Legal
Privacy Policy
Klassified encrypts notes and files on your device before they reach us, so we cannot read what you share. We still process some personal data to run the service. This page explains which data, why, who else handles it, and for how long.
1. Who we are
The controller is MAIN OÜ, a private limited company registered in Estonia under registry code 11272196, Soosepa tee 46-2, Pärnamäe küla, Viimsi vald, Harju maakond, 74020, Estonia. For privacy questions or to exercise your rights, email privacy@klassified.app. We have not appointed a data protection officer.
2. What we cannot see
Your browser or desktop app encrypts note text and file contents with AES-256-GCM before upload. File names and file types
are encrypted together with the file. We store the encrypted content plus the technical details needed to decrypt it later,
such as the format version, random initialisation values, whether the share has a password, and an encrypted copy of the
share secret. The secret that unlocks a share is not sent to our API: in a normal link it sits after the #,
which browsers do not send to servers, and in password mode your device uses your password to unlock it.
With the information we normally hold, we cannot decrypt shares, scan their contents, recover them, or hand readable content to anyone, including authorities.
3. What we process, why, and on what legal basis
| Data | Purpose | Legal basis (GDPR) |
|---|---|---|
| Encrypted share: encrypted content and decryption metadata, a random ID, size, creation and expiry time, whether it has a password | Delivering the share once and then deleting it | Contract, Art. 6(1)(b), for you; for people mentioned in a share, our legitimate interest in providing private delivery, Art. 6(1)(f) |
| Account: internal IDs, email address, display name, email-verification status, creation and update times, and a salted password hash if you sign up with a password | Running your account and signing you in | Contract, Art. 6(1)(b) |
| Google sign-in, if you use it: your Google account ID, email, name, profile picture URL, and the sign-in tokens, scopes and expiry times Google returns | Signing you in with Google | Contract, Art. 6(1)(b) |
| Sessions: a session token, the IP address and browser user-agent when the session was created, and its expiry time | Keeping you signed in and protecting your account | Contract and legitimate interest in security, Art. 6(1)(b) and (f) |
| Temporary authentication records: email-verification, password-reset, account-deletion and sign-in state tokens with their expiry times | Completing these actions securely | Contract, Art. 6(1)(b) |
| Usage: number of file shares and bytes shared in your current allowance period, and a log of your file shares (ID, size, creation, expiry and download time, status). Never the file name or contents. | Enforcing plan limits and showing your share history | Contract, Art. 6(1)(b) |
| Subscription: plan, status, period end, scheduled cancellation or plan change, Stripe customer and subscription IDs, update times | Providing the plan you paid for | Contract, Art. 6(1)(b) |
| Billing and accounting records: billing name and address, VAT ID if given, invoices, tax and payment history (held in Stripe for us) | Billing, refunds, and complying with accounting and tax law | Contract and legal obligation, Art. 6(1)(b) and (c) |
| Withdrawal records: date your subscription started, date you withdrew, refund status | Handling your right of withdrawal and the refund | Legal obligation, Art. 6(1)(c) |
| Request metadata: IP address, time, user-agent, requested path, and the country Cloudflare derives from the IP | Serving the site, preventing abuse, choosing display currency and consent rules | Legitimate interest, Art. 6(1)(f) |
| Diagnostics: error messages and stack traces, and timing measurements for about 10% of page loads and requests, with browser, OS and route. Share keys and sign-in tokens are removed first. | Finding and fixing bugs and slow pages | Legitimate interest, Art. 6(1)(f) |
| Aggregate counters: daily totals of sign-ups, sign-ins, password-recovery requests, shares created and shares opened, split by share type, password protection and signed-in status. No user IDs. | Understanding how the product is used | Legitimate interest, Art. 6(1)(f) |
| Abuse reports, and our record of moderation decisions: each warning, removal, suspension, closure, appeal and reversal, with the reason, what it relied on, who decided, the notice we sent and any refund, linked to your account and, after it is closed or deleted, to the fingerprint of its email address | Handling reports and appeals fairly and consistently, being able to reverse a wrong decision, and meeting our obligations under the Digital Services Act | Legitimate interest and legal obligation, Art. 6(1)(f) and (c) |
| Emails you send us | Answering you, handling reports, and meeting our obligations under the Digital Services Act | Legitimate interest and legal obligation, Art. 6(1)(f) and (c) |
| A one-way fingerprint (SHA-256 hash) of the email address of an account we closed under section 6 of the Terms, without the address itself | Stopping someone whose account we closed for abuse, fraud or another serious breach from opening a new one; an account you close yourself is never recorded | Legitimate interest, Art. 6(1)(f) |
| Advertising identifiers and your consent choice, if ads are shown to you | Showing and measuring ads, and personalising them where you agree | Consent, Art. 6(1)(a), where required; otherwise legitimate interest, Art. 6(1)(f) |
When you sign up with an email and password, our sign-in service receives your password over HTTPS and stores only a salted hash of it. This is your account password; a share password never leaves your device.
