Privacy Policy

Who we are

File Link Pro at filelink.pro is operated by SKB HOLDINGS LLC, based in Montana, United States. Contact our shared business-tools support team at hello@filelink.pro for privacy requests. Identify File Link Pro in your message.

Information we process

Free sharing does not require an account. We store encrypted file contents, file names, sizes, content types, encryption initialization values, expiry dates, download-request counts and sharing settings. Optional sharing passwords are stored as salted hashes. Premium accounts also include an account identifier, email or phone number, subscription status, transfer history and hashed API keys. Authentication and profile information are handled by Clerk.

One-off transfers do not require an account. We retain a transfer order, quoted amount, payment identifiers and payment status to verify payment, support retries and handle refunds. Stripe collects your receipt email and payment details and maintains payment records. Our application database does not store full payment-card numbers. Support messages contain the information you choose to send. Hosting and service providers may process IP addresses, browser information, request timestamps and error logs. Application rate limiting uses keyed hashes of network addresses rather than storing raw addresses in its rate-limit records.

What end-to-end encryption means here

File contents are encrypted before upload and decrypted in the recipient’s browser. The decryption key is included after the # in the share link and is not sent with the upload or ordinary HTTP request. File names, sizes and settings are not end-to-end encrypted. Anyone who obtains the complete link can use its key, subject to the service’s access controls. Protect the complete link and share it only with intended recipients.

For ordinary link-only sharing, we cannot recover a lost decryption key. Encryption does not protect a compromised device or a link that a recipient forwards. A recipient may retain a downloaded copy after a link expires or is revoked.

Purposes and providers

We use information to deliver files, authenticate accounts, manage subscriptions, enforce sharing settings, prevent abuse, diagnose failures, respond to requests and meet legal obligations. We do not sell personal information or use transfer information for targeted advertising.

We use Cloudflare for hosting, delivery and object storage; Convex for application records and backend processing; Clerk for authentication and subscription billing; Stripe for payment processing; and Resend for optional recipient email notifications. Providers may process information in the United States and other countries. Their privacy terms also apply to their services. We may disclose information when necessary to comply with law, protect people or the service, investigate abuse, or transfer the business subject to applicable privacy obligations.

Recipient email notifications

Premium senders can request transactional emails to specified recipients. We process recipient addresses, delivery status, file metadata and email contents. By default, the private link is shared separately. If a sender chooses to include the complete download link, its decryption key is explicitly sent to our backend, queued with the email, and processed by Resend and email providers. This is similar to a sender sharing the link through their own email service. Anyone who obtains the complete link has its key, subject to access controls. We disable email open and click tracking.

Finalized email bodies are scheduled for removal from our delivery queue after seven days; abandoned queue records are removed after 28 days. Delivery metadata may remain in transfer history. Provider logs, backups and recipients’ mailboxes follow their own retention practices, and revocation cannot remove an email already delivered.

QR codes and Apple Wallet passes

QR codes and printable cards are generated on your device and contain the complete private link, including its decryption key. Creating an updating Apple Wallet pass explicitly sends that key to our signing service. We retain an encrypted copy, separate from the encrypted file, to sign and refresh the pass. This optional sharing path gives File Link Pro access to the key while the pass is active. The pass and its private link are also processed by Apple when you add it to Wallet. Anyone with a copy can use the link, subject to access controls.

For automatic updates, we store a Wallet device identifier, push token, pass registration and file availability. Apple receives notifications to refresh the pass. We remove registrations when a device unregisters or Apple reports it invalid. The retained encrypted key is cleared when the pass is refreshed after expiry or revocation; pass metadata may remain to serve its expired or revoked state. Backups follow provider retention practices. Revocation cannot erase a pass, printed card or downloaded file already held by a recipient.

Retention and deletion

Expired and revoked links stop serving new downloads. Background jobs remove stored ciphertext after expiry or revocation; service failures may delay physical deletion. Short-lived download authorizations already issued may remain usable briefly. Abandoned uploads are cleaned up separately. Transfer history and account metadata may remain after ciphertext is removed. Canceling Premium does not erase your account or existing transfer history, and previously issued links follow their own expiry settings.

To request account information, correction or deletion, contact hello@filelink.pro. We may verify your identity and authority before acting. Limited billing, security and legal records may be retained as required or reasonably necessary. Backups and provider logs may not disappear immediately. We cannot delete copies already downloaded by other people.

Cookies, storage and your rights

Necessary cookies support sign-in and account security. Browser storage remembers your theme and keeps an in-progress transfer’s recovery token and decryption key in the current tab until completion. Closing the tab may remove recovery information. Large downloads may temporarily use the browser’s private local storage to decrypt without loading the entire file into memory; the app removes its temporary copy after handing it to the download manager. Blocking necessary storage may prevent account features from working. We do not place advertising trackers in the application.

Depending on applicable law, you may have rights to access, correct, delete, restrict or object to processing, obtain a copy of your information, or complain to a privacy regulator. Where a legal basis is required, processing may rely on providing the service you request, legitimate interests in operating and protecting it, legal obligations, or consent where required. Contact us to exercise your rights.

Changes and eligibility

The service is intended for adults and business use. We do not knowingly solicit accounts from children. Updates to this policy carry a new effective date, with additional notice where required.