Privacy Policy

Last updated: 15 August 2026

This Privacy Policy explains how ReadOnce.eu (“Service”, “we”, “us”), operated by BiLOUD SRL (VAT: RO34723223, Registration No. J2015002244239), handles information for the Free and Premium offerings. We aim to be precise: privacy is an architecture choice, not marketing copy.

1. Roles & Controllers

• BiLOUD SRL operates ReadOnce.eu and is controller for ReadOnce application data described below.
• LeadHosts provides subscription billing, invoicing, EU VAT treatment (including reverse charge where applicable), and license/access-key administration for Premium. LeadHosts processes billing PII under its own GDPR-aligned practices as billing platform / processor or controller for billing records, as applicable to that relationship.

2. Free Tier — What We Do Not Collect

For Free notes you do not create an account. We do not require email, name, phone number, or payment data — no account · no email · no identity required. We do not run advertising trackers or third-party analytics pixels on the Service.

• We never receive plaintext note/file content or decryption keys by design of the client encryption model. The key lives in the URL fragment and is not sent to our servers.
• Free attachments: up to 10 files and 2 GB total per note.
• Original filenames/sizes for attachments are encrypted client-side where the product encrypts that metadata.

3. What We Store Temporarily (Encrypted Payloads)

For both Free and Premium ciphertext objects we may temporarily store:

• Encrypted content / encrypted file chunks (indistinguishable from random data without the key).
• Non-secret cryptographic parameters needed for decryption by the link holder (e.g. IV, salt).
• Random share/note identifiers used in URLs.
• Operational fields: plaintext byte length, per-file chunk counts, creation time, and expiry time. We need the length to store and serve chunks. That is size metadata — not the file’s contents or its name.
• Encrypted filenames (and an encrypted size label) produced in your browser.
• For new Premium shares, an encrypted integrity payload: your browser hashes plaintext chunks, then encrypts that list with the same share key. We store only the ciphertext. We cannot read the hashes and cannot use them to identify what you sent. A server-side plaintext checksum would break zero-knowledge; we do not keep one.
• Status flags needed to finish an upload (e.g. uploading vs ready) and to delete on burn/expiry.

Retention: Free unread notes expire in 7 days. Premium unread shares expire in 3–10 days by plan (Spark 3 / Pulse 7 / Orbit 10). Revealed/destroyed items are deleted from application storage. Incomplete Premium uploads may be removed after 14 days without upload activity. We do not keep restore-backups of ciphertext after deletion. Architecture details: Security.

Anonymous usage counters: We keep daily aggregate totals (e.g. unique visitors, unique page views, notes created, shares opened, checkout clicks) for product/commercial visibility. Totals are not tied to IP addresses, fingerprints, accounts, or share identifiers. Unique visitor/page-view counts use a first-party cookie only to avoid counting the same browser repeatedly on the same calendar day — the cookie value is not stored in our analytics database.

4. Premium — Account, Entitlement & Separation from Shares

Premium exists so we can authorize large-file capacity. That requires limited identity data:

• Email address — used for login OTP, optional account recovery/sign-in, and matching an active license/subscription.
• Session cookies — to keep you signed in (optionally up to 30 days if you opt in).
• Optional passkeys — WebAuthn credentials for passwordless login (public key material and credential IDs), not share contents. A saved passkey can sign you in later without typing your email.
• License/entitlement records — plan, status, validity window, and sync metadata (manual or future LeadHosts/WHMCS sync).
• OTP hashes — short-lived, for verifying login codes.

4.1 No account-linked file history (important)

• Your LeadHosts billing profile is for subscription, invoices, VAT, and keeping the access entitlement associated with your email.
• Creating a Premium share checks that entitlement at upload time. Once a share is finalized as ready, it is stored as an anonymous encrypted object: there is no account-linked file history or download library tied to your identity.
• Access for recipients is via the share link and key — not via “logged-in files belonging to you.”
• During an in-progress upload we may temporarily associate the upload session with your signed-in user solely to authorize chunk uploads; that association is cleared when the share becomes ready.
• Premium shares may include multiple encrypted files / a folder (up to 100 files, within the plan size cap). Burn happens after a successful download completion of all files in the recipient’s browser (expected size, plus the client-side integrity proof when present). An interrupted download does not destroy the share (see Security). Uploads and downloads are resumable.

