Last updated 19 June 2026.
This is placeholder copy describing how AbraFile actually handles your data and your account. It is not legal advice; the operator will have it reviewed by a solicitor before launch.
Your files
Files you upload and the converted results are stored only as long as your plan needs them, then deleted automatically:
- Anonymous (no account) — your file is purged the moment you download it. Anything uncollected is swept within minutes (the cleanup job runs every five minutes).
- Starter (the 30-day free trial) — files are kept for 24 hours, then deleted.
- Pro and Power — files are kept while your subscription is active. If your subscription lapses, downgrades, or your trial ends without payment, we hold the files for a 30-day grace period (with reminder emails) and then delete them.
Files are NOT included in our application backups. We back up the database record of a conversion (what was converted, when, by whom), but never the file itself. Deleted means deleted.
During conversion your file is processed on our own servers. It is never sent to a third-party conversion API.
Security and storage
- Every upload is scanned for viruses with ClamAV before conversion. Files flagged as infected are deleted, not converted.
- Files are encrypted at rest with AES-256 (Cloudflare R2 server-side encryption), and in transit over TLS.
- Files are stored in UK data centres.
- We do not sell your files or the data in them, and we do not use your files to train any AI or machine-learning model.
What we store about your account
If you create an account, we store:
- Your email address and a hashed password (we never store the password itself).
- A count of conversions per month (for tier limits) and per-conversion metadata: source format, target format, file size, status, IP address, and locale.
- If you subscribe, a Stripe customer ID and the last four digits of your card. Card numbers themselves are handled by Stripe and never touch our servers.
Anonymous users have no account row. Usage is tracked against a session cookie ID and that ID alone — there is no profile attached to it.
Cookies
We use cookies only for the basics: keeping you signed in, your language, and CSRF protection. No advertising or cross-site tracking cookies. The full list lives on the cookie notice page.
Your rights
We are still legally bound by UK GDPR even though we no longer market ourselves on it. You have the right to:
- Ask for a copy of the personal data we hold about you.
- Have it corrected if any of it is wrong.
- Have your account deleted, taking your data with it. Closing your account from the dashboard does this; emailing us also works.
- Receive a portable export of your account data.
To exercise any of these, email privacy@abrafile.app.
Contact
Questions about this policy or about how we handle your data: privacy@abrafile.app.