Privacy Policy

1. Our Privacy Philosophy

ZeroHost is built on privacy by design: data we never hold cannot be breached, subpoenaed, or leaked. We collect the minimum needed to run the service and make sure your shared content is automatically and permanently deleted.

2. What We DON'T Collect

• Shared Content: We never log, backup, or permanently store the text you share
• Personal Information: No names, emails, or personal identifiers required for basic use
• Browsing History: We don't track what you do outside of ZeroHost
• Location Data: We don't collect or store your geographic location
• Device Information: We don't profile your devices or browsers, and we set no cookies for tracking

3. What We DO Collect (Minimal Data)

3.1 Technical Data for Service Operation

• IP Address: Used for rate limiting and abuse prevention (not stored long-term)
• Usage Metrics: Share count and rate limiting data (expires automatically)
• Share Metadata: Creation time, expiry time, and view count (not linked to you personally)
• Hashed Access Metadata: When shares are accessed, we record a hashed (non-reversible) representation of the accessing IP address, a hashed user agent, and an access timestamp for abuse detection purposes. This metadata is automatically deleted after 24 hours and cannot be used to identify individuals.
• Anonymous Users: For anonymous users, we process minimal technical data (IP addresses, usage counts) on the basis of legitimate interests - specifically, operating a reliable service, preventing abuse, and maintaining security. This processing is proportionate, limited in scope, and automatically expires within 24 hours.
• Subscribed Users: For premium account holders, we process account data (email address, Stripe customer ID, API usage) on the basis of contractual necessity - this data is required to provide the subscription service you've signed up for.

3.2 Aggregate Site Analytics

We use Cloudflare Web Analytics to understand how many people visit the site and which pages they find useful. It is cookieless and stores no identifier in your browser. It records the page path, the referring site, your country, browser type, and page load timing, and reports them only as aggregate totals. It does not build a profile of you, does not follow you across other websites, and cannot be joined back to any share you create.

Two limits apply on top of that:

• Never on share pages: Analytics do not run on any page that displays or confirms shared content, so a share ID is never sent to an analytics service.
• Opt-out signals honoured: If your browser sends Do Not Track or Global Privacy Control, the analytics script does not load at all.

3.3 Premium Account Data (Optional)

• Email Address: Only for premium accounts, used for billing and support
• Payment Information: Processed securely by Stripe (payment data never reaches or is stored by ZeroHost)
• Stripe Customer ID: We store only the Stripe customer identifier to manage your subscription
• API Usage: Request counts and rate limiting for premium features

4. How We Protect Your Data

4.1 Encryption

• In Transit: All data is encrypted using TLS 1.3
• At Rest: Shared content is encrypted using AES-256 in secure cloud storage
• Password Protection: Optional passwords are hashed using SHA-256

4.2 Automatic Data Deletion

• Ephemeral Storage: All shared content is automatically deleted after expiry (1 hour to 30 days)
• No Backups: We maintain no backups or copies of your shared content
• Burn After Reading: Optional immediate deletion after first view
• Usage Data TTL: Rate limiting data expires automatically within 24 hours

4.3 Security Measures

• Infrastructure Security: Enterprise-grade cloud security with restricted access policies
• Rate Limiting: Protection against abuse and automated attacks
• Input Validation: All content is sanitized and size-limited (1MB max)
• No Logging: We don't log the content of your shares

5. Third-Party Services

We use minimal third-party services, all selected for their privacy and security standards:

• Cloud Infrastructure: Amazon Web Services (AWS) with encryption and automatic lifecycle processes
• Payment Processor: Stripe for premium accounts (payment data is processed by Stripe and never touches our servers)
• Content Delivery: Cloudflare CDN for fast, secure content delivery with DDoS protection
• Site Analytics: Cloudflare Web Analytics for cookieless, aggregate visitor counts (see section 3.2)

We have data processing agreements with all service providers to ensure they meet our privacy standards.

We may disclose metadata (not content) to law enforcement when required by law or valid legal process.

6. Data Retention

• Shared Content: Automatically deleted according to expiry time you set (1 hour to 30 days maximum)
• Usage Data: Rate limiting data expires within 24 hours
• Account Data: Premium account information retained only while account is active
• Logs: Technical logs (no content) retained for 30 days maximum for security monitoring
• Site Analytics: Aggregate page view totals retained by Cloudflare for up to 6 months; no individual visitor records exist to delete

7. International Data Transfers

ZeroHost is operated from Queensland, Australia, but your data is processed in secure AWS data centers in the United States (us-east-2 region) for optimal cost and performance. We ensure appropriate safeguards are in place for international transfers, including:

• AWS adherence to international privacy frameworks and SOC 2 compliance
• Encryption in transit (TLS 1.3) and at rest (AES-256)
• Minimal data collection and automatic deletion (ephemeral by design)
• Compliance with Australian Privacy Principles and GDPR requirements

Your GDPR Rights (EU/EEA Users): If you are located in the EU or EEA, you have the right to access, correct, or delete your personal data; withdraw consent where applicable; lodge a complaint with your local supervisory authority. Contact [email protected] to exercise these rights.

8. Children's Privacy

ZeroHost is intended for users aged 16 and over. We do not knowingly collect personal information from anyone under 16. If you are under 16, please do not use this service.

If you believe a child under 16 has used our service or provided personal information, please contact us at [email protected] and we will take appropriate action, including deletion of any associated data.

This age threshold reflects our compliance obligations under the Australian Privacy Act, the EU General Data Protection Regulation (GDPR), and the US Children's Online Privacy Protection Act (COPPA).

9. Changes to This Policy

We may update this privacy policy to reflect changes in our practices or for legal reasons. We will:

• Update the "Last updated" date at the top of this policy
• Post updates prominently on our website

Continued use of ZeroHost after changes constitutes acceptance of the updated policy.

10. Contact Us

For privacy-related questions, concerns, or to exercise your rights:

• Email: [email protected]
• Response Time: We aim to respond within 48 hours
• Privacy Team: Available for privacy concerns and data requests