not upload files containing data you are not allowed to share with a processor: that mainly means health records, biometric data and similar special categories under Article 9 GDPR. Nothing in our system is designed around that level of sensitivity.

3. What else we hold, and why

Technical data from every visit

Your IP address with the last part removed — so 198.51.100.42 is stored as 198.51.100.0 — plus timestamps and, for signed-in sessions, the browser identification string. We use it to enforce daily limits, to spot abuse, and to work out why something broke. Basis: our legitimate interest in running a service that is not immediately overwhelmed by automated misuse (Article 6(1)(f) GDPR). We truncate the address because a full one identifies a household and we do not need that much.

An anonymous key, if you are not signed in

Converting without an account is the normal way to use FileFlint. To let you come back for your result, we set a cookie with a random value tied to your conversions. It identifies a browser, not a person, and it tells us nothing about you.

Account data, if you make an account

Email address, whether you have confirmed it, a hash of your password if you set one (argon2id — the password itself is never stored), an optional display name, your interface language, and the dates your account was created and last used. If you sign in with Google, we also keep the identifier Google gives your Google account, so that the next sign-in finds the same account; we receive your name and email address from Google and nothing else — no contacts, no files, no access to your Google account. Basis: the contract between us (Article 6(1)(b) GDPR). Kept while the account exists. You can delete the account yourself under Account → Account data, which removes it at once; or write to us.

Links we send by email

Confirming your address, resetting a password and signing in with a link all work through a one-time link sent to your inbox. We store only a hash of the code inside the link, the address it went to and when it expires — 48 hours for confirmation, one hour for a password reset, 15 minutes for a sign-in link. Each works once. Used and expired ones are deleted within minutes. The emails are sent by Brevo and contain nothing but the link and a short explanation — no tracking of our own, no marketing.

Files you share by link, on a paid plan

On Pro and Business you can create a link to a converted file. Anyone who has the link can download that file, without an account, for as long as the file is kept — or until you turn the link off, which works immediately. We store the link, which file it points to, who made it and how many times it was downloaded. We do not record who downloaded it. Choosing whom to send the link to is up to you; please treat it like the file itself.

Payment data, if you buy a plan

Payments run through Stripe. Card numbers never reach our servers — they go from your browser to Stripe directly. What we store is the identifier Stripe gives your customer record, the subscription identifier, which plan you are on, its status, and when the current period ends. Basis: the contract, plus our legal obligation to keep accounting records, which in Poland is five years from the end of the tax year. When you delete your account we cancel the subscription and delete your customer record at Stripe, which removes your saved card; the invoices themselves stay with Stripe for as long as that obligation lasts, and we hold no copy of them.

Statistics about the service

We count conversions: which format pairs are used, how long they take, how many fail and why, how many bytes go in and out. These counters are aggregated per day and contain no field that points to a person — no account, no address, no file name. They tell us what to build next and what is broken. Because they are not personal data, they are not deleted along with your account; there is nothing in them to delete.

An audit record of administrative actions

When someone with administrative access changes an account or issues a licence, we record who did it, what they did and when. This exists to protect you from us: it means no change to your account can be made without a trace.

How long each of these is kept

Files are the short one and they are covered above. Everything else has a deadline too, and these are enforced by a job that runs every few minutes, not by good intentions:

4. Cookies

We use as few as the service allows, and we group them honestly:

• Necessary. Your session (so you stay signed in), a security token that stops other websites acting on your behalf, the anonymous key described above, your light or dark theme choice, and — only while you are signing in with Google — a ten-minute cookie that ties Google’s answer to the tab that asked for it. These do not require your consent: storing them is exempt under Article 399(3) of the Polish Electronic Communications Law (Prawo komunikacji elektronicznej, in force since 10 November 2024, replacing Article 173 of the old Telecommunications Law), which implements Article 5(3) of the ePrivacy Directive — the exemption for storage strictly necessary to deliver a service you explicitly asked for. Under the GDPR we rely on Article 6(1)(b) for the ones that make the service work and Article 6(1)(f), our legitimate interest in keeping it secure, for the security token.
• Advertising. Google AdSense uses cookies and similar identifiers to show ads and measure them. There is no exemption for these — they require your consent under Article 399(1) of the same act and Article 6(1)(a) GDPR. Where the law requires consent, Google shows its own consent message the first time you open a page with ads, and uses cookies and identifiers for ads only if you agree. If you decline, the site works exactly the same, Google may still show ads that do not rely on them, and the free plan stays free either way.

The consent message is Google’s own (a consent management platform following the IAB Europe Transparency & Consent Framework), and Google remembers your answer in a cookie on this site so it does not ask again on every visit. We do not see or store it. If your browser sends a Global Privacy Control signal, or you have switched advertising off on our choices page, we do not load the advertising script at all, so no message appears. The script is not loaded on sign-in, account or shared-file pages.

You can change or withdraw your choice at any time from the “Cookie settings” link in the footer, and you can clear cookies in your browser. Withdrawing consent does not make what happened before it unlawful, but it stops the processing from then on.

5. Advertising

The free plan is paid for by advertising. We use Google AdSense. Once you consent, Google may set identifiers and use them to select and measure ads, in some cases based on your activity across other websites.

