Privacy statement

This statement covers share.ux.nl, the service for sharing text and files in encrypted form. Last updated on 10 August 2026.

We cannot see what you share

Whatever you type into the screen or drop onto it is encrypted in your own browser before it reaches us. The key for that sits in the last part of the link. Browsers never send that part of an address along with a request, so the key never arrives at our servers. The file names are part of the encrypted portion too.

That means something awkward and something reassuring at once: we can never help you recover the contents if you lose the link, and we cannot hand those contents to anyone else either — not to an attacker, and not on demand.

What we do process

• How many files there are, how large they are together, and whether text is included.
• When the link expires, how often it may be opened, and how often that has happened.
• The IP address and browser version at the moment of creating and of opening.
• Whether a password is set — the password itself is only stored as a hash.
• If you ask us to send email: your address, those of the recipients, and any covering message. That message sits unencrypted in the email.

Why

To make the service work, and to be able to act against abuse. A service that lets anyone offer files anonymously inevitably attracts people with bad intentions. The recorded IP addresses and timestamps are what allow us to do something about that. This is our legitimate interest; for sending email, the basis is carrying out what you ask us to do.

For how long

The contents are deleted as soon as the link expires, is used up or is withdrawn — from our storage and from the database. This happens automatically, several times an hour.

The data listed above is kept for a further 90 days, so that a report of abuse can still be investigated. After that, the record is deleted too. What you shared was gone long before.

Who else processes it

• Cloudflare — storage of the encrypted files, within the European Union, and protection against automated abuse.
• Postmark — delivery of the emails.

Both see only what they need: Cloudflare holds unreadable files without names, Postmark sees the email addresses and the text of the email. If you choose to include the key in the email, it sits in that email as well — which is why we warn you at the moment you make that choice.

Cookies

Only a technically necessary session cookie, which remembers the language you chose and whether you have already confirmed your own email address. No analytics, no trackers, no third-party scripts on the pages where your contents pass through.

Your rights

You may request access to, correction of, or deletion of the data we hold about a shared link. Because we cannot read the contents, this concerns the metadata described in this statement. You can withdraw a shared link yourself at any time using the management link from the confirmation email. Email us at support@ux.nl. You may also lodge a complaint with the Dutch Data Protection Authority.

Contact

UX, support@ux.nl. Abuse can be reported without email, through the link at the bottom of every shared page.