Privacy Policy

Version 2026-08-26-2 · HelloRoom Image Transfer, a free service run by a private operator.

1. Short version

No accounts, no cookies, no analytics, no ads, no trackers, and nothing sold or shared. The service stores the images you upload and the minimum needed to keep them private to your devices.

2. What is stored on the server

• Your images, re-encoded to plain sRGB JPEG or PNG, plus a small thumbnail of each.
• The collection name, as a folder name.
• A salted PBKDF2-SHA256 hash of the collection's PIN. The PIN itself is never written to disk.
• SHA-256 hashes of connected-device tokens. The tokens themselves are never written to disk.
• The original filename, sanitized, kept as the stored filename.

Re-encoding drops EXIF metadata, so camera, timestamp, and GPS tags from your original files are not stored — only orientation is applied. Anything visible in the picture is of course still there.

3. What is stored in your browser

Local storage holds your acceptance of these documents and, for each collection connected with a headset code, the collection name and a random device token that keeps this browser connected. A token persists until you forget that collection on this page, the headset disconnects all devices, or you clear browser data; the server stores only token hashes. No cookies are set.

4. What is collected automatically

Your IP address is held in server memory to rate-limit failed access attempts, connect-code guesses, and new-collection creation, and server logs may record IP address, timestamp, request path, and response status. Active connect codes are held in server memory until they expire. No profiling, no advertising identifiers, no third-party analytics.

5. Who can see your images

The headset that created the collection and every connected device — that is the entire access model, so share connect codes carefully. The operator has filesystem access to the host and can technically read stored files. Traffic is encrypted in transit over HTTPS; files are not encrypted at rest.

6. Retention

Images stay until you delete them or the operator removes them. There is no guaranteed retention period, no archive, and no backup to restore from.

7. Deleting your data

Delete individual images from the gallery on the transfer page. To have a whole collection removed, email the address below with the collection name.

8. Children

The service is not directed at children under 13 and does not knowingly store their personal data.

9. Changes

This policy may change; the version stamp above changes with it, and acceptance is asked again.

10. Contact

Privacy questions or deletion requests: server-admin@yoavinations.com.