Privacy Policy

Polu is operated by Polu (polu.io) (“Polu”, “we”, “us”). This policy covers the Polu website, the Polu app and the share pages we host for our customers. For files that customers upload and share, the customer decides what is shared and with whom; we process that content on their behalf.

• Account data: your name, email address, sign-in method (email and password, Google or Microsoft), workspace name, team membership and preferences. Passwords are stored only as hashes by our authentication provider.
• Content: files you upload, file names and sizes, share link settings (such as expiry, passwords and download limits) and workspace branding.
• Share link activity: when someone opens a share link we record views, previews and downloads with the time, approximate device and browser type, referring site and a salted hash of the visitor's IP address. If the sender turns on an email gate, the email address the visitor enters is shared with that sender.
• Billing data: your plan, subscription status, billing country and invoice history, received from Lemon Squeezy. Payment card details are handled by Lemon Squeezy and never reach our servers.
• Security and abuse data: sign-in sessions (with hashed IP and device details), audit logs of sensitive account actions, abuse reports and bot-protection checks.
• Support messages: anything you send us by email.

We do not store raw IP addresses in our database or analytics. Before an IP address is saved, for example with a share link view or a sign-in session, it is converted into a keyed (salted) SHA-256 hash. The hash lets us count unique visitors and detect abuse without keeping the address itself. Raw IP addresses are only used briefly in memory and in short-lived rate-limit counters. Our authentication provider may keep IP addresses in its own security logs for sign-in requests.

• To run the service: store files, publish share pages, send links and enforce your access settings.
• To show senders how their links perform (views, downloads and activity).
• To keep Polu secure: rate limiting, bot protection, malware scanning of uploads and abuse handling.
• To bill paid plans and send transactional email about your account.
• To improve Polu using product analytics, only if you have opted in.
• To meet legal obligations, such as responding to valid legal requests and copyright notices.

Where the GDPR or UK GDPR applies, we rely on performance of our contract with you, our legitimate interests in running a secure service, your consent (for analytics and session replay) and legal obligations.

We use necessary cookies to keep you signed in, protect forms against request forgery, remember your theme and store your cookie choice (for up to six months). Analytics (PostHog) and session replay (Sentry) are off by default and only start after you allow them in the cookie banner or on the Cookie settings page, where you can withdraw consent at any time.

When you are signed in, we also save your analytics choice with your account. Some product events about your account happen without you, for example when someone opens a link you shared or a payment is confirmed; they are only sent to our analytics provider if your saved choice allows analytics, and never include the visitor's details.

Error monitoring runs without session replay and without personal data by default; email addresses and tokens are removed from error reports before they are sent.

We use these providers to run Polu. Each processes data only for the purpose listed:

• Cloudflare (Workers, D1, R2 and Turnstile): Hosting, database, authentication and account records, private file storage, file delivery and bot protection on forms.
• Lemon Squeezy: Checkout, payments, invoices and sales tax as our Merchant of Record. Lemon Squeezy processes your payment details; we never see full card numbers.
• Resend: Transactional email such as sign-in links, notifications and receipts.
• PostHog: Product analytics. Only runs after you opt in to analytics cookies.
• Sentry: Error monitoring without personal data by default. Session replay (masked) only runs after you opt in.

Some providers process data outside your country, including in the United States. Where required we rely on appropriate safeguards such as standard contractual clauses.

• Account data and files are kept while your account is active.
• Share link activity is kept for the analytics period of your plan (7 days on Free, 90 days on Plus, 365 days on Pro).
• When you delete your account it can be restored for 30 days. After that, your workspace, files and links are permanently deleted. Residual copies in encrypted backups expire as backups rotate.
• Billing records are kept as long as tax and accounting law requires.

Depending on where you live, you can ask to access, correct, export or delete your personal data, object to or restrict certain processing, and withdraw consent at any time. Signed-in users can export their data and delete their account from Settings → Data & privacy. You can also complain to your local data protection authority.

If you opened a share link and want your data removed, contact the sender first; they control that content. We will help if you contact us.

Data is encrypted in transit with TLS and files are kept in private storage, delivered through short-lived signed URLs. Read more on our Security page.

Polu is not directed to children under 16 and we do not knowingly collect their personal data.

We will post updates on this page and change the “Last updated” date. For significant changes we will also notify account holders by email.