Politique de confidentialité

Ce que nous recueillons

Nous gardons délibérément la collecte de données minimale. Plus précisément:

• Session content — the text and files you drop into a session. Both are encrypted with AES-256-GCM in your browser before they are uploaded, so we store ciphertext and nothing else, and it exists only for the lifetime of the session.
• A session name and settings — the memorable name you choose, its expiry time, and whether it is public or password-protected. File sizes are visible to us; filenames are not, as they are encrypted with the content.
• Minimal technical data — request logs and IP address, used only for rate limiting and abuse prevention, never for profiling.
• Pseudonymous session analytics — a session-scoped hash records joins, active duration, exit time, device category, browser, operating system, country, language, timezone, screen and viewport size, colour scheme, connection category, app display mode, referral hostname, and actions such as download, share, link copy, QR opening and session close. We never attach content, filenames, IP addresses or raw user-agent strings to this analytics record, and its identifier cannot be correlated between different sessions.

Nous n'avons pas besoin de comptes. Nous ne demandons pas votre nom, email ou tout détail personnel pour utiliser l'outil de transfert.

Combien de temps on le garde

Sessions are ephemeral by design. Content expires automatically after the timer you choose (a few minutes by default), or the moment you close the session manually.

After expiry, content is purged. Session metadata and its pseudonymous visit records are retained for up to 30 days for aggregate product analytics and abuse investigation, then permanently deleted with the session.

Cookies

We use a functional cookie to remember your language preference. A random identifier is also kept in local storage to count the same browser only once inside each session; the server converts it into a different one-way hash for every session. We use no advertising cookies and perform no cross-site tracking.

To order the language selector, we keep monthly totals by browser and interface language for up to 100 days. These counters contain no session IDs, filenames or content. Session storage prevents repeated counting within the same tab and month. These language samples respect the browser's Do Not Track preference.

Publicité

RapidLink peut afficher des annonces pour garder le service gratuit. Nous utilisons la première publicité qui ne vous suit pas:

• Ads are contextual, not behavioural — they are chosen by the page content, not by a profile of you.
• Notre partenaire publicitaire (EthiqueAds) n'utilise pas de cookies, ne construit pas de profil et ne vend pas de données personnelles.
• Les annonceurs qui réservent des placements directement via notre outil paient via Stripe; leurs coordonnées d'affaires sont traitées uniquement pour remplir et facturer la réservation.

Traitements tiers

Nous comptons sur un petit ensemble de fournisseurs de confiance pour gérer le service:

• Neon — gestion de l'hébergement de la base de données PostgreSQLTM.
• Vercel — hébergement d'applications, stockage de fichiers (Vercel Blob) et analyse d'agrégat conviviale.
• Stripe — traitement des paiements pour les annonceurs seulement.
• EthicalAds — cookieless, contextual ad serving.

Chaque personne ne traite les données que si nécessaire pour fournir sa part du service.

Sécurité des données

Session content is encrypted with AES-256-GCM in your browser, before it is sent. Our storage and database only ever hold ciphertext, and traffic is served over HTTPS on top of that. What differs is who holds the key.

Si vous définissez un mot de passe sur une session, la clé est dérivée de ce mot de passe sur votre appareil en utilisant PBKDF2-SHA256 et n'est jamais transmise. Nous recevons seulement une valeur séparée dérivée du même mot de passe, ce qui prouve que vous le connaissez mais ne pouvez rien décrypter. Une telle session est cryptée de bout en bout: nous ne pouvons pas la lire, et personne ne peut non plus nous contraindre ou nous violer. Si vous perdez le mot de passe, le contenu est irrécupérable, y compris par nous.

If you do not set a password, we hold the key, sealed at rest with a separate master key. This is what allows anyone who knows the session name to open the drop without extra secrets, and it does mean we are technically able to decrypt those sessions. We do not, but you should choose a password for anything you would not want us to be able to read. The interface states which of the two applies before you create a session, and again once it exists.

Access to internal systems is restricted, and the ephemeral design means there is very little data to protect at any given moment.

Vos droits

Under the GDPR and similar laws you may request access to, correction of, or deletion of any personal data we hold about you. Because sessions are anonymous and short-lived, in most cases the fastest route is simply to close or let your session expire.

For anything else, contact us and we will respond within the timeframes the law requires.

Enfants

RapidLink is not directed at children under 13, and we do not knowingly collect data from them.

Changements apportés à cette politique

Nous pouvons mettre à jour cette politique à mesure que le service évolue. Les changements matériels seront reflétés dans la date de la dernière mise à jour ci-dessus.