LEGAL // privacy

Privacy Policy

Effective November 7, 2026

The short version: your messages and files are encrypted on your device before they reach us, and we never have the key, so we can't read them. We keep the encrypted data only until it is opened or expires. We don't use accounts, cookies, analytics or trackers on the sending and receiving pages, and we don't store IP addresses.

This Privacy Policy explains how Big Tex Labs (“we”, “us”) handles information when you use Secure Deliver (the “Service”).

1. Information we cannot access

Your message text, file contents, file name and file type are encrypted in your browser with AES-256-GCM before upload. The key is generated on your device and placed in the link after the “#”, which browsers do not send to servers. If you set a password, it never leaves your device either. We store only the resulting ciphertext, which we cannot decrypt.

2. Information we do store, temporarily

For each delivery we store the following until it is deleted:

the encrypted data;
a random delivery ID;
technical metadata: creation and expiry times, the attachment's size and the number of encrypted chunks, whether a message, a file and a password are included, and the number of wrong-password attempts;
one-way hashes of access tokens that let the server confirm the opener has the key without learning it.

3. Aggregate statistics

We keep anonymous counters, such as how many deliveries were created, opened or expired per day and total data volume. These cannot be linked to any person or delivery. Daily figures are kept for up to 90 days; running totals are kept while the Service operates.

4. IP addresses and logs

To prevent abuse, the Service briefly holds your IP address in server memory to enforce rate limits. The application does not write IP addresses to storage or logs. Our hosting provider (Microsoft Azure) processes network traffic, including IP addresses, to operate and protect its platform under its own privacy terms. We do not enable Azure web-server request logging for this Service.

5. Cookies and tracking

The sending and receiving pages set no cookies and load no third-party scripts, fonts, analytics or advertising. The administrator sign-in area uses strictly necessary security cookies for the administrator only.

6. Retention and deletion

Opened deliveries: deleted as soon as the recipient's download completes, and in any case within 60 minutes of being opened.
Unopened deliveries: deleted at the expiry time chosen by the sender (no more than 7 days).
Unfinished uploads: deleted within 60 minutes.
Revoked deliveries: deleted immediately when the sender destroys the link.
Wrong passwords: a password-protected delivery is deleted after 5 incorrect attempts.

There are no backups of delivery data.

7. How we use information

We use the information above only to provide and secure the Service, enforce our Terms, and understand overall usage. We do not sell or rent personal information, share it for targeted advertising, or use it to build profiles.

8. Sharing and legal requests

We use Microsoft Azure to host the Service and store encrypted data in the United States. We may disclose the limited information we hold if required by law. Because we never have the decryption keys, we cannot provide the contents of any delivery to anyone, including law enforcement.

9. Security

Content is protected with AES-256-GCM, keys are derived with HKDF-SHA-512, and passwords are strengthened with PBKDF2-SHA-256 (600,000 iterations). Connections use HTTPS with HSTS, pages use a strict Content Security Policy, and stored data is additionally encrypted at rest by Azure Storage. No system is perfectly secure, so please share links only with intended recipients and use a password for highly sensitive content.

10. Children

The Service is not directed to children under 13, and we do not knowingly collect their personal information.

11. Your rights

Depending on where you live, you may have rights to access, correct or delete personal information about you. Because the Service is account-free and we cannot link deliveries to individuals, we usually hold nothing that identifies you. A sender can delete a delivery at any time using the “Destroy this link now” button. For any privacy request, contact info@bigtexlabs.com.

12. Changes

We may update this policy. The “Effective” date above shows when it last changed.

13. Contact

Big Tex Labs · info@bigtexlabs.com