What we collect
- Account data: your email address and sign-in sessions.
- Content: the files you upload and their metadata (name, size, type). File bodies are encrypted at rest.
- Transfer data: sender/recipient emails and an optional message, for as long as a transfer lives.
- Contacts: names, company, email addresses and phone numbers you choose to save in your address book — details about other people, provided by you.
- Billing data: subscription status and payment records (handled by Mollie — we never see full card details).
- Technical data: limited logs and rate-limit counters (e.g. IP address) needed for security and abuse prevention.
- Usage statistics: anonymous, aggregate page views collected without cookies or device fingerprinting, so we can see which pages are used.
- Bandwidth totals: how many bytes your account has served each month. A running total only — no record of which file, when, or by whom, and it is deleted with your account.
How your files are protected
Every file is encrypted at rest with a unique per-file key (envelope encryption, AES-256-GCM). Those keys are themselves encrypted by a master key held outside the database. Because keys are per-file, we can honour a deletion or takedown by destroying a single key, making that content permanently unrecoverable. Files are stored on Hetzner, an ISO 27001-certified, renewable-powered cloud provider, within the EU (Germany). Your data is never transferred outside the EU/EEA.
Why we process it (legal bases)
- To provide the service you asked for — performance of our contract with you.
- To keep Yungle secure and prevent abuse — our legitimate interests.
- To take payment for the paid plan — performance of contract.
- To meet legal obligations, such as responding to lawful takedown notices.
Retention
Free transfers and their metadata are deleted 7 days after creation. Paid collection files are retained for as long as the plan is active. If a plan lapses, content is kept for a further 90 days and then deleted; the account holder is emailed the date. Deleting your account erases your files, keys, and personal data immediately. We keep minimal billing records where required by law and a tombstoned audit trail of security-relevant events.
Contacts are the exception to everything above expiring: they have no time limit and are kept until you delete them, or until you delete your account. You can delete any contact at any time, and export the whole address book as JSON from your account settings.
Contacts you save about other people
Your address book holds details about people who may never have used Yungle. For that slice of data you decide what is stored and why, so you are its controller and we process it on your behalf under our data-processing agreement — please only save details you have a lawful basis to keep. If one of your contacts asks you to correct or remove their details, you can do it yourself from the Contacts section; if they contact us instead, we will point them to you and help you action it. Contacts are visible to anyone you have added to your workspace, and they are never used to advertise, profile, or contact anyone on our own behalf.
Sub-processors
We share the minimum necessary with a small set of EU-oriented providers:
- Hetzner Online (Germany) — encrypted object storage & hosting.
- Mollie (Netherlands) — payment processing for the paid plan.
- Brevo (EU) — transactional email (sign-in links, invites, notifications).
- Simple Analytics (Netherlands) — cookieless, privacy-first page statistics. No cookies, no cross-site tracking, no personal data or device fingerprints collected.
Your rights
Under the GDPR you can access, correct, export, or erase your personal data, and object to or restrict certain processing. You can export your data as JSON from your account settings, and delete your account there at any time. To exercise other rights, contact privacy@yungle.co. You also have the right to complain to your national data-protection authority.
Cookies
Yungle uses only strictly-necessary cookies — your sign-in session and short-lived unlock tokens for password-protected links. We use no advertising or third-party tracking cookies.