Privacy Policy | PRV5

Learn how PRV5 protects your privacy with encryption and a default-deletion architecture.

Last Updated: November 2, 2026

Introduction

Welcome to 'your secure share link' (hereinafter referred to as 'the Service'). We are committed to protecting your privacy and helping you understand how we collect, use, protect, and delete your information. This Privacy Policy applies to all users of the Service.
Before using the Service, please read and understand this policy carefully. By starting to use the Service, you signify your agreement to the contents of this policy.

1. Information We Collect

To provide the core function of private file sharing, we collect the following types of information when you use the Service:

Information You Provide Actively:

File Content: The images or videos you upload. These files are stored in private, access-controlled storage.
Access Password: We store a one-way hashed version of the password you set. We never store your plaintext password and cannot reverse-engineer it.
Sharing Rules: The file expiration time or maximum access count limit you set.
File Metadata: The original filename of your uploaded file, used for mapping and identification during the upload process.

Information We Collect Automatically:

Security and Log Information: When you interact with the Service (including uploading or accessing files), our servers (provided by Cloudflare) may automatically log your IP address. This information is primarily used to implement rate limiting and CAPTCHA verification to prevent malicious attacks and abuse by automated scripts, thereby protecting the stability and security of the Service.
Anonymized Analytics Data: We collect anonymous website usage information through analytics tools like Google Analytics (GA), such as: visitor's IP address (we have enabled IP anonymization), pages accessed, time spent and interaction behavior, browser type and operating system used, and the preferred language set in the browser to provide a multi-language interface. For pages involving file sharing (such as parcel receive and file request pages), the system pre-masks specific identifiers into generic paths at the browser level (such as /:lang/p/:id and /:lang/r/:token), and never transmits individual parcel identifiers, access keys, or file contents to analytics tools.
Guest device cookie (prv5_did): When you create a parcel without signing in, we set a signed, random device identifier (and keep a copy in your browser's local storage). It's used only to count how many parcels one device creates per day, to prevent abuse. It's kept for one year, contains no personal data, and is never used for cross-site tracking, advertising, sign-in or authorization. The rate-limit counts are deleted automatically after 24 hours.

Member Account Information (only if you choose to sign in with Google):

Account Identifiers: The email address and Google account identifier that Google provides to us. We never receive or store your Google password.
Sign-in Records: The time, IP address and browser information (User-Agent) of each sign-in, used for account security auditing.
Share Association: Shares you create while signed in are linked to your account so you can view and manage them under “My shares”. Using the Service without signing in works exactly as before and creates no account data.
Sender time zone: When you send a parcel by email, we keep your browser time zone with the parcel to show times in the emails. It is deleted with the parcel.
Essential Cookies: After you sign in we set two cookies: one keeps you signed in (marked HttpOnly, so it cannot be read by page scripts); the other only indicates that this browser may be signed in, so we know whether to show the account menu, and contains nothing that identifies you. Both are removed when you sign out.

Report Content:

The subject, description, reported share ID and country code you submit through the “Report” page, used to handle complaints and keep a record of how they were handled.

Payment information (only if you subscribe to a paid plan):

Processed by Stripe: Payments are processed by Stripe, Inc. Your card number and other payment details go directly to Stripe; the Service never receives or stores your full card number.
Transaction records: For accounting, tax, and support purposes we keep subscription and transaction records (plan, amount, currency, time, payment status, and Stripe customer and subscription IDs). If you delete your account, these records are retained as required by law but are dissociated from your email and other identifying data.

Enterprise audit records (Enterprise plans only):

Create, open, download and destroy events for organization parcels (time, parcel ID, size, file count, whether a password or open limit was set, the organization member who acted, and the visitor's country code), so organization admins can run compliance audits. Passwords, file names and IP addresses are never recorded, and records are deleted automatically after 400 days.

2. How We Use Your Information

We use your information only for the following purposes and to the extent necessary:

To Provide and Maintain the Service: This is the primary purpose. It is used to process your file uploads, storage, generate sharing links, verify access passwords, and automatically delete files according to the rules you set.
To Protect Service Security: To implement rate limiting and security measures using IP addresses to ensure the Service is protected from malicious attacks and to safeguard the rights of all users.
To Optimize and Improve the Service: By analyzing anonymized usage data, we can understand how the Service is being used, identify potential issues, improve the user interface and flow, and decide on the direction of future feature development.
Account Management: To let signed-in users view the shares they created and their storage usage, and to destroy shares early when no longer needed.

3. Data Storage, Security, and Deletion

We place extreme importance on the security and lifecycle management of your data.

