File Retention Policy
Conversion files
Browser-only tools keep documents in page memory and provide downloads directly. Server conversion workers use temporary working files and remove their working folders after completion or a processing deadline. Conversion results are not stored as downloadable account history. Abrupt host termination can leave temporary working folders until operating-system or operator cleanup.
Optional private files and links
When enabled, private files expire three days after acceptance. Links cannot outlive their file and have a maximum three-day lifetime. Expiry is checked on each new download request, so scheduled cleanup is not the access-control boundary. Revocation and deletion stop future requests; a transfer already started or a previously downloaded copy cannot be recalled.
Physical cleanup and interrupted uploads
Incomplete uploads expire after one hour. The background worker removes expired/deleted files, stale upload chunks and orphaned objects on its cleanup cycle. Cleanup depends on that worker running; an outage can delay physical removal while access remains denied. Private file encryption keys are stored separately from file contents.
Metadata and backups
Conversion history is kept for seven days. Transfer events are kept for up to 30 days; account security events are bounded to 100 per account for up to 90 days. Account database backups retain seven local copies. Those backups contain account metadata and may include earlier profiles after live deletion. Private file blobs are not included in those database-only backups. Reports and moderation audit records require controlled operator review and a documented preservation decision where justified.