privacy policy

what we collect

Account information: Email address, name, password (hashed), billing address, payment information (processed by our payment provider, not stored by us).

Usage data: When you log in, what buckets you create, how much data you store, when you request restores. We need this to run the service and bill you.

Technical data: IP addresses, browser type, device information. Standard web server logs. We keep these for security and debugging purposes.

Your files: We store the files you upload. We don't make a practice of browsing your data. However, filenames, paths, and metadata may appear in logs during normal operations and troubleshooting. Your files are encrypted on tape.

what we don't do

We don't sell your data. We don't sell your email to marketers. We don't share your information with advertisers. We don't have advertisers. We don't track you across the web.

cookies

We use cookies to keep you logged in and remember your preferences. If you block our cookies, you won't be able to log in.

analytics

We use Cloudflare Web Analytics, which is privacy-respecting and doesn't use cookies or track individuals across sites. We track aggregate metrics like page views, visit duration, and referral sources to understand how people find us and use the site.

We also track where new signups come from (referral source, campaign parameters) so we know which marketing efforts are working. This information is associated with your account but is not shared with third parties or used for advertising.

data retention

Your files stay on tape until you delete them or close your account. Account information is kept while your account is active and for a reasonable period after (for legal and accounting purposes). Server logs are kept for up to three years. Logs related to tape inventory may be kept indefinitely.

security

Data is encrypted in transit. Data is encrypted at rest. Tape data encryption keys are protected using post-quantum cryptography. Your password is hashed. You may also choose to encrypt your data before uploading to Bombable. No system is perfectly secure, but we take reasonable precautions.

third parties

We use the following service providers to operate Bombable. Each has their own privacy policy:

• Stripe — payment processing
• Cloudflare — DNS, web proxying, and web analytics
• AWS — hosting (user interface, database, control plane, metadata), phone and SMS support via Amazon Connect, internal business applications
• Fastmail — email services

We don't share your data with anyone else unless legally required.

law enforcement

We comply with valid legal requests for information. We may also voluntarily report to law enforcement any content we discover that appears to be illegal. Don't store illegal content on our service.

your rights

You can download your data. You can delete your account. You can update your information. You can request your tapes be mailed to you. If you're in a jurisdiction with specific privacy rights (like GDPR), we'll honor those rights. Email us and we'll help.

changes

We may update this policy. If we make significant changes, we'll notify you by email. The current version is always available at this URL.

contact

Questions? Contact us.