Privacy Policy
What we process, why, and for how long.
Last updated
The short version
We run no analytics, no advertising and no tracking. Normal page and file requests are not written to an access log with IP addresses. Uploaded files are encrypted and we do not hold the key.
This is a translation for convenience. The German version is the legally binding one, and it prevails if the two ever disagree.
1. Controller and contact
The controller within the meaning of the GDPR is:
imageserver.pw – Leon Schmidt
c/o Online-Impressum.de #1158
Europaring 90
53757 Sankt Augustin
Germany
Email: [email protected]. Further details are in the Impressum.
No data protection officer has been appointed, because the conditions in section 38 BDSG are not met. Please send privacy enquiries to the address above.
2. Your rights
As a data subject you have the right
- to know whether and which data we process about you, and to receive a copy of it (Art. 15 GDPR);
- to have inaccurate data corrected and incomplete data completed (Art. 16 GDPR);
- to have your data erased (Art. 17 GDPR) or, where further processing is required, to have it restricted (Art. 18 GDPR);
- to receive the data you provided in a common format and to have it transmitted to another controller (Art. 20 GDPR);
- to object to processing we base on a legitimate interest (Art. 21 GDPR);
- to lodge a complaint with a supervisory authority (Art. 77 GDPR). Ours is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia.
While signed in you can exercise the rights of access and portability yourself at any time, see section 19.
3. What we deliberately do not process
Starting with what does not happen, because it puts the rest of this document in context:
- No analytics service, no tracking pixel, no ad networks, no profiling.
- No access log with IP addresses for normal requests to pages and files. Uploading and reporting are different, see sections 8 and 15; where IP addresses occur otherwise, sections 16 and 17 say so.
- No inspection of the content of uploaded files. They are stored encrypted and we do not hold the key, see section 8.
- Opening a short link only increments a counter. No record is created per visitor, see section 9.
- No sale or disclosure of data for advertising purposes.
4. Serving the website
To send you a page at all, we process the connection data your browser transmits, in particular your IP address. That happens transiently, to answer the request.
We also limit how many requests are allowed in a given period, to prevent abuse. A counter is kept in memory for that, tied to your user key or, where there is none, to your shortened IP address. This counter is not stored permanently and expires after a minute.
The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is the secure and stable operation of the service.
6. Account and sign in
There are two ways to create an account, and they can be linked afterwards.
Through Discord. We request the
identify and
guilds
scopes, which gives us your Discord ID, your username, your avatar and the list of your
servers. We use the server list solely to check whether you are a member of our Discord
server and to determine your boost status. We do not store the list. We do keep a refresh
token so that this check remains possible without signing in again. The provider is Discord
Netherlands B.V., Amsterdam.
With email and password. In that case we store your email address and a hash of your password. The password itself is not stored and is not readable by us.
In both cases we additionally create a display name, your personal API key, your settings, your plan, and timestamps for creation and modification.
The legal basis is Art. 6(1)(b) GDPR, since the processing is necessary to perform the user agreement.
7. Two-factor authentication
You may secure your account further, at your option. For an authenticator app we store the corresponding secret in encrypted form, for a passkey the public credential identifier, a counter and a name you choose. Recovery codes are stored as hashes only.
The legal basis is Art. 6(1)(b) GDPR together with Art. 32 GDPR, which is the obligation to take appropriate security measures.
8. Uploads and encryption
Every uploaded file is encrypted with AES-256 before it is written to disk. The key generated for it is not stored on our side, it sits in the link you receive. The stored files are therefore unreadable to us, and we cannot restore them either.
Alongside the encrypted file we store, for each upload:
- a random identifier, the original file name, the file type and the size;
- the link to your account, where the upload was made while signed in;
- a deletion key and the settings for the link preview;
- a view counter, kept without any reference to individual visitors;
- optionally the file password encrypted to your public key, if you set that feature up;
- a checksum of the file (SHA-256), which is how several copies of one file can be recognised;
- the IP address the upload came from, for 30 days.
We store the IP address of an upload for one purpose only: so that reports about a file and lawful requests from authorities can be answered at all, and so that repeated abuse can be stopped. It is not analysed, it is not linked to anything else you do on the site, and it is removed from the record automatically 30 days after the upload. The checksum describes the file rather than you and says nothing about its content. Where a file is removed for what it contained, its checksum is kept so that the same file cannot be uploaded again; what is kept is the checksum, never the file. The legal basis for all of this is Art. 6(1)(f) GDPR; our legitimate interest is the prevention of abuse and meeting our obligations as a hosting provider.
Uploads made without an account are deleted automatically once they are seven days old. Uploads made with an account remain until you delete them or your account.
The legal basis is Art. 6(1)(b) GDPR. If you upload files showing other people, you are the controller for that.
9. Short links
For a short link we store the destination, the code, the domain used, the deletion key, the link to your account and the creation date.
When it is opened we increment a counter and note the time of the last visit. No record is
created per visitor, and no IP address or referrer is stored. On redirect we also set
Referrer-Policy: no-referrer,
so the destination does not learn where the visitor came from.
