file.fish

Privacy Policy

Last updated: 29 October 2026

1. Who we are

Squared Lemon, registered in the Netherlands, operates file.fish. We are the data controller for the personal data described in this policy.

2. What we collect

We collect the minimum data needed to run the service:

  • Sender details. When you email a file to bucket@file.fish, we receive your email address, the name shown in your From: header, the email subject and body, and the technical metadata included in the inbound email payload.
  • Files. The attachments you send to file.fish, stored for the lifetime of the access code plus a short post-expiry window. Section 7 covers the timing.
  • Access code activity. The 5-digit codes we generate, when each code expires, and when each file is downloaded.
  • Feedback. If you use the feedback card on the download page: your rating, any comment and the file type.

Senders and recipients do not need an account. We never ask for a password.

3. How we use your data

We use your data to:

  • deliver your file to the person who enters the access code
  • email you the access code, and warn you when a code is about to expire
  • operate, monitor, and improve the service

We do not sell, rent, or share your personal data with third parties for marketing purposes. We do not read your files, and we do not use your files for anything other than delivering them via the access code.

4. Cookies and analytics

We don't use cookies for analytics or advertising. We do not track you across other websites.

The only cookies set by file.fish are strictly functional session cookies (filefish_session and XSRF-TOKEN). These are required for the site to work and are not used for tracking.

We use Fathom Analytics for anonymous, aggregate website statistics. Fathom does not use cookies, does not collect personal data, and is fully GDPR-compliant. No cookie banner is required.

Disclosure: the Fathom link above is a referral link. If you sign up after clicking it, we receive a small discount on our own Fathom plan. It does not change the price you pay.

5. Third-party services

We use the following services to run file.fish:

  • Mailgun. Inbound and outbound email delivery. Mailgun processes the emails you send to bucket@file.fish and the emails we send to you, under their own privacy policy.
  • Fathom Analytics. Cookieless website analytics. No personal data is collected or shared.
  • mood.cards. A small feedback card on the download page, built by us. Stores your rating, any comment, the page address without its query string, the file type and screen size. No cookies, no IP addresses.
  • EU cloud storage. Your files are stored on EU-based cloud infrastructure for the lifetime of the access code.

Each service operates under its own privacy policy. We select services that align with EU data protection standards.

6. Where your data is stored

Your files are stored on infrastructure in the European Union. The app itself runs on EU-based servers. Database records (sender details, message metadata, access codes) live on the same EU infrastructure.

Limited operational metadata may transit through non-EU infrastructure operated by our email provider. These transfers are covered by Standard Contractual Clauses and other appropriate safeguards under GDPR Article 46.

7. How long we keep your data

Files. Access codes expire one hour after we generate them. File binaries are deleted from storage within roughly one hour after code expiry. The post-expiry window is intentional: it lets senders postpone expiry from a one-time signed link we email shortly before the code expires. If a sender postpones, the file persists for the extended validity period plus the same post-expiry deletion window.

Sender records. Your email address and the name from your From: header are kept while you remain active. If twelve months pass without you sending a new message, we anonymize these fields. The email subject and body, and the raw inbound email payload, are cleared within roughly 48 hours after the access code expires. You can request earlier deletion at any time (see "Your rights" below).

Access code and download activity. Records of which codes were generated and when files were downloaded are kept for operational and abuse-detection purposes.

8. Your rights

Under GDPR, you have the right to:

  • access the personal data we hold about you
  • correct inaccurate data
  • request deletion of your data
  • export your data in a portable format
  • object to or restrict certain processing
  • lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens)

To exercise any of these rights, email us at squeeze@squaredlemon.com. We will respond within 30 days.

9. Changes to this policy

We may update this policy from time to time. The "last updated" date at the top reflects the most recent revision.

10. Contact

Privacy questions? Reach us at squeeze@squaredlemon.com.