Cookie and Storage Policy

1. Why we do not show a consent banner

In its current configuration, the website and app do not use cookies or identifiers for advertising, audience measurement, profiling or cross-site tracking. The technologies below are needed to provide a feature you request, maintain security or remember an express preference.

We therefore do not request consent through a banner. If we introduce a non-essential technology, we will update this policy and ask for consent before enabling it where the law requires.

2. Strictly necessary cookies

Names without the __Host- prefix may appear only in local environments without HTTPS. In secure production, the session cookie uses that prefix plus Secure, HttpOnly and SameSite=Lax attributes.

Name	Purpose	Duration
`__Host-filesup_session` / `filesup_session`	Keeps you signed in after OTP verification. It is HttpOnly, limited to the service and used to authorise requests.	Until the session expires, you sign out or it is revoked.
`filesup_public_token`	Exchanges a public-link token for an HttpOnly cookie scoped to that conversation/transfer path, so the credential need not remain in the URL or accompany every request manually.	No more than 10 days, limited by share expiry or earlier revocation.

3. Local Storage and Session Storage

A modern link token starts in the URL fragment (#), which is not sent to the web server. The app then submits it in a protected header to obtain the resource-scoped public cookie.

Key	Location	Purpose and duration
`filesup.locale` / `filesup-marketing-locale`	Local Storage	Stores PT or EN to show your chosen language. Remains until changed or site data is cleared.
`filesup.link-conversation.<id>`	Local Storage	On the sender's device, keeps the stable conversation URL for reuse. It may contain a bearer credential and remains until replaced or site data is cleared.
`filesup.pending-link-claim`	Session Storage	Temporarily stores a link identifier and token while you sign in and claim the conversation. Removed after the operation or when the tab/browser session ends.

4. Cache Storage and service worker

The app uses browser Cache Storage through a service worker to store the app shell, manifests, logos and other static resources needed for fast loading and basic offline operation. Old cache versions are removed when the service worker updates.

API requests are excluded from this cache. Shared-file binaries are not deliberately stored by the service worker, although the browser or operating system may manage its own cache and downloads outside FilesUp's direct control.

5. How to manage these technologies

You can clear cookies and site data in browser settings and sign out of FilesUp. Blocking cookies, Local Storage, Session Storage or service workers may prevent sign-in, opening links, claiming a conversation, remembering language or offline operation.

Clearing local data does not necessarily delete account data on our servers. For that request, see the Privacy Policy or contact privacy@filesup.app.

6. Contact and changes

Questions about these technologies can be sent to privacy@filesup.app. Material changes, including measurement or marketing, will appear here before activation and be accompanied by the legally required choice mechanism.