Privacy for file URL workflows

GetFileURL turns files into URLs for apps, APIs, and automations. This policy explains what data the app handles, why it is used, where it is stored, and what controls users have.

Open data requests View retention

Reviewed by: GetFileURL technical team
Updated: June 18, 2026

account datauploaded filesfile metadataanalyticsdata requests

What we handle

Account: Name, email, sign-in identity, workspace membership, and workspace settings.
Files: Uploaded file bytes, file ID, file name, size, type, expiry, delete status, and public or signed URL state.
Requests: Support, abuse, privacy requests, API activity, and product events needed to run the service.

Short answer

What this page answers

No. GetFileURL is built to store and deliver the files users upload, not to sell customer file data.

Reviewed by: GetFileURL technical team
Last updated: 2026-06-18

What we collect

The app keeps the account, file, and activity records needed to run file URLs.

GetFileURL collects only the data needed to provide the service, protect accounts, answer support requests, and improve the product.

Account and workspace data

We use Clerk for sign-in and keep workspace membership, roles, settings, plan fields, and audit records in Convex.

Uploaded files and metadata

File bytes are stored in Cloudflare R2. Convex stores file IDs, names, sizes, content types, expiry times, delete state, visibility, and related lifecycle records.

API and dashboard activity

We keep API key records, upload records, delete records, webhook events, diagnostics, support records, abuse reports, and data requests so the app can be operated and reviewed.

How we use it

We use data to create URLs, manage access, support users, and protect the service.

The product is built around file handoffs. That means the main use of data is to store a file, return a URL, keep the URL available for the chosen window, and then expire or delete it.

Provide file URLs

We store uploaded files, return public or signed URLs, enforce limits, and serve files until expiry or deletion.

Protect accounts and files

We check API key scope, rate limits, file policy, Turnstile responses on public forms, and abuse reports.

Improve the product

Product analytics are disabled when no analytics key is configured. When enabled, event fields that look like API keys, secrets, URLs, file names, file IDs, IPs, or emails are removed before sending.

Vendors

GetFileURL uses a small set of service providers to run the app.

These providers help us authenticate users, store files, store product records, send email, prevent abuse, measure public pages, and understand product events.

Cloudflare

Cloudflare runs the web and API Workers, stores uploaded files in R2, serves CDN URLs, handles Turnstile, and may provide public web analytics and email services.

Convex and Clerk

Convex stores app records and powers dashboard data. Clerk handles sign-in and user identity for the web app.

PostHog and support tools

PostHog may receive product events when enabled. Support, abuse, and email records are used only to respond to requests and operate the service.

Your controls

You can manage file lifetime, delete access, rotate keys, and send privacy requests.

GetFileURL should not be used as permanent public storage by default. Keep important source files in your own systems and use expiry or deletion when a handoff is complete.

Expiry and deletion

You can track returned expiry and delete files through the API or dashboard. If file deletion is delayed, delivery is blocked and the file is marked for follow-up.

API keys

API key secrets are shown when created and stored as a hash after that. Keep keys server-side, rotate them when needed, and remove keys you no longer use.

Privacy requests

Use the dashboard data request area to ask for export, correction, restriction, workspace deletion, or account deletion. You can also email support@getfileurl.com.

FAQ

Common questions

Do you sell customer file data?