Terms

Terms and privacy.

Cookie information

BuddyFile uses essential cookies to keep a session working, protect requests, remember the language selected within that session and display dates in your time zone. These cookies are used for the requested service, not for advertising.

PHPSESSID identifies your browser session. It supports security checks and temporary access to upload results or password-protected files. It is a session cookie.
buddyfile_timezone stores a time-zone name, not your precise location. It expires after one year unless your browser deletes it sooner.

We use Google Analytics 4 (measurement ID G-LDV4CW7WE0) to measure visits to our public home, FAQ, contact and terms pages. It processes browser and device information, approximate location and usage statistics. Google receives the network information needed to provide its service. We do not include query strings, URL fragments or referrer URLs in the configured page-view data; the tag is excluded from file, deletion and account pages. We do not send uploaded file contents, passwords or contact-message contents to Analytics. Google signals and advertising personalization signals are disabled in our tag.

Analytics may store _ga and _ga_LDV4CW7WE0 cookies to distinguish browsers and maintain session information, normally for up to two years; repeat visits can renew their expiry. These are optional analytics cookies, separate from essential cookies. You can remove or block them in your browser or use Google’s Analytics opt-out add-on. Blocking Analytics does not prevent file sharing. Google Ireland Limited provides Analytics for users in the EEA; processing may also take place outside the EEA, including in the United States. See Google’s Privacy Policy and how Google uses data from partner sites. Cookie lifetime is not the same as retention of data stored by Google, which depends on the Analytics property settings.

You can remove or block cookies in your browser. Blocking them may prevent uploading, managing links or accessing protected files. It does not stop the server from recording technical requests. Details about other personal data are in the Privacy Policy.

1. Operator and scope

BuddyFile, intended to operate at buddyfile.com, is provided by OVERMIND, ul. Piotrkowska 28/8U, 90-269 Lodz, Poland; NIP: 7262512928; REGON: 520728288. Contact for support, complaints, illegal-content notices and privacy requests: hello@buddyfile.com.

These terms cover the free service for uploading files and sharing download links. Registration is not required for public file sharing. There are no subscription fees, paid packages or payment orders under these terms. A temporary HTTP preview may show informational pages while uploads, downloads and forms remain unavailable pending the HTTPS launch.

2. Using the service

You need an internet connection, an up-to-date browser, JavaScript and essential cookies for interactive functions. Before uploading, read these terms and the Privacy Policy. Requesting an upload constitutes an agreement to provide that file-sharing service on these terms; reading the Privacy Policy is not blanket consent to personal-data processing.

Upload only files you are entitled to use and share. Where a file contains somebody else's personal data, you are responsible for having an appropriate legal basis to upload it and disclose it to your chosen recipients.

3. Limits and availability

Public uploads reject these file extensions: .exe, .rar, .bat.

Uppercase and lowercase extensions are treated the same. File size limits and the rules against unlawful or harmful content also apply.

The current maximum size of one file is 3 GiB (3072 MiB). File-type restrictions, available settings and limits are shown by the service. Some formats may be rejected for security reasons. If batch upload is enabled, each file remains subject to the individual limit.

The default retention setting is 3 days. The expiry shown for a particular file and any supported setting chosen by its uploader determine its availability; files may expire sooner after a selected download limit or manual deletion. Where the service uses inactivity-based retention, a later download may move the expiry date.

BuddyFile is a temporary transfer service, not a permanent archive or your only backup. Keep your own copy. Availability, transfer speed and successful delivery to a recipient are not guaranteed; maintenance, capacity limits, failures or action required by law can affect them.

4. Sharing links and passwords

A download link may let anyone who receives it view the file name, file information, an available image preview and the file itself. If you enable a file password, recipients also need that password. Share passwords separately where appropriate. Password protection is an access control; it does not provide end-to-end encryption or make a file invisible to authorised service administrators.

Keep the deletion link private: anyone possessing it may be able to delete the file. A link can be forwarded by its recipient. We do not promise to recover lost links or passwords. Do not treat a sharing link as a safe place for highly confidential information without additional protection.