The legal basis is Art. 6(1)(b) GDPR.
10. BioLink pages
If you create a BioLink page, we store the content you enter, such as display name, description, links, images and styling settings.
That page is explicitly public and can be opened by anyone who has its address. Everything you put there, you publish yourself. The legal basis is Art. 6(1)(b) GDPR.
11. Custom domains
If you connect a domain of your own, we store the domain name, its validation status and the link to your account. For setup and the certificate we transmit the domain name to Cloudflare, see section 16.
The legal basis is Art. 6(1)(b) GDPR.
12. Email
We only send messages that the service requires: confirming your email address and resetting your password. There is no newsletter and no promotional mail.
Sending runs over a mail server we operate ourselves. No external provider is involved. The tokens belonging to a confirmation or a reset are stored as hashes only and expire quickly.
The legal basis is Art. 6(1)(b) GDPR.
13. Payments and subscriptions
Paid plans are billed through Mollie B.V., Keizersgracht 126, 1015 CW Amsterdam, Netherlands. Mollie is our payment service provider, not our counterparty: the contract for the plan is concluded with us, and Mollie only collects the money and hosts the payment page for it. Its privacy policy applies to that page.
Payment details such as card or account data never reach us. When a checkout starts we transmit your username, your email address, the chosen plan and the amount due to Mollie. What we receive back and store is an identifier for you as the payer, an identifier for the subscription, its status and the end of the current period.
The legal basis is Art. 6(1)(b) GDPR, and for retaining records additionally Art. 6(1)(c) GDPR together with the commercial and tax retention periods.
14. Discord bot and boost status
A bot runs on our Discord server which assigns a role to signed-in members and determines how many boosts you contribute. We store the number of boosts together with the time of the last check, because it translates into extra storage and a higher upload limit.
The legal basis is Art. 6(1)(b) GDPR. If you use our Discord server, Discord's own privacy policy applies to that as well.
15. Reports and abuse
Reports. If you report a file through the report button, we store the category you picked, whatever you added in the text field, the reference to the file, and for 30 days the IP address the report came from. The address only serves to recognise the same person reporting the same file repeatedly and to contain abuse of the report function. Giving an email address is optional and is used solely to tell you what we decided. The report is additionally forwarded into an internal Discord channel. For the most serious categories the reported file is blocked immediately, meaning it is no longer served, before a person has looked at it; the block is lifted if the review finds nothing. If you report by email, we process what your message contains, as far as it is needed to deal with it.
Aborted uploads. If a transfer breaks off, our operational log keeps a warning containing the IP address, so that repeated failures can be narrowed down.
The legal basis is Art. 6(1)(f) GDPR, and for legal notices additionally Art. 6(1)(c) GDPR. Our legitimate interest is the prevention of abuse.
16. Cloudflare as a CDN
To protect against attacks and to speed up delivery we use Cloudflare, a service of Cloudflare, Inc., 101 Townsend Street, San Francisco, California 94107, USA.
Every request to our site passes through Cloudflare. In doing so Cloudflare processes in particular the IP address, information about the browser and device, the address requested and the time of access, and it may set a cookie to detect malicious traffic. Suspicious requests can be blocked or challenged. We also transmit domain names when you connect a custom domain.
The legal basis is Art. 6(1)(f) GDPR, our legitimate interest being secure and available operation. The transfer to the USA is based on the European Commission's standard contractual clauses; Cloudflare is additionally certified under the EU-US Data Privacy Framework.
More at cloudflare.com/privacypolicy.
17. Hosting and operational logs
Our servers are located in Germany and operated by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen. Hetzner processes the data arising there as a processor on our behalf, under a contract pursuant to Art. 28 GDPR.
For troubleshooting we keep an operational log of the application, which we send to a log database we run ourselves. It contains events such as completed uploads and errors that occurred, in individual cases with an account identifier. We do not keep a per-request access log with IP addresses.
We take daily backups of the system. Deleted data may still be contained in them until the backup in question is overwritten. The legal basis is Art. 6(1)(f) GDPR.
18. Retention at a glance
| Data | Duration |
|---|---|
| Uploads made without an account | Deleted automatically once they are seven days old |
| Uploads with an account, short links, BioLink page | Until you delete them or your account |
| IP addresses on uploads and reports | 30 days, then removed from the record automatically |
| Reports | Kept as a case, with the IP address in them removed after 30 days |
| Account data | Until the account is deleted |
| Confirmation and reset tokens | Until they expire, then deleted |
| Billing records | For the statutory retention periods, up to ten years |
| Backups | Until the backup in question is overwritten |
19. Data export and deletion
While signed in you can trigger a full export of the data we hold about you. That serves your right of access under Art. 15 GDPR and your right to data portability under Art. 20 GDPR directly.
Individual uploads and short links you delete yourself, in the dashboard or through the deletion link that came with them. To have your entire account and everything belonging to it deleted, an informal message to [email protected] is enough.
Excluded is data we are required to retain by law, and copies in backups until those are overwritten.