StorageSync Privacy Policy

Last updated: 23 October 2026

StorageSync is an end-to-end encrypted ("zero-knowledge") cloud storage service operated by Naresh Singh ("we", "us"). This policy explains exactly what we can and cannot see.

What we cannot see

Your files, their names, folder names, thumbnails, and version contents are encrypted on your device with keys that only you hold before anything is sent to us. We store ciphertext and "wrapped" (encrypted) keys only. Neither we nor our infrastructure provider (Cloudflare) can read your content or filenames. We cannot recover your data if you lose both your password and your recovery code — that is a deliberate consequence of the design, not a limitation we can override.

What we necessarily see

To run the service we process the following metadata:

• Your email address (account identity and sign-in).
• An authentication verifier derived from your password (never the password itself, and never the key that encrypts your data).
• Device names and platform (so you can manage and revoke devices).
• Sizes of encrypted files, counts of files/folders/versions, timestamps of changes, and encrypted identifiers for de-duplication within your own account.
• IP addresses and request logs for security, abuse prevention and debugging, retained for up to 30 days.
• Public-link view and download counts.
• If you enable it on iPhone, a push-notification token so the app can be nudged to sync.

We do not use analytics or advertising SDKs, and we do not sell or share personal data.

Sharing links

A share link carries the decryption key in the part of the URL after #, which browsers do not send to servers. Anyone who has the link can decrypt what it points to until you revoke it or it expires. Treat links like keys.

Where data is stored

Encrypted data and metadata are stored on Cloudflare's infrastructure (R2 object storage, D1 database) and served through Cloudflare Workers. Cloudflare additionally encrypts storage media at rest; this is a second layer beneath yours, not a substitute for it.

Your rights

You can export your data at any time through the apps (it is decrypted on your device), delete individual items permanently, or delete your account, which removes all your ciphertext and metadata within 30 days. Email privacy@storagesync.ca for any request about your data.

Children

StorageSync is not directed at children under 13 and we do not knowingly collect data from them.

Changes

We will post changes here with a new "last updated" date. Material changes are announced in the apps.