Data Storage and Security Measures:

Data Storage: Your files, hashed passwords, and related metadata are all stored on Cloudflare's global infrastructure. All storage is set to private and can only be accessed through the Service's backend logic with authorization.
Transport Encryption: All data transmission between you and the Service is encrypted using the HTTPS (TLS) protocol.
Password Security: We use industry-standard one-way hashing algorithms to process your password, ensuring that even in a worst-case scenario, your original password will not be compromised.
Access Control and File Handling: An accessor must provide the correct password to obtain a temporary access link with a very short lifespan. This link will expire automatically in a short period. To enhance security, the Service may perform automated security checks and processing on uploaded files.

Data Retention and Deletion:

Core Design: The core design philosophy of this Service is 'deletion by default.' We only retain your files during the validity period of the sharing conditions you set.
Timing of Deletion: Files will be scheduled for permanent deletion by the system when the 'sharing expiration time' you set is reached, or the 'number of accessible times' is exhausted (whichever condition is met first).
Complete and Irreversible: Once a file is deleted, its content, password hash, and all related records will be permanently removed from our online systems and cannot be recovered.

Retention and Deletion of Member Account Data:

Sign-in Sessions: Sessions expire automatically and are removed by the system (30 days for members, 1 day for administrators). You can also sign out at any time.
The Account Itself: Account data is kept until you delete your account. You can delete it yourself at any time at the bottom of the “My shares” page (for your security, you must have signed in within the last 10 minutes). Your account data, sign-in link and sessions are removed immediately, and all of your unexpired shares are destroyed immediately as well. This cannot be undone.

End-to-End Encrypted Parcels

If you turn on end-to-end encryption when sending, your files, folder structure, file names, file types, title and note are encrypted in your browser first. We keep only ciphertext and never receive your password or a fast hash of it. For these parcels, this section takes precedence over what the rest of this policy says about file names and file content.

What we can see:

The number of parcels and files.
The encrypted size, which is almost the same as the original size.
Upload and open times, counts and countries.
The owner account and the expiry rules.

What we cannot see:

File names, paths, file types, titles, notes and file content.

Limits you should know about:

Passwords cannot be recovered: we keep neither the password nor a backup key, so if it is lost, nobody can decrypt the parcel.
Password strength is encryption strength: short or common passwords could be guessed if data leaks.
Browser temporary files: decryption happens in your browser, and when memory runs low, decrypted plaintext can still be paged to temporary files. The Web has no API to prevent this.
Web code: encryption runs in the web code loaded for that visit, so it cannot protect against malicious code served after this service or its hosting provider is compromised, or against a compromised device.

4. Information Sharing and Disclosure

We promise never to sell, rent, or trade any of your personal information. We may only share information with third parties in the following circumstances:

Service Providers: We rely on trusted third-party service providers to operate the Service, including Cloudflare, Inc. (for core infrastructure), Google LLC (for website analytics and sign-in), and Stripe, Inc. (for payment processing).
Legal Requirements: We may disclose your information to the extent permitted by law when we receive a legally binding request from a government agency, court, or legal process.

5. Third-Party Advertising Services

The Service may contain advertisements provided by third-party ad suppliers (such as Google AdSense). These suppliers may use cookies or other technologies to collect your anonymous information in order to show you personalized ads that you might be interested in.
These third-party ad suppliers have their own privacy policies, and their data collection and use practices are not governed by this Privacy Policy. We recommend that you review their relevant policies for more information.

6. Your Rights and Choices

Control Sharing: You can fully control who can access your files and the lifecycle of your files by setting strict passwords and sharing rules.
Language Preference: Our interface will attempt to detect your browser's language, and you can also switch languages manually.
Analytics Opt-out: If you do not want your access data to be collected by Google Analytics, you can install the official 'Google Analytics Opt-out Browser Add-on' provided by Google.
Right to Use: You have the right to choose whether or not to use the Service. If you do not agree with this Privacy Policy, please stop using it immediately.
Access and Delete Account Data: When signed in, you can see the shares linked to your account under “My shares” and delete your account on the same page. To obtain a copy of your account data, email supports@prv5.com.

7. Children's Privacy

The Service is not designed for children under the age of 13 (or the legal age in your region). We do not knowingly collect personal information from children.

8. Content Complaint and Removal

If you find any file content that involves malicious programs, fraud, infringement of your copyright, or other legal rights, please notify us immediately through the contact information below. We will review and remove the relevant content as soon as possible after receiving the notification.

9. Changes to This Privacy Policy

We may revise this Privacy Policy from time to time. When we make significant changes, we will post the updated version on the Service's website and update the 'Last Updated' date at the top of the page. We recommend that you periodically review this policy to stay informed about the latest privacy protection measures.

10. Contact Us

If you have any questions, concerns, or suggestions about this Privacy Policy, please feel free to contact us via the following method:
Email: supports@prv5.com