5. Expiry and deletion

A file can become unavailable after its expiry, a configured download threshold, use of its deletion link or removal by the operator. Deletion prevents new public access; a transfer already in progress may finish. Storage cleanup, temporary transfer copies and protected backup copies have a separate lifecycle, so unavailability is not a promise that every physical copy disappears instantly. Audit records and technical logs may remain as explained in the Privacy Policy.

6. Prohibited use

Do not upload or distribute unlawful material, including child sexual abuse material, terrorist content, malware, content infringing intellectual-property or privacy rights, or material you have no right to disclose. Do not use the service for spam, phishing, harassment, unauthorised access, bypassing safeguards or disrupting its operation.

You retain your rights in uploaded files. You authorise us only to store, transmit, prepare available previews or download archives, and remove those files as necessary to deliver and protect the service. Uploading does not transfer ownership to BuddyFile or grant permission to use your files for unrelated advertising.

7. Illegal-content reports and restrictions

Send a notice to hello@buddyfile.com or use the contact or file-report form when available. Include the exact download URL, a clear explanation of why the content is unlawful, relevant supporting information, your name and email address where legally required, and a statement that you believe the information is accurate and complete. Applicable exceptions to identifying a reporter, including reports of child sexual abuse material, remain available.

We assess sufficiently specific notices without undue delay and may restrict access or remove files when warranted. We may also restrict use to address abuse or binding legal orders. Where the law requires and usable contact details are available, we provide notification, reasons and information about possible review. Ask for review at hello@buddyfile.com, identifying the file and the grounds for your request. Never attach unlawful content to a report; identify its location instead.

8. Support and complaints

Contact hello@buddyfile.com with a description of the problem, when it happened, a relevant link if safe to disclose, and the response you seek. Do not send a deletion link or password unless needed for the particular request. We aim to answer service complaints within 14 days; mandatory shorter deadlines, if applicable, take precedence. A temporary HTTP preview does not accept forms, so use email during that stage.

9. Responsibility

You are responsible for the files you choose to upload and for recipients you select. We take reasonable measures to operate and protect the service, but no internet service is free from failures or security risks. These terms do not exclude liability that cannot lawfully be excluded, liability for intentional misconduct, or statutory consumer and data-protection rights.

10. Changes, applicable law and privacy

These terms are governed by Polish law without removing any mandatory protection you have under the law applicable to you as a consumer. Disputes can be brought before courts competent under applicable law. You can stop using the service at any time and use the available deletion options for your files.

Updated terms are published here. Material changes will normally be announced on the site at least 14 days before taking effect; changes required urgently by law or security may take effect sooner with an explanation. Changes do not retroactively remove acquired rights. Personal-data processing is described in the Privacy Policy.

1. Controller and contact

The controller of personal data processed for BuddyFile is OVERMIND, ul. Piotrkowska 28/8U, 90-269 Lodz, Poland; NIP: 7262512928; REGON: 520728288. For all privacy matters, including exercising your rights, contact hello@buddyfile.com. This policy describes the current free file-sharing service and its informational preview.

2. Data we process and its sources

Files and sharing information: the contents you upload, file names, descriptions, size and type, upload and deletion dates, sharing identifiers, file passwords where enabled, and configured expiry or download limits. An uploader may provide personal data about other people within a file.
Technical and audit data: IP addresses, browser/user-agent information, request times and paths (which may contain sharing links), session identifiers, file fingerprints (SHA-256), download counters, transferred bytes and transfer outcomes. A file fingerprint identifies file content; it is not an encrypted copy of the file.
Messages: your name, email address, the message and its technical context when you contact us or report a file. Optional phone details are processed only if you provide them. Optional sharing emails involve sender and recipient addresses and the message supplied by the sender.
Browser preferences: the session, selected language and time zone described in the cookie information above.

We receive these data from visitors, uploaders, recipients, correspondents and their browsers. You do not need an account to share files. Giving contact details is voluntary, but an email reply requires an address. Essential technical data are needed to operate and secure a requested transfer.

