Privacy
This page describes the personal data StripR actually holds, why it holds it, and when it is deleted. It describes what the code does today — not what we intend it to do.
Why you received an email from us
Your address is in StripR because someone invited you to a project, or sent you a share link. We did not obtain it from anywhere else, and we do not use it for anything but delivering what was sent to you. Every email from a project carries a link to stop that project's updates; the emails that let you in — an invitation, a new link, a code — still arrive.
What we hold, and for how long
| Data | Why we hold it | Legal basis | Retention |
|---|---|---|---|
| The email address of a person invited to a project or sent files in it, the name typed for them, if any, the date of their last visit to the project, and the project's history: who removed whom, who left, and who was given the power to administer, by whom | To send them their personal link and the project's emails, and to name them to the people of the project: every member sees their name; only they and the project's administrators see their address. The date of the last visit serves only to show the person what arrived while they were away. The history tells the people of the project why someone is no longer there, and tells its administrators that someone new administers it. Someone who receives files from a project sees the name and the address of who sent them. | Legitimate interest — the invitation is a transactional message sent on behalf of the person who invited you. | The date of the last visit, and the record that the person was given the power to administer, are deleted as soon as the person leaves the project or is removed from it. The project's history lasts as long as the project, and stops naming a person once their name is anonymised. The address and the name are anonymised 30 days after the person leaves the project or is removed from it — unless they unsubscribed from it: the address is then kept, precisely to honour that request (see below), and the name is erased. The address of someone who was sent files without being a member is kept as long as files are addressed to them in the project. This applies to the project: a copy of the address stays in the address book of the person who invited them. |
| The messages written under what was sent in a project, and who downloaded each file or opened each link, with the first and last time | To keep the exchange about a delivery with it, and to show the people who see what was sent that it was received. They are shown with names, never with an address. | Legitimate interest — the exchange and its receipt are the service the project provides to its people. | As long as the project exists. Once a person's name is anonymised, their messages and downloads stay but no longer name them. |
| When someone deposits files on a request through the link they received: the first name they typed, kept with their deposit | To show the person who asked for the files who deposited them, next to “deposited through the link sent to” and the name of the person the link was sent to — never as a proven identity, and never with an address. | Legitimate interest — the person who asked needs to know who answered. | As long as the depositor's name is kept in the project: it is erased when their name is anonymised 30 days after they leave the project or are removed from it. For someone who is not a member, as long as the project exists. While you deposit, your browser session remembers which link you opened (not the link itself), for as long as the session lasts. |
| The email addresses in your address book: the people you added to a project | To suggest them when you add someone to a project. Only you can see your address book. | Legitimate interest — saving you from typing the same address again. | Kept for as long as its owner keeps it, and deleted with their account. A person leaving a project does not remove their address from the address book of whoever invited them. There is no screen to manage it yet — write to the privacy contact below. |
| A recognised device: a random key kept in a cookie on your device, which says nothing on its own. We keep only a fingerprint of that key, linked to the project, with the date you last proved your address and the date of your last visit — no IP address, no description of your browser | So that you are not asked to prove your address again on a device you already used for this project. | Necessary for the sign-in you asked for — a cookie used for authentication, which needs no consent. | Deleted once the project no longer recognises the device: after 30 days without a visit, and at most 90 days after your last proof. "Forget this device" removes it from that project at once. |
| A one-time code to enter a project. It exists in clear only in the email we send you; we keep only a fingerprint of it | To check that you can read the mailbox you were invited at. | Necessary for the sign-in you asked for. | Deleted 1 day(s) after it was sent. |
| The email address of someone you sent a share link to | To deliver the link they were sent, and to show the sender whether it went out. | Legitimate interest — a transactional message you asked us to send. | Kept while the share is live. Deleted 30 days after the share expires or is removed. |
| The email address of the person who created a share | To identify the sender, and to let them claim their shares with an account. | Necessary to provide the service you asked for. | Kept for as long as the share exists. |
| Access logs: for a shared link, a pseudonymised fingerprint of the visitor (a hash of IP address and browser); for a project, the identifier of the person's entry in that project. Plus what was accessed, or refused, and when | To keep an honest record of what was served, and to answer abuse reports. | Legitimate interest — security and abuse handling. | No defined retention today: these logs are append-only by design and are not deleted. The fingerprint is pseudonymised — it could be traced back to a person if both our database and our application key were compromised. A project's log holds no address itself; the entry it points to loses the address 30 days after the person leaves the project, on the same terms as the row on people invited to a project. |
| Session data: IP address and a description of your browser. While you wait for a code to enter a project, it also records which address asked for it — never the code | To keep you signed in, or to let you into a project once you have proved your email address. | Necessary to provide the service. | A session expires after 7 day(s) without activity; an expired session is deleted by a clean-up that later visits to the site set off. The mention of the address that asked for a code is dropped when the code is typed, or the next time the project's door is opened after the code has expired — otherwise it goes with the session. If you tick « Remember me » when signing in, a separate cookie keeps you signed in on that device until you sign out. |
| The name and email address of a person who created an account | To sign you in, and to link the accesses you were given to your account. | Necessary to provide the service you asked for. | Kept for as long as the account exists. There is no self-service deletion screen yet — write to the privacy contact below and a human will erase it. |
Shares you chose to keep
A share you keep permanently never expires, so the addresses you sent it to are kept for as long as that share exists — the link still works, and we need the address to have delivered it. Remove the share and those addresses are deleted 30 days later, like any other.
If you unsubscribed from a project
When you unsubscribe from a project, we keep your address on that project's list — precisely so that we can honour your request. Deleting it would mean forgetting it, and the project's updates would reach you again. The emails that let you into the project still arrive.
If you want your address erased entirely, write to us at the privacy contact below and we will do it by hand.
Your rights
You can ask what we hold about you, ask for it to be corrected, or ask for it to be erased. There is no self-service erasure screen yet — write to the contact below and a human will handle it.
Privacy contact: [to be completed]