Privacy notice

Last updated: 8 November 2026

This notice covers the filesorter.app website and its connected services. Using the website does not give consent to optional analytics or email subscriptions.

Who is responsible

Digital Unity Ltd. is the data controller responsible for the website's processing of personal data.

Privacy contact
info@filesorter.app

Email subscriptions

Product updates through MailerLite

The product-updates form sends your email address directly to MailerLite for release and feature emails. MailerLite also receives connection information such as your IP address and browser details. The basis for subscription emails is your consent (GDPR Article 6(1)(a)). Use the unsubscribe link in those emails to withdraw it.

MailerLite can record email opens and link clicks depending on campaign settings. Those settings have not yet been verified for this mailing list.

Blog notifications through this website

Blog subscriptions are separate from product updates. This website stores your email, optional name, selected language, confirmation and unsubscribe times, and delivery history. Notifications start after email confirmation. The basis is consent (Article 6(1)(a)). Unsubscribe using the link in a blog email. Leaving one list does not unsubscribe you from the other.

Accounts and comments

Account details, password hashes and login records support registration and authentication. Comments, display names and any profile links you provide are public. Comment records also include an email address and IP address for administration and abuse prevention. Account and commenting services use Article 6(1)(b); security and moderation use the legitimate interest in protecting the service (Article 6(1)(f)).

If GitHub sign-in is offered and you choose it, GitHub supplies the profile and email information needed to connect your account. GitHub also processes the sign-in under its own privacy notice.

Contact and support

Contact messages, FAQ questions and issue reports are stored to answer requests and investigate problems. They may include your name, email, message, system details and optional diagnostic files or screenshots. Contact messages are also forwarded by email; issue-report notifications link staff to the report. Relevant bases are steps toward or performance of a requested service (Article 6(1)(b)), and the legitimate interest in answering enquiries and improving support (Article 6(1)(f)).

A submitted FAQ question may be edited and published with an answer. Review messages and attachments before sending them and remove passwords, API keys and unrelated personal information. Providing an email address allows a reply; it does not subscribe you to a mailing list.

Payments and licences

Donations and purchases use the details you provide and payment-provider confirmations, including names, emails, amounts, currencies, messages and transaction identifiers. Plugin licensing also stores licence status, device identifiers, platform, app version and activation times. These records support payments, delivery and licence administration (Article 6(1)(b)), fraud prevention (Article 6(1)(f)) and applicable accounting obligations (Article 6(1)(c)).

PayPal handles PayPal donations and Stripe handles plugin checkout. Payment details entered on their pages are processed by those providers under their own terms. Payment confirmations, including payer details, may be retained here. Cryptocurrency transactions are visible on the relevant public blockchain.

Downloads and security

Direct downloads record the requested file, IP address, time and delivery outcome. Server, error and email-delivery records can contain request paths, addresses and diagnostic details. These support delivery, troubleshooting, abuse prevention and download statistics under the legitimate interests in operating and protecting the website (Article 6(1)(f)).

Analytics and cookies

Optional Clicky analytics starts only after acceptance. It receives your IP address, browser/device information, public page views and selected button clicks. The basis is consent (Article 6(1)(a)). Rejecting or withdrawing stops further Clicky collection. Open Privacy settings in the footer to change your choice or withdraw consent. Clicky cookies are disabled in this integration.

Self-hosted Plausible separately receives public page URLs without query strings, IP addresses and browser information from the server. It estimates daily visitors without visitor cookies or storing raw IP addresses. Rejecting Clicky does not stop these server-side counts. The intended basis is the legitimate interest in understanding website use (Article 6(1)(f)); the separate assessment of applicable analytics-consent requirements is not yet complete.

The analytics choice on this website is available regardless of browser privacy signals. Optional Clicky analytics still requires acceptance. Server-side Plausible counts are separate and respect Do Not Track.

Functional cookies support sign-in, form security, language choices and the analytics preference. The preference cookie remembers your choice and its date for six months; it is not a visitor ID. Plausible dashboard authentication uses a separate login cookie for dashboard users.

Service providers and transfers

Authorised staff and providers receive information needed for the purposes above. Hosting and email providers process site or message data on behalf of the operator. Payment providers may also act as independent controllers for their own legal, security and payment obligations.

DNSExit and Clicky are based in the United States. Other providers can also process data internationally. The hosting and backup locations and the applicable transfer safeguards have not yet been confirmed for every service. Contact the privacy address for information about processing locations and copies of applicable safeguards.

How long data is kept

The following retention policy applies to the filesorter.app website:

  • Unconfirmed subscriptions: delete after 30 days if the subscription is not confirmed.
  • Contact messages: delete 12 months after the conversation closes, unless continued retention is justified for an ongoing request or legal claim.
  • Diagnostic files and screenshots: delete 90 days after the issue is resolved.
  • Raw download IP addresses: retain for 90 days. Routine Django security and email logs: retain for 90 days. Records needed for a specific investigation are retained separately only for as long as justified.
  • Confirmed subscriptions: retain while subscribed. After withdrawal, remove unnecessary profile data and delivery history, keeping only the minimum opt-out or consent evidence for a justified period.
  • Payment and licence records: keep accounting records for the period required by applicable law. Separately retain only the information needed to provide and manage the licence.

Unnecessary withdrawn-subscription details become eligible for cleanup 0 days after withdrawal. Unsubscribing stops emails immediately.

Files left by unsuccessful submissions become eligible for cleanup after a recovery period of 24 hours if they are not linked to a support report.

Cleanup is performed manually through an administrative review process with scheduled reminders. Mailbox and provider copies are reviewed separately. Data may remain until that cleanup is completed. Contact the privacy address to request erasure.

Retention arrangements for other records, including account data, provider copies and backups, still need to be established.

Your rights

Depending on the applicable law and circumstances, you may request access, correction, erasure, restriction or portability of your data, and object to processing based on legitimate interests. Consent can be withdrawn at any time without affecting earlier lawful processing. Send requests to the privacy contact above. Identity checks may be needed; GDPR requests normally require a response within one month, subject to permitted extensions.

You may complain to the supervisory authority where you live, work or believe an infringement occurred. Find a European data protection authority

Fields marked as required are needed for the requested form or service. Optional fields and subscriptions are voluntary. Without necessary details, a request, account or transaction may not be completed. Website data is not used for solely automated decisions with legal or similarly significant effects.