Who we are
FileForge is run by Hanzala Rasool, 52110, Pakistan. We are responsible for the personal data described here. Questions about privacy go to hanzalaphool@gmail.com.
Your files
When you upload a file or give us a link, we store the file on our servers so our software can convert it. Conversion is fully automatic: nobody at FileForge opens, reads or watches your files, and we don't use them to train any model or for any purpose other than producing the file you asked for.
Each file and its result get a random, unguessable address. Anyone who has a download link can download that result until it expires, so only share links with people you trust.
Files are deleted automatically 24 hours after upload, together with the converted result. You can delete them sooner by removing the file in the converter or with the API.
What we collect
| Data | Why | Legal basis |
|---|---|---|
| Files you upload, their names and sizes, and the converted results | To do the conversion you asked for | Performing the service you request |
| Links you ask us to import from | To fetch the file | Performing the service you request |
| Your IP address and a random visitor ID stored in a cookie | To apply the free limit of 10 conversions a day, prevent abuse, and keep the service secure | Our legitimate interest in running a fair, secure service |
| Account details: email address and a hashed password | To let you sign in and to send password reset emails | Our agreement with you (the terms) |
| Pro subscription details from Paddle: customer and subscription IDs, plan, status and renewal date. We never receive your card details | To give you Pro and show your plan on the Account page | Our agreement with you |
| API keys (stored only as a one-way hash) and webhook addresses | To authenticate API requests and notify your app | Our agreement with you |
| Server logs: IP address, time, page requested, browser type, errors | To fix problems and investigate abuse | Our legitimate interest in security and reliability |
| Server names and domains you enter in the email tools, and SMTP login details for a login test | To run the check you asked for. Login details are used once for that test, then discarded: never stored or logged, and removed from the transcript we show you | Performing the service you request |
| Anonymous visit counts: the page visited, the referring website's name, and which conversion was run | To see how many people use the site and which features matter | Our legitimate interest in improving the service |
To count visitors we don't use cookies and don't store your IP address. Each visit gets a short code made from your IP address and browser type mixed with a random value that we throw away every midnight (UTC). That lets us count unique visitors per day, but nobody, including us, can turn the code back into your IP address or link your visits across days.
We don't use third-party advertising, analytics or tracking services, and we don't sell or rent personal data.
Cookies
We only use cookies the site needs to work. There are no advertising or analytics cookies, so we don't show a cookie banner. The checkout on the pricing page is run by Paddle inside its own secure frame; Paddle may set cookies there that it needs to process the payment and prevent fraud.
| Cookie | Purpose | Lasts |
|---|---|---|
ff_anon | A random ID that lets you see your own conversions and applies the free daily limit | 1 year |
ff_auth | Keeps you signed in | Up to 14 days, or until you sign out |
.AspNetCore.Antiforgery.* | Protects forms against cross-site request forgery | Until you close the browser |
.AspNetCore.Mvc.CookieTempDataProvider | Carries a one-time message between pages, such as a new API key | Until you close the browser |
How long we keep it
- Files and results: 24 hours after upload, then deleted from our servers.
- Conversion records (file name, formats, status, IP address): deleted together with the files after 24 hours.
- Subscription records: as long as you have the account; invoices are kept by Paddle as tax law requires.
- Account data and API keys: until you delete your account. You can do that yourself on the Account page, and it takes effect immediately.
- Server logs: up to 30 days.
- Anonymous visit counts: 90 days.
- Backups of the database (accounts, not files) are overwritten within 30 days.
Who sees it
We don't share your files or personal data with anyone except:
- our hosting provider, which stores data on our behalf and is not allowed to use it for anything else;
- our email provider, only to send emails you trigger (such as a password reset);
- Paddle.com, our reseller and Merchant of Record, when you buy Pro. Paddle collects your name, email, country and payment details itself and handles them under its own privacy policy. We give Paddle your email address and account ID so the payment is linked to your account;
- the website you named, when you ask us to import a file from a link or to call your webhook;
- authorities, if the law requires it. We will tell you unless the law forbids that.
Security
Connections are encrypted with HTTPS. Passwords and API keys are stored only as hashes. Files are processed in separate folders with strict time and size limits, and download links are signed so they can't be guessed or altered. No system is perfectly secure, so please don't upload files you aren't allowed to share with a service like ours.
Your rights
Depending on where you live (for example under the EU and UK GDPR), you can ask to see, correct, export or delete the personal data we hold about you, object to how we use it, or ask us to restrict it. Most of this you can do yourself: delete files in the converter, and delete your account on the Account page. For anything else, email hanzalaphool@gmail.com. We reply within 30 days. You can also complain to your local data protection authority.
Children
FileForge is not meant for children under 13, and we don't knowingly collect their data. If you believe a child has created an account, contact us and we will delete it.
Changes
If we change this policy we will update the date at the top. If a change materially affects how we use your data, we will tell signed-in users by email before it takes effect.