Privacy Policy

This Privacy Policy explains what personal data we process when you use the website ftpie.com, the FTPie app, and FTPie's online services: FTPie links on ftpie.link and FTPie mail. It also covers people who receive a link or an email shared through FTPie.

1. Who Is Responsible

The controller of your personal data is Vladyslav Fedoniuk, who runs FTPie as a sole proprietorship registered in Poland, NIP 8133881618 ("we", "us", "our"). You can reach us at contact@ftpie.com or by post at c/o BitQuail Sp. z o.o., Biznes Zone, ul. Rejtana 20A, Rzeszów, Poland. BitQuail Sp. z o.o. provides that correspondence address only and does not handle your personal data.

The same operator runs BackupKit on the same infrastructure; backupkit.io's privacy policy covers it.

2. What Stays on Your Device

FTPie is a desktop app. The following stay on your device and are never sent to us:

• your files and their contents, which travel directly between your device and the servers and storage services you connect to
• your passwords, keys and storage credentials, and your connection details
• sign-ins to cloud storage, which happen between your browser and the provider; the resulting access is stored on your device
• your settings, history and the app's log files, unless you send a log to us in an error report

If you connect an AI assistant to FTPie through its MCP server, that connection runs on your device. The assistant's provider receives what the assistant reads, under that provider's own privacy policy; none of it passes through our servers.

3. What the FTPie App Sends to Us

License and trial checks

When the app starts, and when you start a trial or activate, extend or deactivate a license, it sends your license key and a device identifier to ftpie.com. The app derives the device identifier from Windows; it identifies the installation, not you. We keep your license (its key, plan and expiry, and the email address it was bought or verified with), the devices it is activated on, and a record of license checks for each device and day, with a keyed one-way hash of the last IP address seen.

Why: to check licenses, apply the device limit and the trial rules, and prevent misuse. Legal basis: our contract with you (Art. 6(1)(b) GDPR) and our legitimate interest in preventing license misuse (Art. 6(1)(f) GDPR).

Configuration, updates and prices

When the app starts, it asks ftpie.com for its configuration, which turns features on or off, and checks for updates. When you open a plan or upgrade screen, it fetches current prices. The installer checks once for a newer version.

Service records

Every request from the app or the installer shows our server your IP address. For the requests above, we keep a record of the event (for example an installation, an app start, a trial started, an update installed or a plan screen opened), its date, the approximate location (city and country) we look up for your IP address with IPinfo, and a keyed one-way hash of the address. We do not store the address itself.

Why: security, preventing abuse and license misuse, running and improving the service, and seeing trends in aggregate, such as which countries install the app, start trials and open plan screens. Legal basis: our legitimate interests (Art. 6(1)(f) GDPR).

Error reports and feedback

Only when you send one. A report contains your description, your email address if you give it, and, if you choose to attach it, the app's recent log files. Logs can contain server addresses, user names, file and folder names and error details. Reports reach us by email and through our internal notifications, and are kept in our records.

Why: to find and fix problems and to reply to you. Legal basis: our legitimate interest in fixing the software you use (Art. 6(1)(f) GDPR).

Trial extension

To extend a trial, you give us your email address, and we send it a code to confirm it. You can also choose to receive our newsletter at the same time. Legal basis: our contract with you for the extension (Art. 6(1)(b) GDPR) and your consent for the newsletter (Art. 6(1)(a) GDPR).

4. FTPie Links and FTPie Mail

These online services are optional. The app asks the first time whether you want to use them, and you can always share your storage provider's own links and use your own email server instead.

What we store when you share

• Screenshots and notes are stored in Cloudflare R2, in its Eastern Europe storage region. Without a password, they are stored readable, so that we can check an item someone reports. With a password, the app encrypts them before upload, and we cannot read them.
• File links: we store the links to your storage that you share, which can include file and folder names. Without a password, they are encrypted with our server's key, and we decrypt them only to send a visitor on to your storage. With a password, the app encrypts them with a key from your password, and we cannot read them.
• For each item, we keep a random id, its kind and size, when it was created, last visited and expires, the plan it was made on, and a keyed hash of your license key, so that only your license can revoke it. We do not store your license key, IP address or email address with your items.
• Screenshots and notes travel directly between your device or a visitor's browser and Cloudflare R2, not through our server.

