Privacy
What fyl.at stores and when it is deleted. There are no accounts.
Files you share
The file is stored in Cloudflare R2, and its name in the file’s record at Cloudflare, until the link expires, its one download is used, or the sender or the operator deletes it. Then the file and its name are deleted. Unfinished uploads are deleted after 24 hours. As a safety net, storage deletes any file still there after 8 days.
A small record without the file name (size, dates and why the link closed) stays for 7 days, so the link can say what happened. A file the operator removed keeps that record for good, so its link stays blocked.
For a password, only a salted PBKDF2 hash is stored (100,000 rounds), plus a keyed checksum that recognises a repeated upload request; never the password itself. Both are deleted with the file. The private management key is stored only as a hash too.
Encrypted files
With end-to-end encryption, the file is encrypted on your device before upload. The key is the part of the link after #, which browsers don’t send to fyl.at. fyl.at stores the encrypted file, its size and when it is fetched, not its name or contents: it keeps a generic name (“fyl-” and the start of the link’s ID), the exact size, two short encrypted headers and a checksum of each uploaded part, until the file is deleted like any other.
Anyone with the full link can open the file, and a lost key can’t be recovered. fyl.at can’t check encrypted files or who sent them, so only open files you expected. In the browser, this relies on the code fyl.at serves. To not depend on fyl.at, use the fyl tool from the GitHub releases and compare its checksum there.
A link without encryption carries the file’s name in its path, which every request for it sends to fyl.at; links with a password carry no name. A one-time encrypted link stays open from the same network for up to 15 minutes after the file was delivered, so a failed save can be retried. Reports refuse details that contain a key.
Link previews
When a link is posted in a chat app, the app’s preview service fetches the download page, which names the file, its size, type and expiry; links with a password show none of that. For a picture up to 8 MB that has no password and allows more than one download, the known preview services also get the picture. That doesn’t count as a download. The chat app keeps its copy on its own servers, and that copy can outlive the link.
Networks
fyl.at does not store IP addresses. Where a limit has to recognise a network (an IPv4 address, or an IPv6 /56; a /64 for one-time downloads), it stores a keyed hash (HMAC) of it instead:
- for upload limits, a hash that changes every day; these entries are deleted about 30 days after the upload.
- for the limit on how much one network stores at once, a hash that doesn’t change; it is kept only while that network’s uploads are stored, and deleted when their storage is released after the files are gone.
- for one-time downloads and wrong password tries, a hash that differs for every file; it is deleted together with the file.
Request rate limits are counted by Cloudflare and not stored by fyl.at.
Usage counts
fyl.at counts events such as a finished upload or a wrong password, each with a code (such as an error or the kind of client, like browser or curl) and a number such as a size. The counts contain no file IDs, names, keys or addresses.
When a page is shown, fyl.at counts a page view with exactly these details: which page it was (home, the report form, this page, a download page or a closed link, never which file), the name of the site that linked to it (or “direct”), a campaign tag from the link (utm_source, utm_campaign) if it has one, the country Cloudflare derives from the connection, a device class (mobile, tablet or desktop), the kind of client (browser, command-line tool or bot) and the browser’s first language. The server counts it; there is no cookie, script or address in it, and nothing identifies a visitor or links two visits.
Request logs
fyl.at runs on Cloudflare, which handles every request. Its logs keep a 10 % sample of requests for troubleshooting, with query strings removed. A logged path can contain a file’s link and name. Cloudflare’s log retention applies.
Reports
A report stores the file’s ID (not the link you entered), the category and details, your name and email if you give them, that day’s hash of your network, and the decisions taken. Files that closed within the last 7 days can still be reported. A case is deleted 183 days after it is closed; one nobody decides closes about 8 days after it was filed, once the file must be gone.
When it is enabled, the report form checks that a person sends it with Cloudflare Turnstile, which sets no tracking cookies; fyl.at passes your token and IP address to Cloudflare to check it and stores neither.
In your browser
The site keeps these in your browser’s local storage, never on the server:
- your recent uploads (up to 20) with their private management links, until you forget them or a day after the link expires;
- an unfinished upload with its private key, but not its password, until it finishes, you discard it, or its 24 hours are up;
- passwords, only if you tick “Remember the password on this device”. Otherwise a password stays in this tab’s session storage until you close the tab;
- the keys of encrypted uploads, and keys you typed into a download page, in this tab’s session storage until you close it; in local storage only if you tick “Remember keys on this device”. Recent uploads keep their links without the key;
- for an unfinished encrypted upload, a checksum of each part it sent, so a resume can tell whether the file changed;
- your colour theme.
To clear them, use “Forget this device” under Recent uploads, or clear this site’s data in your browser. The site sets no cookies and loads no scripts, fonts or trackers from other sites, except Turnstile on the report form when it is enabled; the form has its own address, report.fyl.at, so Turnstile never runs where this site keeps your data. The fyl CLI stores nothing on your computer.
Contact
To report a file, use the report form.