What we collect
- Account data: your email address and sign-in sessions.
- Content: the files you upload and their metadata (name, size, type). File bodies are encrypted at rest.
- Transfer data: sender/recipient emails and an optional message, for as long as a transfer lives.
- Billing data: subscription status and payment records (handled by Mollie — we never see full card details).
- Technical data: limited logs and rate-limit counters (e.g. IP address) needed for security and abuse prevention.
How your files are protected
Every file is encrypted at rest with a unique per-file key (envelope encryption, AES-256-GCM). Those keys are themselves encrypted by a master key held outside the database. Because keys are per-file, we can honour a deletion or takedown by destroying a single key, making that content permanently unrecoverable. Files are stored on Hetzner, an ISO 27001-certified, renewable-powered cloud provider, within the EU (Germany). Your data is never transferred outside the EU/EEA.
Why we process it (legal bases)
- To provide the service you asked for — performance of our contract with you.
- To keep Yungle secure and prevent abuse — our legitimate interests.
- To take payment for the paid plan — performance of contract.
- To meet legal obligations, such as responding to lawful takedown notices.
Retention
Free transfers and their metadata are deleted 7 days after creation. Paid album files are retained for 90 days per file (a rolling window, so later additions keep their full term). Deleting your account erases your files, keys, and personal data immediately. We keep minimal billing records where required by law and a tombstoned audit trail of security-relevant events.
Sub-processors
We share the minimum necessary with a small set of EU-oriented providers:
- Hetzner Online (Germany) — encrypted object storage & hosting.
- Mollie (Netherlands) — payment processing for the paid plan.
- Brevo (EU) — transactional email (sign-in links, invites, notifications).
Your rights
Under the GDPR you can access, correct, export, or erase your personal data, and object to or restrict certain processing. You can export your data as JSON from your account settings, and delete your account there at any time. To exercise other rights, contact privacy@yungle.co. You also have the right to complain to your national data-protection authority.
Cookies
Yungle uses only strictly-necessary cookies — your sign-in session and short-lived unlock tokens for password-protected links. We use no advertising or third-party tracking cookies.