Privacy Policy

Who is responsible

Graysphere LLC, a Wyoming limited liability company at 30 N Gould St Ste N, Sheridan, WY 82801, USA, is the controller of personal data processed by Markedfile. The contact email is contact@markedfile.com. The company site is https://graysphere.com.

Account data

When you register, we store your name, your email address, and a hash of your password in an authentication database on the server that runs the service. We also store sessions so you stay signed in. A session lasts up to 30 days. We do not ask for a phone number or a postal address.

You can change your name, email, and password from profile settings. Changing the email sends a confirmation to the new address when email delivery is configured, and the address stays the same until that link is opened. Registration can send a verification message. The login screen can send a password reset link when email delivery is configured. You can turn on an authenticator app from profile settings. While it is on, signing in asks for a current code from that app. We store an encrypted authenticator secret and encrypted backup codes. The plain codes are shown once. A backup code can be used once to sign in, and then it no longer works. From profile settings you can see the devices signed in to this account, when each session started, and sign out another device or every other device. That list shows an approximate browser and system. It does not include session tokens or network addresses.

Product records

A separate database stores workspaces, members (name and email), invitations, and file records. An invitation stores the invited email and a hash of the token, not the token itself, and it expires after 7 days. A file record stores the identifier you assigned, the file name and type, processing layers, timestamps, status (active, paused, or expired), and a detection token while the file is active. A Business or Enterprise workspace can store API keys. We store the name, a short prefix, and a SHA-256 hash of the secret. The secret is shown once and is not stored. An audit row records who created or revoked a key, and each mark or detection made with that key: the time, the key prefix, the action, and the identifier you assigned. It does not store the file. A report of abuse, or of a file someone believes is theirs, stores the date, the requester's name and email, a short description, and the kind of request. It does not store the file.

File contents

Uploaded bytes and marked copies are processed and are not kept. A video is written to a temporary file on the server and deleted when the job finishes, or within 30 minutes if it is still there. Do not send a file if you do not want it processed for watermarking or detection.

Cookies and local storage

better-auth.session_token keeps you signed in. It is HttpOnly and lasts up to 30 days. On HTTPS the name may use a secure prefix.

theme and theme-color store your appearance (light, dark, or system). The same choice is stored in localStorage under the key theme.

markedfile_workspace remembers the workspace you selected. It is HttpOnly.

markedfile_locale remembers the language you choose. It is not HttpOnly.

mark_session is a legacy cookie from an older anonymous session. It is read only to move old file records onto your account. New sessions do not rely on it.

markedfile_promo stores a promotion code from the page address for checkout. It is not HttpOnly and lasts 7 days.

markedfile_touch stores the first and last advertising parameters from the page address. It is not HttpOnly and lasts about 90 days.

markedfile_ads_consent stores Accept or Reject for Google Ads measurement. It is not HttpOnly and lasts about 180 days.

Google's ads tag may set measurement cookies, including IDE, _gcl_au, _gcl_aw, and _gcl_gb. In the European Union, the EEA, and the United Kingdom those cookies are set only after you accept. Elsewhere they may be set when the tag loads, unless you have rejected measurement.

markedfile_ref stores a referral code from the page address. It is not HttpOnly and lasts about 90 days. The code is saved on the account when you register.

Email

When Resend is configured, with an API key and a from-address, Markedfile can send a branded workspace invitation through Resend in the sender's language, one of the 22 languages the service offers. That message includes the recipient address, the workspace name, and an invitation link. A failed invoice sends one message to the workspace billing email, in the workspace owner's language, one of those 22 languages, with a link to Manage subscription. If that invoice is paid later, one message says the payment went through. The invoice id is stored so the same notice is not sent twice. A public report sends one notice to the public inbox and to each configured admin address. The notice includes the requester's name and email, a short description, and a link to the admin page. The file is not attached. Resend processes the message as the email provider. When Resend is not configured, no invitation email is sent and the owner copies a link. On a local machine the unsent message can be previewed; a public production server does not store it. Markedfile does not send marketing email.

Payments

When Stripe is configured, checkout and the billing portal are provided by Stripe. Markedfile would receive subscription status (plan, status, and period end) and a customer reference. Card numbers are handled by Stripe and are not stored by Markedfile. When Stripe is not configured, we do not send payment data to Stripe and we do not charge you.

