Privacy
Last updated 21 August 2026
The short version. We store the files you upload so we can serve them at your link. We do not open them, scan them, read them or train anything on them. Nothing you share is listed publicly or indexed by search engines. Anyone holding your link can open it, so put a password on anything sensitive.
What you upload
Your files are stored in Cloudflare R2 and served from there when somebody opens your link. We keep them until you delete them, until the expiry you set, or — for links made without an account — for seven days.
Alongside the bytes we record what the file is called, how large it is, what kind of thing our detection decided it was, and a fingerprint: a SHA-256 digest of the first four megabytes together with the exact byte length. The fingerprint exists for one purpose — when a file is reported and removed, that fingerprint is blocked so the same file cannot be uploaded again under a different name. It is not used for anything else and it cannot be turned back into your file.
We do not open your files. Detection reads the first few kilobytes to decide which viewer to draw — that is a pattern match on a header, not a person or a model looking at your document.
When somebody opens a link
Each visit records a timestamp, the country Cloudflare reports, whether the request came from a phone, a tablet or a desktop, which browser family it was, and the domain of the referring page. It does not record IP addresses, and there is no cookie, no fingerprinting script and no third-party analytics on any page of this site.
Only the owner of a link sees those numbers, and how much of them they see depends on their plan. We keep the last 100 visits per link and a running total.
Your account
An account holds a username, an email address, a password hash, and — if you turn it on — a TOTP secret and a set of one-time backup codes. Passwords are stored as PBKDF2-SHA256 with a per-account salt and 300,000 iterations of work; they are never stored in a form that can be turned back into your password.
Your email address is stored in the clear so we can send you security notices, and indexed as a SHA-256 hash — meaning the database column used for lookups is not a mailing list. Backup codes and one-time codes are stored only as hashes.
Links made without an account
There is no account to attach an anonymous upload to, so we store a salted hash of the uploading IP address instead. It answers exactly two questions — "was this the same uploader as that one" and "block this uploader" — and it cannot be turned back into an address. It is deleted with the link.
Who else is involved
| Who | What for |
|---|---|
| Cloudflare | Serving the site, storing files (R2), the database (D1), and the bot check on anonymous uploads (Turnstile). |
| Resend | Sending account email — verification codes, password resets, security notices. |
| Dodo Payments | Taking payment for paid plans, through Vapih Pay. We never see or store your card details. |
That is the complete list. There is no advertising network, no analytics vendor and no data broker. Notably, the QR code for a link is drawn on our own servers rather than fetched from a QR service, because a QR service would otherwise be told about every link anybody generates a code for.
Search engines
Every page that shows uploaded content carries X-Robots-Tag: noindex, nofollow, noarchive, and the paths files are served from are disallowed in robots.txt. Only the marketing pages of this site are meant to be found in a search.
That is a strong measure and not an absolute one. If somebody you sent a link to publishes it on a public page, a crawler can reach it from there.
Your rights
You can delete any link at any time from your dashboard, which removes the record, the analytics and the stored bytes. You can delete your whole account, which removes everything above. If you want a copy of what we hold about you, or you have any other question about this, write to support@2l.nz.
If we ever change any of this in a way that matters, the date at the top changes and anybody with an account gets an email about it.