When you sign up with an email and password, we treat plus-aliased addresses (for example
name+anything@example.com) as the same address as name@example.com to enforce one free account per
person.
What you must provide
You can create notes without an account. An account needs an email address and either a password or Google sign-in, and file sharing needs a verified account. To buy a plan, Stripe needs the payment and billing details its checkout asks for. A VAT ID and agreeing to advertising cookies are optional.
Automated decisions
We automatically check plan allowances and duplicate email aliases. A person reviews every abuse report. We do not make decisions based solely on automated processing that have legal or similarly significant effects on you.
4. Payments
Paid plans are sold by MAIN OÜ and paid through Stripe. You enter your payment details, billing name and address, and optional VAT ID on Stripe's hosted checkout page. Our application never receives or stores your full card number or security code. Stripe calculates VAT, issues invoices and runs the billing portal, and holds billing records that we can access for billing, refunds, tax and support. Stripe also processes payment data as an independent controller for its own purposes, such as fraud prevention and its legal obligations, under its privacy policy.
5. Cookies and browser storage
| Name | What it is for | How long |
|---|---|---|
__Secure-better-auth.session_token and related sign-in cookies | Keeping you signed in; short-lived state cookies protect Google sign-in | Session cookie up to 7 days; state cookies minutes |
classified:theme, classified:lang-pref, classified:dateformat | Your display preferences (browser storage) | Until you clear them |
classified:auth-hint, classified:tier | Remembering whether you are signed in and your plan, to avoid needless requests | Updated as you use the site |
| Google consent and advertising cookies | Recording your consent choices and, where you allow it, delivering and measuring ads; only on informational pages, see section 6 | Set by Google; advertising cookies only with consent where required |
The first three rows are strictly necessary or store a choice you made, so they do not need consent. Our visitor statistics use Cloudflare Web Analytics, which counts page views without cookies and without tracking you across sites. None of these store the content of your shares.
6. Advertising
The free service is designed to be supported by ads from Google AdSense. At the time of this update no ads are shown. When they are, these rules apply: paid subscribers see no ads; ads appear only on informational pages such as How it works, Security and Use cases; and ads never appear on pages where you create, open or download a share, on sign-in, account or billing pages, or on legal pages.
Google and its partners use cookies or similar identifiers to show ads, including ads based on your visits to this and other websites, and to measure them. In the EEA, the UK and Switzerland we ask for your consent through a Google-certified consent management platform, which lets you accept, refuse or change your choices for each purpose and vendor at any time from the "Privacy choices" link in the footer. You can also manage personalised ads in your Google Ad Settings, opt out with participating companies at aboutads.info, and read how Google uses information from sites that use its services. For advertising, Google acts as an independent controller.
7. Service providers and other recipients
- Cloudflare, Inc. - hosting, content delivery, storage of encrypted shares, the accounts database, transactional email and web analytics. Processes data on our instructions.
