1. Our Simple Privacy Promise
GPHosting is designed from the ground up to collect only the absolute bare minimum data needed to process and deliver your files. We do not sell, rent, monetize, or broker your personal data. We do not place ad-tracking cookies, record your screen, or build behavioral profiles about you.
No Google Analytics, no Meta / Facebook Pixels, and no covert marketing tags.
We use only a single secure, encrypted session cookie to keep you logged into your account.
Your files, share links, and download traffic are never inspected or sold to third parties.
2. How Your Files Travel (Direct to Storage)
On typical legacy file hosts, your file is routed through intermediary proxy servers, allowing the hosting provider to sniff, buffer, or retain unauthorized copies.
GPHosting uses direct storage architecture. When you upload or download a file, your browser communicates directly with secure cloud storage using secure, short-lived direct upload authorizations. Our application servers never receive the raw file payload, never write your files to application server disks, and cannot read your contents.
3. Secret Client-Side Encryption & SHA-256 Verification
When you activate Client-Side Encryption, your file is scrambled directly on your device using AES-GCM 256 prior to transit:
The secret unlock key is appended strictly after the # character in the link. HTTP specifications mandate that web browsers never send hash fragments to any server. Consequently, our servers never receive, store, or have access to your decryption key.
Our storage backend holds only ciphertext. In addition, an anti-tamper SHA-256 checksum is computed on upload and verified on receipt to guarantee that nobody has modified or corrupted your data.
4. Permanent Deletion & Zero-Stale Lifecycle Purge
When a file reaches its expiry timestamp, exhausts its download allowance, or finishes its 60-second Burn on Preview countdown, it is permanently purged:
- Storage Blobs: Raw encrypted or unencrypted file bytes are immediately and irreversibly deleted from cloud storage.
- Database Records: File metadata, share link records, and access logs are permanently wiped from the database.
- Active Memory Shredding: All ephemeral download session tokens, active lease reservations, and rate-limit counters associated with that link are evicted instantly from high-speed memory.
- Zero Shadow Backups: We do not keep cold archive duplicates or unpurged snapshots. Deletion is absolute.
5. Minimal Stats & Hardware Device Anti-Abuse Shield
We collect only aggregate, privacy-safe analytics and use lightweight device signals strictly to protect users from automated abuse:
We display high-level geographic counts (e.g. view count by country) so you know who accessed your link. We do NOT save visitor IP addresses in your persistent download logs.
To prevent malicious bots from exhausting single-use download slots, hoarding burner links, or conducting sybil attacks, we generate a privacy-preserving mathematical hash based on browser/hardware entropy. This hash is used strictly for real-time abuse prevention in ephemeral memory, never for user profiling, and is never shared or sold.
6. Account Information We Store
When you create an account using Google authentication:
- Profile Details: Your email address, full name, and avatar image URL provided by Google OAuth.
- Storage Tracking: The current aggregate size of your uploaded files to monitor your storage quota (typically 5 GB).
- Developer API Keys: Created via a 2-step verification flow. We display the secret key once and store only a cryptographic one-way hash in our database. We can never view or retrieve your plaintext key.
7. Bot Protection Without Annoying Puzzles
We use privacy-preserving smart bot verification to shield our upload and login endpoints from automated bot spam. Unlike legacy CAPTCHAs, it runs seamlessly in the background without cross-site tracking cookies or interactive puzzle games.
8. Trusted Cloud Partners & Infrastructure
We collaborate strictly with enterprise-grade cloud infrastructure partners:
| Infrastructure Layer | Operational Role | Privacy & Data Handling |
|---|---|---|
| Encrypted Cloud Storage | Storage & Delivery | Stores encrypted file blobs securely and delivers downloads directly with zero payload inspection. |
| Authentication & Records | Database & Access Control | Provides secure account authentication and manages access control records for active share links. |
| High-Speed Memory Cache | Speed & Rate Limiting | Manages temporary rate-limit counters and ephemeral session state to prevent automated abuse. |
| Global Web Hosting & Edge CDN | Application Delivery & Routing | Delivers web application pages, applies strict security headers, and caches public static media at the edge. |
9. Your Rights & Total Deletion (GDPR & CCPA)
You retain complete autonomy and ownership of your data at all times:
- Right of Access (Article 15): You have complete visibility into every byte stored on GPHost. Your dashboard and Settings display real-time storage metrics, categorized byte breakdowns, active links, and audit history.
- Right to Data Portability (Article 20 — 1-Click Export): You can export your entire personal data archive directly from Account Settings in both Structured JSON and a Standalone HTML Dossier. Data export requests are rate-limited to 5 requests per hour per account to safeguard platform availability.
- Data Retention Lifecycles: Uploaded files are strictly governed by their configured expiration presets (1 hour to 90 days TTL, or permanent if granted) and are physically destroyed immediately upon expiration. Single-use links are purged 50 seconds after their download lease concludes. Download telemetry and access audit records are retained on a strict 90-day rolling lifecycle, after which older records are permanently purged by our automated lifecycle sweeper.
- Right to Erasure (1-Click File Deletion): You can delete any uploaded file or share link instantly with one click.
- Complete Account Deletion: You can permanently delete your entire account in Account Settings. Doing so immediately purges all your profile information, files, database records, and API keys with zero grace period.
10. What Changed Over Time (Privacy Revision History)
| Version | Date | Status | Summary of Privacy Updates |
|---|---|---|---|
| v1.0.0 | September 14, 2026 | Original Launch | Initial privacy commitments, zero ad policy, and basic direct-transit documentation. |
| v2.0.0 | September 16, 2026 | Superseded | Documented client-side zero-knowledge encryption and secret key isolation in the link hash. |
| v2.5.0 | September 17, 2026 | Superseded | Added auto-deletion details for Burn on Preview (60s countdown) and single-use downloads. |
| v3.0.0 | September 18, 2026 | Superseded | Added smart anti-spam rate limiting, privacy-first bot protection, and hashed API keys. |
| v3.1.0 | September 19, 2026 | Prior Revision (Superseded) | Rewrote the privacy policy in plain, simple English so anyone can easily understand how their data and privacy are protected. |
| v3.2.0 | September 30, 2026 | Active & Effective | Documented privacy safeguards for hardware device fingerprinting (anti-abuse only), Zero-Stale lifecycle purge, 2-step API key one-way hashing, and SHA-256 anti-tamper checksum integrity. |