For that processing Google acts as its own controller, not as our processor, which means it decides how it uses that data and answers for it. Its practices are described at policies.google.com/technologies/partner-sites. We do not give Google your email address, your account, or anything about the files you convert.

We do not sell your personal data for money. We never have and there is no plan to. See section 9 for what this means under United States law, where “sharing” is defined more broadly than you might expect.

6. Who else touches the data

Everyone in this list is bound by a contract that limits them to what we instruct, and none of them may use your data for their own purposes — with the one exception of Google for advertising, which is marked as such.

We may also disclose data where the law requires it — a court order or a lawful demand from an authority. We will tell you if that happens to your data, unless we are forbidden from telling you.

7. Data leaving the European Union

Your files stay in the European Union. They are stored on servers in Poland and are processed there.

Some of the services above are United States companies, so some personal data — payment records, advertising identifiers, sign-in details — may be transferred there. Those transfers rely on the EU–US Data Privacy Framework where the recipient is certified under it, and otherwise on the European Commission’s Standard Contractual Clauses together with additional safeguards. You can ask us for a copy of the clauses that apply.

8. Your rights under the GDPR

If you are in the European Economic Area or the United Kingdom, you may ask us to:

• tell you what we hold about you and give you a copy;
• correct anything that is wrong;
• delete it — and you can do that yourself, instantly, without asking: files one by one, or the whole account under Account → Account data;
• restrict what we do with it while a dispute is resolved;
• hand you your data in a portable form, or send it to someone else;
• stop processing based on our legitimate interest, by objecting to it and telling us why;
• withdraw a consent you gave, at any time and as easily as you gave it.

Write to contact@fileflint.app. We answer within a month. If your request is complex we may take longer, and if we do, we will tell you before the month is up and say why.

We make no automated decisions about you that produce legal effects or anything similarly significant. There is no profiling, no scoring, no automated gatekeeping. A daily conversion limit is a counter, not a decision about you.

If you think we have handled your data badly, please tell us first — most of it we can fix the same day. You also have the right to complain to a supervisory authority. In Poland that is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warszawa. If you live elsewhere in the EEA, you may complain to the authority where you live.

9. If you are in the United States

Several states give you rights over your personal information. This section explains them and how to use them. Where a state law uses a term with a specific legal meaning, we use that term.

What we collect, in the categories those laws use

• Identifiers — email address, an anonymous browser key, a truncated IP address.
• Commercial information — which plan you bought and when.
• Internet activity — which conversions you ran, and, if you consent to advertising, information Google collects through its cookies.
• The content you upload, for as long as it is with us.

We do not collect sensitive personal information as those laws define it, and we do not collect biometric data, precise geolocation, or information about your race, religion, health, sexual orientation or union membership. We do not knowingly collect anything from children — see section 11.

Selling and sharing

We do not sell your personal information for money. However, under California law, showing you personalised advertising counts as “sharing” personal information for cross-context behavioural advertising. When you consent to advertising, that is what happens.

You can opt out. Use the Do Not Sell or Share My Personal Information link, which is also in the footer of every page. We also honour the Global Privacy Control signal: if your browser sends it, we treat it as an opt-out automatically and you do not need to do anything else.

Your rights

Depending on where you live, you may have the right to know what we collect and why, to get a copy, to correct it, to delete it, to opt out of sharing for advertising and of profiling, and to limit the use of sensitive personal information — which in our case is moot, because we do not collect any. Exercising any of these rights will never get you worse service or a worse price.

Write to contact@fileflint.app. We may need to confirm you are who you say you are before we act, and for an account that means confirming control of the email address. You may use an authorised agent. If we refuse your request, we will say why, and you may appeal by replying to that refusal — we will answer an appeal within sixty days.

10. How we keep it safe

• Everything travels over an encrypted connection, and files are encrypted at rest.
• Passwords are stored as argon2id hashes. Session tokens are stored hashed too, so a copy of our database does not let anyone sign in as you.
• Conversions run in isolated containers with a read-only filesystem, no privileges and hard limits on time and memory. A malicious file gets a sandbox, not a server.
• Every uploaded file is verified by its actual content, not by its name — a “.jpg” that is not a JPEG is refused before any tool opens it.
• Administrative access is limited, and every administrative action is recorded.

No system is perfectly secure and anyone who tells you otherwise is selling something. If a breach ever puts you at risk, we will notify the supervisory authority within 72 hours and tell you directly where the law requires it — and where it does not require it but you would want to know anyway.

11. Children

FileFlint is not meant for children. You need to be at least 16 to have an account with us in the European Economic Area, and at least 13 in the United States. We do not knowingly collect personal data from anyone younger. If you are a parent or guardian and believe your child has given us data, write to contact@fileflint.app and we will delete it.

12. Changes to this page

When we change how we handle data, this page changes with it, and the date at the top changes too. If a change matters — a new recipient, a new purpose, a longer retention — we will say so on the site before it takes effect, and where the change relies on your consent, we will ask you again rather than assume.

Written to describe what the service actually does. If you find a sentence here that does not match what you observe, that is a bug and we want to hear about it: contact@fileflint.app.