How long shared items are kept

• When you revoke an item in the app, or remove it from its page with your license key, it is deleted at once.
• An item is deleted after 30 days without a visit, and an item created during a trial after 7 days at most.
• Uploads that are never completed are deleted after an hour.
• Backups of our share database are kept for up to 30 days. Screenshots and notes are not backed up.
• Short links made by earlier versions of the app (ftpie.com/s/...) store the address they point to, and are deleted once they go 30 days without use.

FTPie mail

To send a share email, we receive the recipients' addresses, your short message and the links you share. The mail shows your verified email address as its sender name and reply-to address. We hand the mail to Cloudflare Email Sending, or to SendPulse if Cloudflare cannot take it, for delivery. We do not keep the recipients' addresses or your message in our database; the mail providers keep delivery logs under their own retention rules. Alerts go only to your own verified email address.

When a recipient opts out of FTPie mail, or their address bounces or complains, we keep a keyed hash of that address so that no more FTPie mail is sent to it.

Limits and abuse prevention

To apply usage limits, we keep counters under keyed hashes of license keys and IP addresses. They hold no readable key or address and are deleted when they are no longer needed.

Legal basis: our contract with you, since you ask us to host and deliver what you share (Art. 6(1)(b) GDPR), and our legitimate interest in keeping the service secure and free of abuse (Art. 6(1)(f) GDPR).

5. If You Receive Something Shared Through FTPie

When you open an FTPie link, our server and Cloudflare process your IP address and browser details to deliver the page and protect the service. ftpie.link sets no cookies and uses no analytics. We record that an item was visited and when, not who visited it. To stop password guessing and link scanning, we keep keyed hashes of IP addresses in short-lived counters.

If you received an email through FTPie mail, the sender gave us your address so that we could deliver it. We do not keep it after delivery, unless you opt out of FTPie mail; we then keep a keyed hash of it to respect your choice.

A shared item belongs to the person who shared it. To have an item removed, use the Report link on its page or write to abuse@ftpie.link. A report holds the reason you give, any details and contact address you choose to add, and a keyed hash of your IP address; it reaches us through our internal notifications. We keep it as long as we need to handle it and any legal follow-up.

Legal basis: our legitimate interests in delivering what was sent to you, keeping the service secure and handling reports (Art. 6(1)(f) GDPR).

6. The Website

Umami analytics (self-hosted)

We use Umami to understand which pages people find useful. We run it on our own server, so your visit is not sent to an analytics company. Umami sets no cookies and stores nothing in your browser, which is why this site shows no cookie banner. It records the page visited, the referring link, and coarse details such as browser, device type, screen size and country. Your IP address is used only to work out the country and a short-lived anonymous visit identifier; it is not stored. This data is never sold or shared.

Cloudflare and our server logs

All our sites are served through Cloudflare, which protects them and delivers them quickly. Cloudflare processes your IP address and request details for that purpose and may set a strictly necessary security cookie. Our own web server also keeps access logs (IP address, time and the address requested) for security.

Cloudflare Turnstile

We use Cloudflare Turnstile to protect our forms from spam and abuse. It may process your IP address but does not use cookies. Learn more on Cloudflare's Turnstile page.

Chatwoot live chat

We use Chatwoot to run the live chat widget on this site. If you open the chat, Chatwoot stores the messages you send, any name or email address you choose to give us, and technical details such as your IP address, browser and the page you started the conversation from. It also sets a cookie and browser storage entries so the same conversation can be continued on your next visit. The widget only loads the chat; nothing is sent to Chatwoot unless you open it and write to us. Learn more in Chatwoot's privacy policy.

Forms and email

When you use a form on the Website (for example a refund request, a business enquiry or uninstall feedback) or email us, we receive what you write and your email address, and use them to answer you. Legal basis: taking the steps you ask for (Art. 6(1)(b) GDPR) and our legitimate interest in answering you (Art. 6(1)(f) GDPR).

