Privacy Policy

Version 2026-09-05 · HelloRoom Image Transfer, a free service run by a private operator.

1. Short version

No accounts, no cookies, no analytics, no ads, no trackers, and nothing sold or shared. Images are encrypted on your device before upload with a key the server never receives, so the operator cannot view them. The server stores ciphertext plus the minimum needed to keep a collection private to your devices, and everything is deleted on a short schedule.

2. What is stored on the server

Your images, encrypted (AES-256 with an authentication tag): the full image, a small thumbnail, and a sealed record holding the display name and pixel size. None of these can be opened without your collection key.
The collection ID, a random room-xxxxx name used as the folder name. It is shown on this page and in the headset under Options → Connection.
A salted PBKDF2-SHA256 hash of the collection's PIN. The PIN itself is never written to disk.
SHA-256 hashes of connected-device tokens. The tokens themselves are never written to disk.
While a connect code is live (15 minutes), the collection key wrapped under that code, in server memory only.

Original filenames are stored only inside the encrypted record; files on disk carry random ids. Your device re-encodes each image before encrypting it, which drops EXIF metadata such as camera, timestamp, and GPS tags — only orientation is applied. Anything visible in the picture is of course still there, encrypted.

3. What is stored in your browser

Local storage holds your acceptance of these documents and, for each collection connected with a headset code, the collection ID, a random device token that keeps this browser connected, and the collection's encryption key. Forgetting a collection on this page removes all three; the headset disconnecting all devices invalidates the token; clearing browser data removes everything. No cookies are set.

4. What is collected automatically

Your IP address is held in server memory to rate-limit failed access attempts, connect-code guesses, and new-collection creation; it is not written to disk. Application logs record collection IDs, image ids, and events with timestamps, and are rotated at 30 MB. The HTTPS front end keeps no request log. No profiling, no advertising identifiers, no third-party analytics.

5. Who can see your images

The headset that created the collection and every connected device — that is the entire access model, so share connect codes carefully. The operator cannot see your images: the server holds only ciphertext, and the key exists only on your devices. What the operator can see is the metadata in section 2: collection IDs, how many encrypted files each holds, their sizes, upload times, and how many devices are connected.

Honest limits: the key travels between your devices protected by the 6-character connect code, stretched with 600,000 rounds of PBKDF2-SHA256. That makes guessing the code from server data expensive, not impossible for someone with server access and serious computing effort. The service is built so the operator does not look and cannot look casually, and is not certified against a determined, well-funded attacker. Traffic is encrypted in transit over HTTPS.

6. Retention

Images are deleted automatically 30 days after upload. You can delete images yourself at any time from the gallery, and the operator may remove images or collections at any time. There is no guaranteed minimum retention period, no archive, and no backup — deletion is final. Deleting an entire collection appends one record with the collection ID, the time, and the number of files removed; these records hold no other data and are kept for up to 12 months as proof of deletion.

7. Deleting your data

Single images: delete them from the gallery on this page. The encrypted file, thumbnail, and record are removed immediately.
Everything: in the headset, open Options → Connection → Delete Server Data. The whole collection — files, PIN hash, and device registrations — is erased immediately and the headset forgets its key.
By request: email the address below with the collection ID. The operator erases the collection, normally within a few days and in any case within one month, and confirms by reply. Without a collection ID the operator cannot identify which data is yours, because nothing else links a collection to a person.

8. Your rights

Where the GDPR or similar laws apply, you have the right to access, correct, export, and erase your data, and to complain to a supervisory authority. Access and export are immediate: your connected devices hold the only readable copies, and the gallery lets you download any image. Erasure works as described above. The operator processes your data to provide the transfer you request; the legal basis is performance of that service. The server is a virtual machine hosted by DigitalOcean, which stores the encrypted files on the operator's behalf and cannot read them either.

9. Children

The service is not directed at children under 13 and does not knowingly store their personal data.

10. Changes

This policy may change; the version stamp above changes with it, and acceptance is asked again.

11. Contact

Privacy questions or deletion requests: server-admin@yoavinations.com.