Privacy Policy

Last updated 10 October 2026

In short: we collect what we need to store, send and protect your files, and nothing more. We do not sell personal data, show ads, or run analytics or tracking scripts. Your files are yours, and we only look at them when abuse is reported or the law requires it.

1. Who we are

TasPod is run by Tas Group LLC, a company organized in Wyoming, USA. We decide how and why personal data in TasPod is used, so we are responsible for it (the "controller" in European terms). For files in an organization's Team Space, that organization decides what is stored and who can see it, and we handle those files on its behalf. This policy covers the TasPod website, apps, API and the links people create with them. The Terms of Service cover everything else about using TasPod.

2. What we collect

Information you give us

Account details: your email address and password. We only keep the password as a one-way Argon2 hash, never in readable form. If you turn on two-step sign-in, we keep the authenticator secret encrypted and the recovery codes hashed.
Your files: the files and folders you upload, their names, sizes and dates, earlier versions, and the settings you choose for sharing.
Things you write: transfer titles and messages, file request instructions, and anything you put in an abuse report or a message to us.
Other people's email addresses that you enter to share a link, invite someone to your organization or email a transfer. Addresses used to email a Quick Send transfer are used to send that email and are not stored.
Secure Drop: if you send files to someone's file request, the name, email address and message you choose to give, together with the files.
Organizations: organization name, members and their roles, groups and pending invitations.
TasPod Backup: if you install our backup program on a computer, the files and folders it backs up (with their names, paths, sizes, dates and permissions), the name you give the computer, its host name and operating system, the program version, and when it last checked in and ran.

Information created when you use TasPod

Sign-in sessions: when each session started and was last used, your browser and device type, and a scrambled (hashed) form of your IP address.
Security log: important account events, such as sign-ins, password and email changes, sharing and deletions, with the time and the IP address they came from. You can see your recent events on the account page. When your account is used from a device or browser we have not seen before, we email you, naming the browser and system.
Link activity: when a shared link, transfer or file request is viewed or downloaded, we record the time, a hashed IP address and, if the visitor is signed in or gave their email, who it was. Owners see view and download counts for their links.
Service totals: daily counts such as number of accounts and storage used, which do not identify anyone.

Information from payment

If you buy a paid plan, Stripe collects your card and billing details directly. We receive and keep only a Stripe customer reference, your plan, the subscription status and renewal dates, and references to payment events. We never receive your full card number.

3. Why we use it

To provide TasPod to you as agreed in the Terms: storing and delivering files, running links, sending the emails a feature needs, and billing. (Legal basis: performance of our contract with you.)
To keep TasPod and its users safe: scanning uploads for malware, stopping spam and abuse, rate limiting, investigating reports and keeping a security log. (Legal basis: our legitimate interest in a safe service, and legal obligations.)
To run and improve the service: fixing faults, planning capacity from overall totals, and answering your questions. (Legal basis: legitimate interest.)
To meet legal duties: tax and accounting records, and answering valid legal requests. (Legal basis: legal obligation.)

We send account, security, billing and service emails that you need to use TasPod. We do not send marketing emails; if that ever changes, we will ask first where the law requires and every such email will let you opt out. We do not sell personal data, use it for advertising, or use your files to train AI models.

4. Cookies and browser storage

TasPod uses only cookies that are needed for the service to work, so there is nothing to opt in to:

taspod_session keeps you signed in. It cannot be read by page scripts and expires after 14 days at most.
Short-lived cookies starting with tps_, tpd_ or tpt_ remember for one hour that you entered the password for a protected link.

The website also saves a few display choices in your browser's local storage, such as list or grid view and which organization you last opened. These stay on your device and are not sent to us. We do not use advertising, analytics or social media cookies, and we do not load tracking scripts from other companies.

People you choose. Anyone you give a link to can see what the link shares. Owners of a link or file request can see activity on it, and if you send files through someone's file request, they see what you provide. Owners and admins of an organization can see its members and the files in its Team Spaces.