5. Email Communications

• Transactional login mail — short-lived one-time codes for Premium sign-in.
• Subscription / license notices — reserved for entitlement and billing-related messages when needed.
• Support — through LeadHosts billing channels for subscription matters (we do not publish public mailbox addresses on this site).

Mail is sent via our mail infrastructure for the ReadOnce domain. We do not use your address for advertising lists.

6. Server Logs

Hosting/web infrastructure may generate standard access or mail logs (IP address, timestamps, request paths without URL fragments, status codes, user agents). These are for security and operations. They are not used to decrypt content. Retention follows operational rotation policies of the hosting stack.

7. Cookies & Local Storage

We do not use advertising cookies or third-party analytics SDKs. Free notes still need no account and no login cookie. The only Free-tier cookie is the optional stats dedup below.

• Free product: no account / session cookies. Creating or reading a Free note does not require signing in.
• Premium: essential session cookie(s) for authentication only (optionally up to 30 days if you opt in).
• Stats dedup (ro_stat) — Free and Premium pages: a short-lived first-party cookie set when you visit public pages (home, plans, security, etc.). It only records which of those pages were already counted for the current calendar day, so one person refreshing cannot inflate “unique visitor” totals. It is not an advertising tracker, stores no email/IP/fingerprint in our analytics database, and expires at the end of the day. Without it, every refresh would count as a new view.
• Upload resume (Premium, sender’s browser only): localStorage may keep the in-progress share id and the decryption key on that device until the upload finishes or you discard it. That is how a multi-day transfer can resume. It is not a key backup on our servers. Clearing site data drops resume.
• Download resume (Premium, recipient’s browser only): IndexedDB may keep a file handle and local progress on that device. Same rule — local only; we do not receive the key.

8. Third Parties

• Fonts — self-hosted on ReadOnce (no third-party font CDN).
• LeadHosts billing — subscription, invoicing, VAT, license keys for Premium.
• Infrastructure providers hosting the Service within our operational environment (EU-oriented hosting).

9. Legal Bases (GDPR)

• Free ciphertext processing: performance of the service you request / legitimate interests in operating a ephemeral encrypted drop, with data minimisation by design.
• Premium account & entitlement: contract (subscription) and legitimate interests in securing accounts (OTP, passkeys, sessions).
• Billing via LeadHosts: legal obligation and contract for invoicing/VAT where applicable.

10. Your Rights

Depending on your situation you may have rights of access, rectification, erasure, restriction, objection, and portability under GDPR.

• We cannot decrypt or export plaintext of notes/shares — we do not have the keys.
• Ciphertext is deleted on burn or TTL.
• For Premium account/email/passkey/license data, contact us to exercise rights. Billing document requests may also involve LeadHosts.

For rights requests relating to Premium account or entitlement data, use your LeadHosts billing support channel. You may also lodge a complaint with the Romanian supervisory authority (ANSPDCP) or your local EU authority.

11. International Transfers

Application servers for ReadOnce are operated in our EU-oriented infrastructure. If a sub-processor outside the EU is ever used, we will apply appropriate transfer safeguards. Billing data handled by LeadHosts follows LeadHosts’ location and transfer practices.

12. Children

The Service is not directed at children under 16. Premium subscriptions are intended for adults / organisations capable of forming a billing relationship.

13. Security Measures

• TLS in transit; HSTS and standard security headers.
• Client-side AES-256-GCM via Web Crypto API.
• no-referrer policy to reduce accidental leakage of share URLs via Referer.
• Parameterized queries, upload authorization checks, OTP rate limits.

14. Limitations (honest)

• Anyone with the full link can decrypt the payload.
• Recipients can copy or screenshot content after decryption.
• Compromised endpoints (malware, malicious extensions) are outside our control.
• Standard server logs may still exist even though ciphertext remains opaque.

15. Changes

We may update this Policy; the “Last updated” date will change when we do. Material changes to Premium billing/privacy will be reflected here and, where appropriate, communicated through billing channels.

16. Data Controller

• Company: BiLOUD SRL
• VAT: RO34723223
• Registration: J2015002244239
• Contact: via LeadHosts billing support (subscription / account matters)