Filevolo

Privacy Policy

Last updated: October 8, 2026

Filevolo is built so that using it requires giving up as little as possible. This page explains exactly what that means in practice. Filevolo is operated by an individual entrepreneur established in Hungary, who is the data controller for the information described below.

The short version

Files you process with Filevolo

Every tool marked "runs entirely in your browser" does exactly that: the file is read, processed, and turned into a result using your browser's own capabilities, and it never leaves your device. Filevolo has no server-side code path that receives, stores, or even briefly touches these files - with two deliberate, explicitly-labeled exceptions, described next.

Sign & Send (the one exception)

Sign & Send, a Filevolo Pro feature, needs more than one person to open the same document, sometimes on different days - that only works if the file exists somewhere other than the first person's own device. When you use it, we store the document you upload, the name and email address you enter for each signer, and - once someone signs - the signature image, the time they signed, and the IP address the signing action came from. This is used only to run the signing request itself and to produce the certificate page appended to the completed document; it is not used for advertising or shared with any third party beyond the infrastructure providers who host Filevolo itself (see below). The document and everything tied to it is deleted automatically 30 days after the request is created, whether or not every signer has signed by then. Sign & Send's own page states this plainly before you use it, not only here. Everything stored for Sign & Send is encrypted at rest (AES-256) on our server - a real, separate layer of protection against anyone who might get raw access to the storage itself (a stolen backup, a compromised disk), on top of, not instead of, the access controls above. This is a narrower guarantee than Secure Share's, below: Filevolo's own systems still hold the key here and decrypt this data when the feature itself needs to (rendering a signer's page, assembling the final signed document), because that is what the feature requires to work.

Secure Share (the strongest guarantee we can make)

Secure Share encrypts your file in your browser, with a key generated in your browser, before anything is uploaded. That key is never sent to us - it travels to whoever you share the link with entirely inside the link itself, in the part after the # character, which is a part of a URL that browsers never include in a request to a server. The practical result: our servers store and serve an encrypted file we cannot read, not because we've chosen not to, but because we never have the key to do so at any point, including the moment you upload it. We do still know a file exists, when it was uploaded, its size, and when it's downloaded - the parts of this that necessarily pass through a server just to move bytes around - but never its content or its real filename, which is encrypted along with the file itself. A shared file is deleted automatically after 7 days, or immediately after its first download if you choose "delete after first download" when creating the link.

Information we collect

If you never pay for anything: essentially nothing that identifies you. The free daily task allowance is tracked in your browser's local storage, on your device only; it is never sent to us. Filevolo also saves its own pages and code in your browser's cache (through a service worker) so that tools you have already opened still load without a connection. That copy stays on your device and never contains your files.

If you subscribe to Filevolo Pro, buy Pro Lifetime, or buy a task-credit or signature pack: we store your email address, a Stripe customer/subscription or payment identifier, and your subscription or credit status, so we can recognize you as a paying customer and stop showing ads (or track your remaining credits). We never see or store your card number - Stripe's own hosted checkout handles that directly, and Filevolo's servers only ever receive a payment confirmation and your email.

If you sign in with Google: we ask Google for one thing only, your email address, and only once Google has confirmed that you own it. We do not receive your name, photo, contacts or anything else from your Google account, and we do not send Google anything about what you do on Filevolo. Signing in with Google uses the same account as signing in with an email and password.

Legal basis for processing (EEA/UK users)

If you are in the European Economic Area or UK, we rely on: contract (to provide the Pro subscription or credits you bought), legitimate interest (to keep the Service secure and understand aggregate, anonymous usage), and consent (for any advertising cookies, where applicable and where local law requires it - see Cookies and Advertising below).

Cookies

Full detail - every cookie and local-storage value, exactly what each does - lives on its own page: see the Cookie Policy. In short: two cookies prove you're a paying Pro subscriber or credit holder, and are strictly necessary to deliver something you already asked for, so they do not require consent. When ads are active, a banner asks for your choice before any advertising cookie is set - see Advertising below.

Usage analytics

Filevolo counts usage on its own server, with no outside analytics service involved. It records how many people visit each day, which pages and tools are opened, whether a tool finished, and which website sent the visitor, as daily totals only. No IP address, cookie or identifier is stored with those totals, nothing links one visit to another, and the events never include a filename or file content. To count a visitor once a day, your browser keeps the date of your last visit in its local storage. Nothing is counted if your browser sends Do Not Track or Global Privacy Control, or on pages whose address contains a private link.

Advertising

AdSense advertising is paused while our application is under review. Where required, Google's certified consent platform handles your advertising choices. Non-personalized advertising is not necessarily cookie-free. You can revisit your choices using the privacy and cookie settings link. Google's own settings are at Google's Ads Settings and read more in Google's Privacy & Terms. Filevolo Pro removes ads entirely.

Third parties we work with

We do not sell personal data to anyone, and we do not share it beyond what is needed for the services above to function.

International data transfers

Stripe, Google, Cloudflare, and jsDelivr may process data outside the country you are in, including in the United States. Where that requires a safeguard under EU/UK law, we rely on mechanisms such as the European Commission's Standard Contractual Clauses, which these providers make available to their customers.

How we protect your data

Your card details are handled entirely by Stripe's own PCI-compliant systems and never reach Filevolo's servers. The limited data we do store - your email and subscription or credit status - is kept on infrastructure with access restricted to what is needed to run the Service. No method of transmission or storage is completely secure, but we take reasonable, industry-standard steps to protect what we hold.

How long we keep data

Subscription and credit records are kept for as long as your account is active, plus a reasonable period for accounting and fraud-prevention purposes, then deleted. A Sign & Send request - the document, signer names and emails, and any signatures - is deleted automatically 30 days after it is created, regardless of whether it was completed. A Secure Share file is deleted after 7 days, or immediately after its first download if "delete after first download" was selected. You can ask us to delete your data at any time - see Your rights below.

Your rights

Wherever you are, you can ask us to tell you what data we hold about you, correct it, export it, or delete it, and you can object to or ask us to restrict certain processing. If you are in the European Economic Area or UK, these are rights under the GDPR, and you also have the right to lodge a complaint with your local data protection supervisory authority if you are not satisfied with our response. Filevolo has no reason to refuse a legitimate request regardless of where you are. Contact us at [email protected] to make a request.

California residents

Under the CCPA/CPRA, California residents have the right to know what personal information we collect, request its deletion or correction, and opt out of the "sale" or "sharing" of personal information. Filevolo does not sell personal information for money. If and when advertising is turned on, an ad partner like Google using cookies for interest-based ads may count as "sharing" under California law; you can opt out at Google's Ads Settings or by sending a Global Privacy Control signal from your browser, which we honor. Exercising any of these rights does not result in different treatment or reduced service. To make a request, contact [email protected].

Children

Filevolo is not directed at children and does not knowingly collect data from anyone under 16. If you believe a child has given us personal information, contact [email protected] and we will delete it.

Changes to this policy

If what Filevolo collects or does with data changes - for example, connecting a real analytics provider or adding a server-side tool - this page will be updated, with the date above reflecting the change.

Contact

Questions about this policy: [email protected].