Newsletter

If you subscribe, we keep your email address and a record of your consent (when and where you gave it, with the IP address and browser used), and we send the newsletter through SendPulse. Every newsletter has an unsubscribe link. When you unsubscribe, we keep your address on a do-not-send list so that we never mail you again. Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.

7. Purchases

Payments are made through Stripe Checkout. Stripe collects your card and billing details; we never see or store your card number. From Stripe we receive your name, email address, billing address and country, any tax ID you enter, and the plan you bought. We keep your email address with your license, create your invoice from those details and email it to you; the transaction itself is recorded and kept by Stripe. You manage a subscription in Stripe's customer portal.

License and purchase emails are sent through Google Workspace, with SendPulse as a backup. Legal basis: our contract with you (Art. 6(1)(b) GDPR) and our duty to keep invoices under tax law (Art. 6(1)(c) GDPR).

8. Service Providers

We use these providers to run FTPie and give each only what it needs for its task:

• DeltaHost (deltahost.com): our server, in a data centre in Dronten, the Netherlands, which runs ftpie.com, ftpie.link and our databases
• Cloudflare: protection and delivery for all our sites, Turnstile, R2 storage for shared screenshots and notes, Email Sending for FTPie mail, and forwarding of abuse@ftpie.link
• Stripe: payments and subscriptions
• Google (Google Workspace): our email, including license emails
• SendPulse: the newsletter, and backup delivery for our other email
• Chatwoot: live chat
• IPinfo: approximate location from an IP address
• Telegram: delivering our internal notifications to us, for example about a new error report or abuse report

Some of these providers process data outside the European Economic Area, mostly in the United States. Those transfers rely on an EU adequacy decision, such as the EU-US Data Privacy Framework where the provider is certified under it, or on the European Commission's standard contractual clauses.

9. How Long We Keep Data

• Licenses: as long as the license exists, and afterwards as long as tax law requires or legal claims can be made
• License checks and service records: 12 months, then deleted
• Server logs: only as long as we need them for security, then deleted
• Shared items: as described in section 4
• Error reports, feedback and messages: as long as we need them to handle the matter
• Newsletter: until you unsubscribe; the record of your consent is kept afterwards as long as we may need to show it was given
• Invoices: as long as Polish tax law requires, currently five years from the end of the tax year

10. Security

All our sites and services use HTTPS. Shared items are encrypted as described in section 4, IP addresses in our records, and license keys in the share service, are kept only as keyed hashes, and access to our servers and data is restricted. No system is completely secure, so please do not use FTPie links for sensitive data.

11. Your Rights

Under the GDPR you have the right to access your personal data, to have it corrected or erased, to restrict its processing, to receive it in a portable format, and to object to processing based on our legitimate interests. Where we rely on your consent, you can withdraw it at any time. You also have the right to lodge a complaint with a supervisory authority; in Poland that is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), or you can contact the authority where you live.

If you live in California: we do not sell or share personal information for targeted advertising, and you may ask what we hold about you and ask us to delete it.

To use any of these rights, write to contact@ftpie.com. We will reply within one month.

Records linked to your license or email address can be found, and deleted on request unless the law requires us to keep them, as with invoices. Records we cannot link to you, such as service records without a license key, cannot be found or deleted on request, because we cannot identify you in them (Art. 11 GDPR).

We store shared items without your name or email address, so we can find them only by their link or by your license key. Include one of them when you ask about a shared item.

12. Children

FTPie is not directed at children under 16, and we do not knowingly collect their personal data. If you believe a child has given us personal data, contact us and we will delete it.

13. Changes to This Policy

We update this Privacy Policy when what we do with data changes. We post the new version on this page with a new date and announce significant changes on the Website or in the FTPie app. If we transfer FTPie to a company formed to run it, the personal data described in this policy (licenses, purchases, service records, messages you sent us, newsletter subscriptions and shared items) passes to that company, which becomes responsible for it; we will say so here and tell you before it happens. Your files never reach us, so they are not part of this.