- Stripe (Stripe Payments Europe, Ltd. and its affiliates) - payments, tax, invoicing and the billing portal. Processor for us, and independent controller for its own purposes as described in section 4.
- Google (Google Ireland Limited and Google LLC) - Google sign-in if you choose it, and advertising as described in section 6.
- Functional Software, Inc. (Sentry) - diagnostics, stored in Sentry's EU region in Germany. Processes data on our instructions.
We give competent authorities information where the law requires it. When we decide on an abuse report, we tell the reporter and the affected account holder what we decided, without disclosing the reporter's identity.
8. Transfers outside the EEA
Cloudflare, Stripe, Google and Sentry are groups with companies in the United States, and their staff or subprocessors may access data from outside the EEA. For transfers to their US companies we rely on the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework, under which these companies are certified, and on the Standard Contractual Clauses in their data processing terms. You can ask for a copy of these safeguards at privacy@klassified.app.
9. How long we keep data
- Shares: a note is deleted when its encrypted content is fetched with Reveal; a file is deleted when its encrypted download is fetched. An unopened share stops being available at its expiry time, 5 minutes to 24 hours after creation. Our storage lifecycle rule then deletes leftover encrypted file data, normally within 2 days of upload.
- Account, Google sign-in data, usage and share log: while your account exists. Deleted when you delete your account.
- Sessions: a session normally lasts 7 days and is extended while you keep using the service. Expired session records are deleted by a daily cleanup.
- Temporary authentication records: until used or expired (at most 24 hours), then deleted by the daily cleanup.
- Billing and accounting records: 7 years from the end of the financial year they relate to, as Estonian accounting law requires. Stripe may keep data longer for its own legal obligations.
- Withdrawal records: 8 years after the withdrawal, once the refund is settled, matching the accounting records above.
- Abuse reports and moderation decisions: kept per case until 2 years after the last decision in that case, then deleted together, unless needed for an ongoing legal matter. You can ask for a copy of the record about you.
- Fingerprint of a closed account's email address: 2 years after we closed the account, then deleted automatically.
- Support emails: 2 years after the conversation ends.
- Diagnostics: deleted automatically by Sentry after at most 90 days.
- Request logs: we do not keep our own access logs. Cloudflare processes request data for security under its own retention rules.
Deleting your account does not delete billing and accounting records, withdrawal records or abuse records, which we keep for the periods above. Shares you already sent stay available until they are opened or expire.
10. Your rights
You can ask for access to your data, a copy of it, correction, erasure, or restriction of processing. Where processing is based on consent or contract, you can ask to receive the data you gave us in a structured, machine-readable format, or to have it sent to another controller. You can object to processing based on legitimate interest. You can withdraw consent at any time; this does not affect processing that happened before.
You can delete your account yourself on the Account page; we email you a link to confirm. For anything else, email privacy@klassified.app. We answer within one month. If a request is complex and the GDPR allows more time, we tell you within that month.
You can also complain to a supervisory authority. In Estonia that is the Data Protection Inspectorate (Andmekaitse Inspektsioon).
11. Children
Accounts are for people aged 16 or over, and we do not knowingly allow accounts for younger people. If we learn that an account belongs to someone under 16, we close it. If you believe this is the case, email us.
12. Desktop apps
The Klassified desktop apps for Windows and macOS create encrypted notes and use the same service, so this policy applies to them. When you press the hotkey you enabled, the app briefly reads the clipboard, triggers Copy to capture the text you selected, puts your previous clipboard text back where possible, encrypts the selection on your device, and copies the resulting link. The app does not record your keystrokes or watch your clipboard in the background. On macOS the hotkey needs the Accessibility permission. Hotkey settings are stored on your device. Clipboard history or sync tools on your device may keep copied links independently of us.
13. Changes
If we change this policy we update the date at the top. If a change materially affects how we use your data, we email account holders before it takes effect.