Apps and addresses you connect. If you create an API key, the program holding it can act on your account. If you set up a webhook, we send details of the events you chose (for example a finished upload or download) to the web address you entered. You decide which programs and addresses get this data and can remove them at any time on the account page.

Service providers who help us run TasPod. They may use the data only to provide their service to us:

Microsoft Azure: the servers that run TasPod and store files and the database.
Cloudflare: domain name service, secure connections, protection from attacks and bot checks on some forms (such as sign-up) for our websites. Traffic to TasPod passes through its network.
Resend: sends our emails.
Stripe: processes payments for paid plans.

Malware scanning runs on our own servers, so files are not sent to an outside scanning company.

Legal reasons. We disclose information when we believe in good faith that it is required by law or a valid legal request, or necessary to protect someone from serious harm, to report child sexual abuse material, or to protect TasPod and its users from fraud and abuse. Where the law allows, we tell the affected user before handing over their data.

Business transfers. If TasPod is sold or merged, personal data may pass to the new owner, who must keep to this policy. We will tell you by email before that happens.

6. How long we keep it

Account details and files: while your account exists. Deleted files stay in the recycle bin for 14 days, then are erased permanently.
Transfers: deleted automatically when they expire. The expiry depends on your plan and the setting you choose.
File requests: files you receive follow the retention you set on the request, or stay until you delete them.
Sign-in sessions: deleted one day after they end. A session ends after 7 days without use and after 14 days at most.
Security log: two years. The IP address is removed from each entry after 180 days.
Link activity: while the link or your account exists.
Payment records: as long as tax and accounting law requires.
TasPod Backup: each backup is kept as long as the job's "Keep" setting says, or until you delete it or remove the computer. Data that no remaining backup needs is then erased.
Our own backups: database backups may contain deleted data until they are replaced.

When you delete your account, your links stop working at once. We keep the account and its files for 7 days so you can undo the deletion, then erase the files. We keep a record that the account existed, with the email address removed, so that security and payment records stay consistent. We may keep information longer when it is needed to investigate abuse, finish a report or appeal, resolve a dispute or meet a legal duty. Takedown notices and appeals are kept with the security log.

7. How we protect it

All traffic to TasPod uses encrypted HTTPS connections.
Passwords are stored as Argon2 hashes, and very common or easily guessed passwords are refused. You can turn on two-step sign-in with an authenticator app.
Uploads are held apart and scanned for malware before anyone can download them.
Share links use long random codes that cannot be guessed, and can be protected with a password, an expiry date and a download limit.
Staff access to the admin tools requires two-step sign-in and is recorded in the security log.

No system is perfectly secure. If a breach affects your personal data, we will tell you and the authorities as the law requires.

8. Your choices and rights

You can do most of this yourself on the account page:

see and download your files at any time, and download a copy of your account information with "Download my data";
change your email address or password;
see your recent security events and sign out sessions you do not recognize;
delete individual files, or delete your whole account.

Depending on where you live, for example in the European Union, the United Kingdom or California, you may also have the right to ask what personal data we hold about you, to have it corrected or deleted, to object to or restrict some uses, and to receive it in a portable format. Write to us at [email protected]. We will answer within one month, may need to confirm your identity first, and will not treat you differently for using these rights. If you are not satisfied, you can complain to your local data protection authority.

If you are not a TasPod user but your data is in TasPod, for example because someone shared a link with your email address, you can contact us at [email protected] too.

9. Where data is processed

Tas Group LLC is based in the United States, and our providers may handle data in the US as well as in other countries. Those countries may have different data protection laws from yours. When personal data leaves the EEA, Switzerland or the UK, we rely on the safeguards the law provides, such as the European Commission's standard contractual clauses in our agreements with providers.

10. Age limit

TasPod is for people aged 18 and over. We do not knowingly collect data from anyone younger. If you believe a child has given us personal data, email [email protected] and we will delete it.

11. Updates to this policy

We will update this policy when TasPod or the law changes, and change the date at the top. If an update changes how we use your data in a way that matters, we will email you before it takes effect.

12. Contact

Privacy questions and requests: [email protected]. To report abuse: [email protected]. Tas Group LLC, Wyoming, USA.