Privacy Policy

Last updated: August 2026

Your privacy matters to us. This policy explains what we collect when you use Fast2Share, why we collect it, who else sees it, and what you can do about it. It covers the website, the panel, the download links and the API. By using the service you accept the current version of this policy; the version published here, with the date above, is the one that applies.

1. Managing your information

You can review and change most of what we hold about you directly in the panel, under Settings — your display name, email, password, two-factor authentication, API tokens and, for affiliates, your payout wallet. Deleting a file removes it from the service. If you want something we do not expose in the panel, ask us through the contact form and we will deal with it.

2. What we collect

Account information. To have an account you give us an email address and a password. The password is never stored — we keep only an Argon2id hash of it, which cannot be reversed. We also store your display name if you set one, your two-factor secret if you enable 2FA, the date of your last sign-in, and — if you choose to link it — your Telegram account, so the bot can talk to you.

File information. For every file you upload we store its name, size, MIME type, content hashes, which storage server holds it, its folder, its share link and its visibility, plus the timestamps and expiry date. The file's contents live on our storage servers; we do not inspect them except as described in section 6.

Payment information. We do not see or store card numbers or wallet keys. Our payment providers handle the payment itself and tell us only what we need to activate your plan: an order reference, the amount, the currency and whether it settled. For affiliate payouts, we store the wallet address you enter, because we have to send money to it.

Support information. A ticket keeps what you write, any images you attach, and the IP address the message was sent from — the last one so we can tell a genuine account recovery from an attempt to take an account over. If you write to us from the contact form without an account, we store the email address you gave and a random token that lets you reopen the thread.

Usage data. Each download is logged: the file, the time, the number of bytes served, the IP address and the country derived from it, and whether the download was free or premium. This is what enforces your daily bandwidth allowance, what pays affiliates for real traffic, and what lets us spot abuse. We also keep ordinary web-server logs for a limited period.

3. Cookies and local storage

We keep this deliberately small. There are no advertising cookies and no third-party analytics on this site.

• a session cookie, so you stay signed in;
• a CSRF token tied to that session, so a form you submit really came from you;
• a short-lived referral cookie when you arrive through an invite or affiliate link, so the right publisher gets credited;
• a cookie set by Cloudflare Turnstile on the pages protected by it (see section 4);
• your theme choice (light or dark), which is kept in your browser's local storage and never sent to us.

Blocking the session and CSRF cookies will stop you from signing in. Everything else is optional to the extent your browser lets you refuse it.

4. Who else processes your data

We use a small number of providers, and give each of them only what it needs:

• Payment providers take the payment and confirm it to us. Their own privacy policies apply to whatever you enter on their pages.
• Cloudflare Turnstile checks that sign-ups, sign-ins, contact-form submissions and free downloads come from a person rather than a script. It sees your IP address and browser characteristics.
• proxycheck.io may be consulted with a download's IP address, when that check is enabled, to determine the country and whether the connection is a proxy/VPN — this is what keeps affiliate earnings honest.
• Google Translate may be sent the text of a support message so our team can read it in a language they speak. Do not put anything in a ticket you would not want machine-translated.
• Our email and Telegram notifications deliver account mail and, if you linked it, bot messages.

Our storage servers are our own — your files are not handed to a third-party cloud. We do not sell your personal information, and we do not share it for advertising.

5. How long we keep it

Files are deleted when you delete them, when their retention period ends, or when the account is closed — whichever comes first. Download logs are retained only as long as they are useful for bandwidth enforcement, affiliate accounting and fraud investigation. Support tickets and payment records are kept longer, because we may need them for accounting, tax or dispute purposes. When you close your account we remove your files and revoke access; a limited record may remain for the period we are required to keep it.

6. When we look at, or disclose, your information

We do not routinely review what users upload. We will access, retain or disclose account information, file metadata and logs where we reasonably believe it is necessary to: comply with the law or a valid legal request; respond to a report under our abuse and DMCA procedure; enforce our Terms; investigate fraud, payment abuse or a security incident; answer your own support request; or protect the rights and safety of our users, ourselves and the public.

7. Be careful what you share

A share link is a capability: anyone who has it can download the file, and they can pass it on. Files you mark public may be found by anyone with the link. Think about what a file contains — documents often carry names, addresses and metadata you did not intend to publish. If a link gets out, delete the file or make it private; both take effect immediately.

8. Security

Passwords are hashed with Argon2id, traffic runs over TLS, uploads and downloads go straight between you and the storage servers over short-lived signed links, and admin access is IP-restricted. Two-factor authentication is available and we recommend turning it on. That said, no system is perfectly secure: we cannot guarantee the security of anything you upload or transmit, and you do so at your own risk.

9. Links to other sites

Share links can be posted anywhere, and pages that link to us are not ours. We do not control or endorse third-party sites, and this policy does not cover them. Read their privacy policy before giving them anything.

10. Children

Fast2Share is not for children. We do not knowingly collect information from anyone under 16 (or the minimum age in your country, if it is higher). By using the service you confirm you meet that age. If we learn that an account belongs to someone younger, we close it and delete the information we hold.

11. Your rights

Depending on where you live, you may have the right to ask for a copy of the personal data we hold about you, to correct it, to have it deleted, to restrict or object to how we use it, or to receive it in a portable form. Ask through the contact form from the email address on the account, and we will respond within the time the law allows. Most of these you can exercise yourself in the panel straight away.

12. Changes and contact

We may update this policy; material changes will be announced on the site. For anything about privacy, use the contact form — rights-holder reports go through the abuse and DMCA procedure instead.