Privacy Policy

In short

Your files never leave your device. Opening, checking, repairing and extracting an archive all happen inside your browser or inside the desktop app.

We count how the site is used, without cookies and without storing any address. We cannot tell who you are, and we do not try to.

Your files are not uploaded

Archives, the files inside them, their names, their contents and any password you type are processed locally and are never transmitted to us or to anyone else.

The safety report you can share creates a link that contains only the result — never the file and never the file names you did not choose to include.

What we do collect

When you use the site we record an event for a page view and for actions such as inspecting, extracting or creating an archive. Each event holds the page path, the page language, the platform (web or desktop), the referring site, a country code supplied by our network provider, and a few technical numbers such as the number of entries, the size in megabytes, the duration, and whether the archive was encrypted.

To count a visitor only once a day we store a hash of a random daily secret combined with your address and browser identification. The secret is different every day and is deleted together with the raw records, so yesterday's hash can never be recalculated. We never store the address itself.

If you administer this service, we store your e-mail address, a hash of your password, your sessions and a log of the changes you make.

What we never collect

File names, folder names, file contents, passwords, encryption keys, or anything read out of your archives.

Your IP address in readable form, a persistent identifier, an advertising identifier, or any profile of you across sites.

Cookies and browser storage

The public site sets no cookies. Your language choice and a few interface preferences are kept in your own browser's local storage and are never sent to us.

Administrators receive one session cookie after signing in. It is strictly necessary for the administration area to work.

If your browser sends Global Privacy Control or Do Not Track, we record nothing at all. You can also switch the counting off yourself in the privacy section of the site.

Advertising

The site may show our own advertisements, which involve no third party and no tracking, and it may show Google AdSense advertisements.

When Google AdSense is active, Google and its partners may use cookies or similar technologies to serve and measure advertisements, subject to their own policies. You can review and change those choices at https://adssettings.google.com and read Google's practices at https://policies.google.com/technologies/ads.

We count how often an advertisement was shown and clicked in aggregate. Those counters hold no information about you.

Who processes the data for us

Cloudflare, Inc. (United States) delivers the website and its network.

Railway Corp. (United States) hosts the application and the PostgreSQL database that holds the aggregated statistics.

GitHub, Inc. (United States) hosts the installer downloads; downloading counts as a visit to GitHub under their policy.

Google LLC (United States) serves advertisements when AdSense is enabled.

This means data may be processed outside the Republic of Korea and outside the European Economic Area, under the safeguards those providers offer.

How long it is kept

Individual usage records and the daily secret are deleted after 90 days. Only day-level totals remain after that, and they contain no identifiers.

Administrator accounts and their change log are kept while the account exists and for up to one year afterwards.

Your rights

You may ask what we hold about you, ask for a copy, ask for a correction, ask for deletion, or object to processing. Write to [email protected] and we will answer within 30 days.

Because we deliberately keep no identifier for visitors, we usually cannot connect a usage record to a person — which also means we cannot single you out. For administrator accounts we can act on every request.

In the Republic of Korea you may also complain to the Personal Information Protection Commission (privacy.go.kr, 118). In the European Economic Area or the United Kingdom you may complain to your local supervisory authority.

How we protect it

Everything travels over HTTPS. Administrator passwords are stored only as a slow salted hash, session tokens only as a hash, and the administration area is closed to anyone who is not signed in.

The database is reachable only by our own service, and the number of fields it accepts from the site is fixed by an allow-list, so unexpected data cannot be stored even by mistake.

Children

The service is not directed at children under 14 (under 16 in the European Economic Area) and we do not knowingly collect their personal data.

Changes to this policy

If we change what we collect, we will update this page and the date above before the change takes effect.

Contact

Questions about privacy, and requests about your data, go to [email protected]. The person responsible for personal data protection is the representative named below.