Analytics

Pages send the page address to Google Analytics. When the address contains a token, the query is omitted, and an invitation link is sent as /invite. In the European Union, the EEA, and the United Kingdom Google Analytics stays unloaded until you accept, the same choice as the ads tag. Google Analytics can store its own cookies. File contents are not sent. When you start a paid checkout and measurement is allowed, the Google Analytics client id and session id from your Google Analytics cookies are saved in the Stripe checkout metadata. After Stripe confirms a real payment, our server sends Google Analytics one purchase event for that subscription through the Measurement Protocol, with that client id, the transaction id, the plan, the billing period, the amount, and the currency. A free trial start is not sent as a purchase. Nothing is saved or sent if you have rejected measurement. In the European Union, the EEA, and the United Kingdom this happens only after you accept.

When Google Ads is configured, pages can also load Google's tag to measure a new account and a paid subscription. In the European Union, the EEA, and the United Kingdom the tag stays unloaded until you accept. Elsewhere it loads unless you have rejected it. Accept and reject are stored in the cookie markedfile_ads_consent. The cookie markedfile_touch stores the first and last advertising parameters from the page address, including utm fields, gclid, gbraid, and wbraid. Those parameters are saved on the account and the workspace when you register, and they are included in Stripe checkout metadata. Google may store its own cookies after you accept, or when the tag loads outside those countries. File contents are not sent to Google. This measurement is conversion tracking with enhanced conversions. When you sign up or pay, and measurement is allowed, the tag may send Google a SHA-256 hash of your email address. In the European Union, the EEA, and the United Kingdom that hash is sent only after you accept. When the browser you finish signing up in cannot report the signup itself, for example when you confirm your email in another app or on another device, our server sends Google the same signup conversion with the ad click id saved from your first visit and a SHA-256 hash of your email address. In the European Union, the EEA, and the United Kingdom this happens only after you accept. Google's privacy policy is at https://policies.google.com/privacy.

Retention

Account data is kept while the account exists. An account that is still unverified 7 days after registration is deleted, along with its sessions and personal workspace. About one day before that, one reminder is sent when email delivery is configured. From profile settings you can download a ZIP of your profile, the workspaces you belong to, and the file records you can see. That file lists the identifier, file name, type, dates, and status. It lists API key names and prefixes, not the secrets. It does not include file contents or detection tokens, and it does not include another person's account. The same settings can delete the account after you enter your password. Deleting the account removes the login and the memberships. Your personal workspace and its file records stay. A shared workspace you own goes to the earliest other member. Files in a workspace you do not own stay in that workspace. Paid subscriptions on workspaces you own are canceled. To remove the personal workspace as well, ask Graysphere LLC at contact@markedfile.com. That deletion cancels paid subscriptions on workspaces the account owns, using the sandbox or live Stripe account stored for each workspace. It removes the personal workspace and its file records, watermark hashes, Stripe customer bindings, and API keys, and it removes a shared workspace that has no other member. A shared workspace with another member goes to the earliest other member. Files in a workspace the account does not own stay there. A file stays detectable while it is active. Records stay until you delete them or they expire. Deleting a file ends detection and frees a slot. On Free, an active file expires 6 calendar months after marking, and the detection token is removed. Expired records can remain as history without a token.

Who we share data with

We do not sell personal information. Pages send the page address to Google Analytics. We share other information with Resend or Stripe only when those services are configured and only for the purpose above. When Google Ads is configured, the tag shares the page address and a signup or purchase conversion, including the amount and currency, with Google. Enhanced conversions may also share a SHA-256 hash of your email address when you sign up or pay. In the European Union, the EEA, and the United Kingdom that hash is sent only after you accept. When the browser you finish signing up in cannot report the signup itself, for example when you confirm your email in another app or on another device, our server sends Google the same signup conversion with the ad click id saved from your first visit and a SHA-256 hash of your email address. In the European Union, the EEA, and the United Kingdom this happens only after you accept. After Stripe confirms a real payment, our server also sends Google Analytics a purchase event through the Measurement Protocol, with the Google Analytics client id saved at checkout, the transaction id, the plan, the amount, and the currency. This happens only when measurement was allowed at checkout. In the European Union, the EEA, and the United Kingdom this happens only after you accept. Google's privacy policy is at https://policies.google.com/privacy. We may disclose information if the law requires it.

We use Sentry, provided by Functional Software, Inc. (United States), to collect error and diagnostic data, such as stack traces and browser and device information, so we can detect and fix bugs. Error reports pass through our own /monitoring tunnel, which processes the sender's IP address to limit how many reports each address can send. Sentry's privacy policy is at https://sentry.io/privacy/.

Contact

Privacy questions go to Graysphere LLC at 30 N Gould St Ste N, Sheridan, WY 82801, USA, or by email at contact@markedfile.com. The company site is https://graysphere.com.