3. Purposes and legal bases

Providing a requested upload, link, preview, download or sharing email: performance of the service agreement, Article 6(1)(b) GDPR, where you are a party to it. Where processing relates to a recipient or another person, Article 6(1)(f) applies to the legitimate interest in delivering a lawful transfer and protecting that person's rights.
Security, fault diagnosis, abuse prevention, technical statistics and establishing or defending claims: Article 6(1)(f), our legitimate interests in maintaining a reliable service, investigating incidents and protecting rights.
Responding to enquiries and complaints: Article 6(1)(b) where linked to your service agreement, or Article 6(1)(f), the legitimate interest in handling correspondence and resolving problems.
Complying with applicable legal duties and valid orders from competent authorities: Article 6(1)(c).

We do not sell personal data or use uploaded files for unrelated advertising. Accepting the terms does not constitute consent to marketing.

4. Who can receive data

Recipients you give a link or password to can obtain the shared file and related information. Anyone else who obtains them may also gain access. Hosting and email-service providers, authorised administrators and technical support may process data needed to operate the service. Competent authorities or other entitled parties may receive data where a valid legal basis requires disclosure. We restrict administrative access; we do not promise that file passwords prevent access by the operator.

5. International transfers and external sites

A recipient may download a file from another country, and an email address you choose may be served by a provider outside the European Economic Area. Social-sharing buttons and the Facebook link open external services when you choose to use them; those providers apply their own privacy policies and may process data abroad. BuddyFile does not load advertising pixels merely because those links exist.

If our providers process personal data outside the EEA, we must use a valid GDPR transfer mechanism, such as an applicable adequacy decision or appropriate contractual safeguards, rather than assume that all transfers are permitted. You can request information about relevant destinations and safeguards at hello@buddyfile.com.

6. Retention and deletion

Uploaded files remain available according to their sharing settings; the current default retention setting is 3 days. Manual deletion, a download threshold or justified removal may end access sooner. The displayed expiry takes precedence for the particular transfer. Cleanup and any transfer already in progress may finish after public access has ended.

Deleting a file does not automatically erase its audit history. File metadata, fingerprints, upload and deletion dates, IP/browser information, request logs and transfer records may remain for incident investigation, abuse prevention and claims. Audit records do not currently have an automatic expiry. Their necessary retention is assessed by reference to unresolved incidents, justified security needs, applicable limitation periods and legal preservation duties; contact us to request an individual erasure or retention review.

Routine web-server and PHP logs are rotated, with up to 14 archived rotations; this is not an absolute 14-day limit for every database record. Correspondence is kept while needed to handle the matter and any justified follow-up, claims or legal duties. Protected maintenance backups can contain earlier data and are kept for necessary recovery or legal preservation; deleting a live file does not immediately erase existing backup copies.

Security blocklists keep an IP address while its block remains active. The current infrastructure can apply failed-SSH-authentication bans of up to 100 years unless lifted sooner; this does not mean every website visitor's IP is kept for 100 years. You may request human review of a block and the necessity of retaining its data at hello@buddyfile.com.

7. Cookies

PHPSESSID is a session cookie used for functionality and security; the selected language is held within that session. buddyfile_timezone stores your time-zone preference for up to one year. Neither is an advertising cookie. Browser controls let you remove or block them, although essential functions may then fail. Rejecting cookies does not disable server logging.

8. Security and your choices

We use access restrictions, protected administrative credentials, monitoring and separation of uploaded files from executable website code. The public HTTP preview exposes informational pages; functions handling uploads or other user operations remain blocked there pending HTTPS. No system offers absolute security. File passwords are access controls, not end-to-end encryption. Avoid unnecessary sensitive information, protect links and passwords, and keep your own backup.

9. Your rights

Subject to the conditions in the GDPR, you may request access, correction, erasure, restriction, portability where applicable, and object to processing based on legitimate interests. If processing is based on consent, you may withdraw it without affecting prior lawful processing. We may retain data where a lawful exception applies and will explain the reason.

Send requests to hello@buddyfile.com. We may ask for proportionate information to establish your identity and locate the relevant data. We normally respond within one month. Where the GDPR permits an extension of up to two further months, we explain it within the first month. You can complain to a competent supervisory authority, including Poland's President of the Personal Data Protection Office (UODO), at uodo.gov.pl.

10. Automated safeguards and updates

We do not use advertising profiling or automated decision-making producing legal or similarly significant effects. Technical safeguards can automatically reject a file, apply expiry or download limits, or block suspicious traffic. Contact us for human review of a restriction. We publish policy updates here and provide further notice where required.