Privacy Policy

1. Who we are

For GDPR purposes, UploadFrog is the controller of personal data processed through the website and related services. Contact: help@uploadfrog.com.

2. What we collect

• Account data: username, email address, password (stored as a secure hash), date of birth (used to enforce the 18+ age requirement), and account preferences.
• Content you provide: images, videos, titles, comments, folder settings, profile image, friend requests, direct messages, and similar user-generated content.
• Technical & security data: IP address, browser/device information, approximate timestamps of activity, CSRF/session identifiers, and signals used for abuse prevention (for example reCAPTCHA results).
• Usage data (with consent where required): analytics events about how the site is used (pages viewed, approximate location derived by analytics providers, device info).
• Communications: messages you send us (for example support emails).

Guest uploads may be associated with technical identifiers (such as IP and session/security tokens) even without a registered account.

3. How we use data

We process personal data to:

• Provide hosting, galleries, folders, comments, votes, friends, messaging, and related features.
• Authenticate users, maintain sessions, and protect accounts.
• Prevent spam, fraud, abuse, and service overload (including rate limits and reCAPTCHA).
• Operate temporary guest uploads and delete them after the retention period.
• Send transactional email when needed (for example account or security-related messages).
• Measure and improve the service (analytics, with consent where required).
• Show advertising (Google AdSense) according to Google’s certified consent message where required.
• Comply with legal obligations and respond to lawful requests.

4. Legal bases (GDPR)

• Contract — providing the service you request (account, uploads, folders).
• Legitimate interests — security, abuse prevention, service reliability, basic logging.
• Consent — optional Google Analytics (Cookie settings); advertising purposes via Google’s TCF CMP when AdSense is on.
• Legal obligation — when we must retain or disclose data under applicable law.

You may withdraw consent at any time without affecting processing based on other lawful grounds.

5. Cookies & similar technologies

We use:

On your first visit we ask for consent before loading Google Analytics. You can Accept all, Reject non-essential, or Customize that category. Essential cookies (including your preference) remain active. That includes a feed-filter cookie that remembers Browse/folder sort and Hide seen, and — if you use Hide seen while signed out — a compact list of post IDs you already opened. Signed-in Hide seen is stored on your account instead. Google Consent Mode starts with analytics and ad storage denied; we grant analytics storage only if you allow Analytics. When ads are denied we also set ads_data_redaction.

Advertising (AdSense): we do not treat this site’s cookie banner as IAB TCF consent. If AdSense is enabled we load Google’s certified Privacy & messaging CMP so visitors in the EEA, UK, and Switzerland can consent to or refuse ad purposes and vendors. You can reopen that message via Cookie settings → Advertising choices. Google’s ads may still use limited / non-personalized modes where Google allows them after a refusal. See Google Privacy Policy and Google advertising.

Change Analytics anytime via Cookie settings in the site footer, or clear cookies in your browser. If you withdraw Analytics after it already ran on the current page, we reload the page so that script stops. Your Analytics choice is stored for up to about one year.

If you install UploadFrog as an app, the browser keeps a service worker that caches static files on this device (icons, scripts, styles, and a small offline page) so the shell can load without a network. HTML pages, your library, messages, and uploaded media are not stored in that cache. You can remove the app and site data from the browser at any time. The install banner’s “Not now” choice is stored in local storage on this device, not as an analytics cookie.

If you turn on alerts (Enable alerts in the notification panel), we store a push subscription for this device (a browser-issued endpoint and keys) so we can deliver system notifications for new messages, friend requests, and moderator invites while the app is in the background. Those alerts are sent through your browser’s push service (for example Google, Mozilla, or Apple). Logout removes this device’s subscription. You can also revoke notification permission in the browser or OS settings.

6. Sharing & processors

We do not sell your personal information. We share data with service providers only as needed to run UploadFrog, for example:

• Google — reCAPTCHA, Analytics (with consent), AdSense and the Privacy & messaging CMP (including IAB TCF vendors Google discloses in that message).
• Browser push services — if you enable alerts, Google, Mozilla, or Apple (depending on the browser) receive the push payload needed to show the notification on this device.
• Hosting / infrastructure — servers and storage that host the website and media.
• Email delivery — transactional mail providers used to send service email.

Content you publish publicly (for example public media pages) can be viewed by anyone with the link or who browses public discovery surfaces. Folder moderators you invite can access content according to the privileges you grant.

We may disclose information if required by law, or to protect rights, safety, and the integrity of the service.

7. Retention

• Registered media & account data: kept while your account is active. You can request account deletion from your profile; we email a confirmation link before permanently removing the account. When you delete content or your account, we remove associated data from active systems within a reasonable time, except where we must retain limited records (for example security logs or legal compliance).
• Guest / temporary uploads: deleted automatically after the retention period published on the upload page (and configurable by operators).
• Security / abuse logs: kept only as long as needed for security and rate limiting.
• Push subscriptions: kept while you leave alerts enabled on that device, and removed on logout, when you revoke permission, or when you delete your account.

8. Your rights

Depending on where you live, you may have the right to:

• Access your personal data.
• Rectify inaccurate data.
• Erase data (“right to be forgotten”) in certain cases.
• Restrict or object to certain processing.
• Data portability for data you provided.
• Withdraw consent where processing is consent-based.
• Lodge a complaint with your local supervisory authority.

To exercise these rights, email help@uploadfrog.com. We may need to verify your identity before responding.

9. Security

We take reasonable technical and organizational measures, including:

• HTTPS for data in transit.
• Password hashing (passwords are not stored in plain text).
• Encrypted storage of email addresses at rest.
• Access controls, CSRF protection, and abuse-prevention tooling.

No method of transmission or storage is 100% secure; please use a strong unique password.

10. International transfers

Some processors (notably Google) may process data outside your country, including outside the EU/EEA. Where required, transfers rely on appropriate safeguards such as Standard Contractual Clauses or other lawful transfer mechanisms offered by those providers.

11. Children

UploadFrog is not directed at anyone under 18. We do not knowingly collect personal data from children. If you believe a minor has provided data, contact us and we will take appropriate steps.

12. Changes

We may update this Privacy Policy. Changes will be posted on this page with a new effective date. Significant changes may also be highlighted in the product or by email when appropriate.

13. Contact

Privacy questions or requests: use our contact form (reason: Privacy / data request) or email help@uploadfrog.com.