Privacy Policy

1 Information We Collect

1.1 Account Data (Required)

When you register, we collect:

• Username — a unique identifier you choose
• Password hash — a bcrypt hash of your password; the plaintext password is never stored
• TOTP secret — encrypted at rest with AES-256, used only for two-factor authentication

If you choose to provide an email address (optional during v2 registration), it is stored only for password recovery purposes. You may remove your email at any time from your profile settings.

1.2 Payment Data

If you purchase tokens:

• Bank card payments are processed by our third-party payment gateway (Zarinpal). SHADOW never sees or stores your full card number, CVV, or bank credentials.
• Cryptocurrency payments use on-chain addresses generated per order. Transaction hashes are stored to verify payment completion; no wallet private keys are ever stored server-side.

1.3 Technical Data

• IP addresses — temporarily held in memory for rate-limiting and fraud prevention. They are not logged to disk and are discarded after each request window.
• Encrypted file payloads — ciphertext only. These are stored temporarily until the recipient downloads them, then permanently deleted. We have no ability to decrypt them.
• Session tokens — JWT tokens with short expiry, stored only in your browser cookie or local storage.

1.4 What We NEVER Collect

• Your plaintext files or messages
• Encryption keys (client-side only, never transmitted)
• Metadata about transfers (who sent what to whom, file names, sizes, timestamps)
• Browser fingerprint, canvas fingerprint, or device identifiers
• Location data
• Contact lists or address books
• Any analytics or telemetry data

2 How We Use Your Information

We use the limited data we collect solely for:

• Service operation — authentication, authorization, token balance tracking, file upload/download routing
• Security — rate-limiting, bruteforce protection, fraud detection
• Payment processing — verifying and crediting token purchases
• Support — responding to your inquiries (if you contact us)

We do not use your data for advertising, profiling, training AI models, or any purpose beyond what is strictly necessary to operate the service.

3 Data Retention & Deletion

• Account data — retained until you delete your account. You can delete your account at any time from your profile settings. All associated data is purged immediately.
• Encrypted files — deleted immediately after the recipient downloads them. Files not downloaded within 7 days are automatically purged.
• IP addresses — held in memory only for the duration of the request rate-limit window (15 minutes maximum). No persistent IP logs exist.
• Payment records — retained for 36 months as required by tax and financial regulations. These contain only order IDs, amounts, and payment method; no card details.

4 Cookies & Local Storage

SHADOW uses strictly minimal storage:

• JWT token — stored in an HTTP-only cookie or localStorage for session persistence. This is a security credential, not a tracking mechanism.
• No tracking cookies — we do not use Google Analytics, Facebook pixels, or any third-party tracking scripts. No cookies are set for advertising or analytics purposes.
• No third-party CDNs for fonts or scripts — all resources are self-hosted except Google Fonts CSS (which sets no persistent cookies when used as we do).

5 Third-Party Services

We engage with the following third parties, who each have their own privacy practices:

• Zarinpal — payment gateway for Iranian bank card transactions. Your payment data is subject to Zarinpal's privacy policy.
• Nobitex — cryptocurrency exchange API for generating deposit addresses and checking wallet balances. No personal data is shared.
• Google Fonts — we include font stylesheets from Google Fonts. Google may record your IP address when fetching fonts. As of our implementation, no cookies are set by this integration.

6 Your Rights

Depending on your jurisdiction (GDPR, CCPA, or similar), you may have the right to:

• Access — request a copy of the personal data we hold about you
• Rectification — correct inaccurate data (update your email in profile settings)
• Deletion — delete your account and all associated data at any time
• Data portability — export your data (your token history and account details)
• Objection — object to any processing of your data

To exercise any of these rights, contact us at privacy@shadowfile.ir. We will respond within 30 days.

7 Data Security

We implement the following security measures to protect your data:

• Encryption at rest — TOTP secrets are encrypted with AES-256 before storage. Password hashes use bcrypt with 10 rounds.
• Encryption in transit — all connections use TLS 1.3. HSTS is enforced. We only support strong cipher suites.
• Zero-knowledge architecture — encryption keys never leave the client. Server-side, we hold only ciphertext that we cannot decrypt.
• No logs — the server does not write access logs, error logs containing user data, or audit trails of file transfers.
• CSRF protection — all state-changing API requests require a CSRF token.
• Rate limiting — brute-force and DDoS protection on all authentication endpoints.

8 International Data Transfers

SHADOW's servers are physically located in Iran (Tehran datacenters). By using the service, you consent to your data being processed in Iran. We ensure that appropriate safeguards are in place for any international data transfers, consistent with applicable law.

9 Children's Privacy

SHADOW is not directed at individuals under the age of 18. We do not knowingly collect personal information from minors. If you believe a minor has provided us with personal data, contact us immediately and we will remove it.

10 Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be announced via a notice on the website or by email (if you have provided one). Continued use of the service after changes take effect constitutes your acceptance of the revised policy.

11 Contact

For privacy-related inquiries: