Privacy Policy
Last updated: 12 October 2026
This policy explains what personal information R2Cloud collects, why, and how it is handled. We collect the minimum needed to run a file storage service and we do not sell personal information.
What we collect
- Account data: name, email address, password hash, and your plan.
- Files and metadata: the files you upload (stored in private object storage) and their names, sizes, types, folders and timestamps.
- Sharing data: share links you create, their settings, and the email addresses you choose to share with.
- Workspace data: workspace names, memberships, roles and invitations.
- Billing data: Stripe customer and subscription identifiers and invoice status. Card numbers are entered on Stripe’s pages and never reach us.
- Technical data: IP address, browser user agent, session identifiers, and audit log entries describing actions in your account (for security and support).
- Messages: anything you send through the contact form or abuse reports.
How we use it
- To provide the Service: storing and serving your files, enforcing permissions and quotas, and showing in-app notifications (invitations, billing and security notices). We do not send email.
- To keep the Service secure: rate limiting, detecting abuse, investigating reports, and maintaining audit logs.
- To bill paid plans through Stripe.
- To respond to your messages.
We do not use your file contents for advertising, profiling or training models.
Who we share it with
- Cloudflare R2 stores file contents (object storage).
- Stripe processes payments and stores your payment details.
- Hosting and database providers run the application and store metadata.
These providers process data on our behalf under their own security commitments. We may also disclose information when required by law or to protect the Service and its users.
Retention
Account data is kept while your account exists. Trashed files are permanently deleted after 30 days (or sooner if you empty the trash). When you delete your account, your personal files, folders, share links and memberships are removed; audit log entries and billing records may be retained for up to 12 months and as required for tax and accounting purposes. Workspace files remain with the workspace.
Your choices and rights
You can view and update your profile, download your files, delete files, and delete your account from within the app. You can ask us to access, correct or delete personal information we hold about you by contacting us. Depending on where you live, you may have additional rights under laws such as the Australian Privacy Act or the GDPR.
Cookies
We use strictly necessary cookies only: a session cookie that keeps you signed in and short-lived cookies that remember a share-link password you entered. We do not use advertising or cross-site tracking cookies.
Security
See our security overview for how files are stored and protected. No method of storage or transmission is completely secure; we keep improving our controls and will notify affected users of any breach that is likely to cause harm.
Children
The Service is not directed at children under 16, and we do not knowingly collect their personal information.
Changes
We will post updates here and, for material changes, notify you by email or in the app.
Contact
Privacy questions or requests: use the contact page.