ShredHub

Privacy policy

How ShredHub processes data — built around data minimization.

This is a working draft. The final version will be reviewed by legal counsel before launch.

1. Controller

[Company name, address, register number — to be added] Email: privacy@shredhub.world

2. Core principle: your files never leave your device

ShredHub analyzes and cleans files entirely in your browser. There is no upload endpoint. Files are not transferred to our servers, not stored, and not processed by us at any point.

Only if you explicitly save a scan to your history do we store the metadata report (file name, size, type, risk score, extracted metadata fields) — never the file itself.

3. Data we process

| Data | Purpose | Legal basis | Retention | | --- | --- | --- | --- | | Email address, password hash, display name | Account management, login | Art. 6(1)(b) GDPR | Until account deletion | | Scan reports (opt-in) | Your personal scan history | Art. 6(1)(a) GDPR | Free: 7 days · Pro: until deletion | | Usage counters | Plan limits and quota | Art. 6(1)(b) GDPR | Current billing cycle | | Audit log (login events, plan changes, hashed IP) | Security, abuse prevention | Art. 6(1)(f) GDPR | 90 days | | Error reports (if enabled) | Stability of the service | Art. 6(1)(f) GDPR | 30 days |

IP addresses are only stored in hashed form in the audit log.

4. Cookies

We only use essential cookies: a session cookie for your login and a preference cookie for language and theme. No tracking, no advertising, no third-party analytics on app pages.

5. Processors

We use carefully selected service providers:

  • Hosting & database: Railway (server hosting, PostgreSQL)
  • Email delivery: Resend (verification and password reset emails)
  • Error monitoring: Sentry (with strict scrubbing, no session recording, no personal data)

All providers process data on our behalf under data processing agreements.

6. Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and objection. You can delete your account and all stored data at any time. You also have the right to lodge a complaint with a supervisory authority.

7. Security

Passwords are stored with bcrypt, sessions use rotating refresh tokens, all traffic is encrypted via TLS. Metadata parsing runs in a sandboxed web worker on your device.

8. Contact

For any privacy question, contact privacy@shredhub.world.