Privacy Policy

Last updated: November 2026

This explains what MyFiles collects, why, who can see it, and your rights under Kenya's Data Protection Act, 2019.

1. What we collect

Account data: your email address and a password (the password is stored in scrambled form by our sign-in provider; we cannot read it).
Your content: event titles, dates, locations, descriptions, folder and file names, and the photos and videos you upload, including any information inside them (such as the time or place a photo was taken).
Technical data: your IP address and basic request information, used briefly to keep the service secure and to limit abuse (for example too many sign-ups or uploads).
Reports: the text of a report and a scrambled (hashed) form of the reporter's IP address, used only to stop report spam.

Visitors who open a share link do not need an account and we do not ask them for personal details.

2. Why we use it

To run the service: to let you sign in, store your files, show them to people with your link, enforce limits, keep the service safe, and respond to reports and legal requests. We do not sell your data and we do not show ads.

3. Who can see what

Other hosts can never see your events or files.
People with your link can see and download everything in a published event.
The service owner uses a management page that shows only counts and sizes (host email, status, number of events, storage used). It does not show event titles, files or links.
Honest note: the service owner administers the database and the storage account and so technically has the ability to open any file. The owner does not browse hosts' content, and would only access it to deal with a report or abuse, to fix a technical problem, or where the law requires it.

4. Where it is stored

We use trusted providers: Supabase (accounts and event records) and Cloudflare (website, application code and file storage). Your data may be processed in countries outside Kenya. These providers act on our behalf and have their own security and privacy commitments.

5. How long we keep it

Your content is kept until you delete it. Deleted items stay in the recycle bin for 2 days and are then permanently removed.
If you delete your account, all your events and files and your sign-in are permanently removed.
Backups made by our providers may keep copies for a short time after deletion.

6. Cookies and similar storage

We do not use advertising or tracking cookies. Your browser stores your sign-in session and your light or dark mode choice on your own device so the site works.

7. Your rights

Under the Data Protection Act you may ask to see, correct or delete your personal data, and to object to how it is used. You can delete your events, files and entire account yourself from the Storage page at any time. For anything else, use the Report link on an event page or the owner's contact route for this service.

If you think your data has been mishandled you may also complain to the Office of the Data Protection Commissioner in Kenya.

8. Children

Accounts are for people aged 18 and over. If you share photos of children, make sure their parents or guardians are happy for you to do so.

9. Changes

If this policy changes, the date at the top will change. Please check it from time to time.