Privacy Policy
Last updated: October 15, 2026
This policy explains what The Black Files ("we") collects when you use The Black Files (the "Service"), why, how long we keep it, and your choices. We collect the minimum needed to run a file-sharing service responsibly and to deal with abuse.
1. What we collect
| Data | When | Why | Retained |
|---|---|---|---|
| The file you upload, its original filename, size, detected type, a SHA-256 hash, and a private management token (the deletion link shown to you after upload) | Every upload | To provide the download link; the hash lets us block known abusive files | File: until expiry or deletion (15 min – 90 days). Metadata and hash: 180 days after deletion |
| Uploader IP address and browser user-agent, upload timestamp | Every upload | Abuse prevention, rate limiting, responding to legal requests | 180 days after the file is deleted |
| Downloader IP address, user-agent, timestamp | Every download | Abuse investigation, statistics | 90 days |
| Email address, password (hashed with a modern one-way algorithm), registration IP and user-agent, last login time and IP | When you register / sign in | To operate your account and secure it | Until you delete your account. Unverified accounts are deleted after 24 hours |
| Page views: path, timestamp, user-agent, referrer, and a salted hash of your IP (the salt rotates daily and is discarded, so the hash cannot be reversed to your address) | Browsing the site | Traffic statistics (unique visitors per day) | 180 days |
| Abuse reports you submit (file ID, reason, description, optional email, your IP) | When you report a file | To investigate the report and prevent form abuse | Indefinitely for resolved legal matters; otherwise 1 year |
| Failed and successful sign-in attempts (IP, email, timestamp) | Sign-in, password reset, verification resend | Brute-force protection | 7 days |
| Administrative audit log (actions taken by staff and by the system on files and accounts) | Ongoing | Accountability, legal compliance | 365 days |
We do not use third-party analytics, advertising networks, or tracking pixels. The admin dashboard loads a charting library from a public content delivery network (cdnjs.cloudflare.com); this is only requested by staff browsers, never by yours.
2. Cookies
We set a single session cookie (bfsess) to keep you signed in and to protect forms against cross-site request forgery. It is strictly necessary, contains only a random identifier, and expires when you close your browser. We set no other cookies.
3. File contents
We do not open, scan, index, or analyse the contents of files except (a) to compute a cryptographic hash, (b) to detect the file type for the download page, and (c) when a file is reported or we have reason to believe it violates our Terms, in which case staff may review it. Anyone with a file's link can download it until it expires; treat links as secrets. Files are stored unencrypted on our servers; encrypt sensitive files yourself before uploading.
4. Legal basis (for users in the EU/UK)
We process account data to perform our contract with you; upload, download, login and audit records on the basis of our legitimate interests in preventing abuse, securing the Service, and complying with legal obligations; and we process and disclose data where required by law. Where we rely on legitimate interests we have balanced them against your rights and limited retention accordingly.
5. Sharing and disclosure
We do not sell or rent personal data. We share it only:
- with our hosting and email delivery providers, who process it on our behalf under contract;
- with law enforcement, courts, or regulators in response to a valid legal request (subpoena, court order, warrant, or emergency request involving imminent harm), or as otherwise required by law;
- with the National Center for Missing & Exploited Children (NCMEC) and relevant authorities when we identify child sexual abuse material, as the law requires; in such cases we preserve and disclose the file and all associated uploader and downloader records;
- with a copyright holder's agent, limited to confirming removal of a reported file; we do not share uploader identity with complainants without legal process;
- in connection with a merger, acquisition, or sale of assets, subject to this policy.
We may preserve data beyond the retention periods above when required by a legal hold, an ongoing investigation, or to establish, exercise, or defend legal claims.
6. Security
Connections are encrypted with TLS. Passwords are stored only as salted one-way hashes. Uploaded files are stored under random names outside of public web access and are served only through an access-checked endpoint. Access to administrative tools is restricted to authenticated staff and is logged. No system is perfectly secure; if we learn of a breach affecting your data we will notify you as the law requires.
7. Your rights and choices
- Delete files at any time from your dashboard (members) or with the private management link shown once after upload (everyone, including guests), or let them expire.
- Delete your account from your dashboard; this removes your account and all of your active files immediately. Metadata of past uploads remains for the abuse-retention period above and is then deleted.
- Access, correction, portability, restriction, objection: depending on where you live you may have these rights. Contact us at abuse@theblackfiles.org. We may need to verify your identity before responding, and we respond within the time required by law (generally 30 days).
- Complaints: EU/UK users may lodge a complaint with their local data protection authority.
8. Children
The Service is not directed at children and we do not knowingly collect data from anyone under 18. If you believe a minor has provided us data, contact us and we will delete it.
9. International transfers
Our servers may be located outside your country. By using the Service you understand your data may be processed where data protection laws differ from your own. Where required we rely on appropriate safeguards such as standard contractual clauses.
10. Changes
We will update this policy when our practices change and revise the date above. Material changes will be announced on the Service.
11. Contact
The Black Files — abuse@theblackfiles.org