Last updated: 7 October 2026
Skypost (“we”, “us”) runs the file transfer service at skypost.co.uk, including the website, installable app and API. For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, we are the controller of the personal data described in this policy.
We have not appointed a Data Protection Officer. Questions about privacy go to the email above.
If you use Skypost through a team or business account, the organisation that runs the team decides how files shared in that team are used. For that content the organisation is the controller and we act as its processor, handling it only to provide the service. Ask the organisation about how it uses your data. We remain the controller for account, billing and security data.
Please do not upload special category data (such as health records) about other people unless you have a lawful basis to share it.
If you use our email, SMS or WhatsApp sharing, we use the recipient’s email address or phone number only to deliver that message. We keep a masked version (for example j***@example.com) to show delivery status. If you share someone’s contact details, make sure they would expect to hear from you.
Payments are handled by Stripe. We store your Stripe customer ID and subscription details. We never see or store your full card details.
UK GDPR requires a lawful basis for each use of personal data. Ours are:
| Purpose | Lawful basis |
|---|---|
| Storing, encrypting and delivering your files | Contract: needed to provide the service you asked for |
| Creating and running your account, team and plan | Contract |
| Taking payments and managing subscriptions | Contract |
| Sending share messages to the recipients you choose | Legitimate interests: delivering the files you asked us to send |
| Service emails (password resets, security and billing notices) | Contract and legitimate interests |
| Preventing abuse, fraud and attacks; rate limiting; security logs | Legitimate interests: keeping Skypost and its users safe |
| Handling abuse reports and removing illegal content | Legal obligation and legitimate interests |
| Counting page visits (anonymous daily totals) | Legitimate interests: understanding which pages are used |
| Replying to enquiries and support requests | Legitimate interests |
| Keeping tax and accounting records | Legal obligation |
| Responding to lawful requests from police, courts or regulators | Legal obligation |
Where we rely on legitimate interests, we have balanced them against your rights. You can ask us for details of that assessment. Account data is needed to provide an account; without it we cannot open one. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.
We do not sell your data, use advertising trackers or profile you for marketing.
Files are encrypted at rest. Each folder has its own encryption key, which is derived from its access words and protected by a server-side key.
Skypost is not a zero-knowledge service. We run the encryption system, so authorised staff may be able to access files where this is necessary for legal compliance, investigating abuse, or security and technical support.
Large uploads (over about 50 MB) may be processed briefly before encryption is finalised. They are encrypted straight after processing and the temporary data is removed.
Anyone who has a folder’s access words or link can open it, so share them carefully. See our security page for more.
| Data | How long |
|---|---|
| Folders without an account | Until the folder expires (see pricing for your plan). The files are then deleted. |
| Folders in an account | Active until they expire. They then move to your archive, which is kept for up to 12 months unless you revive or delete them sooner, and is then deleted. |
| Account data | Until you delete your account. Deletion removes your folders, files, API keys and preferences straight away. |
| Deletion record | A single record that an account was deleted, holding a hashed email only, kept as evidence that we acted on the request. |
| Security and audit logs | For as long as needed for security, fraud prevention and legal claims. Logs linked to a deleted account are anonymised. |
| API usage logs | Up to 90 days |
| Rate-limit records | About 24 hours |
| Billing records | 6 years, as required by UK tax law |
| Enquiries and abuse reports | For as long as needed to deal with them and any follow-up |
Deleted data may stay in encrypted backups for a short period until those backups are overwritten.
We use trusted service providers who process data on our behalf under written contracts:
| Provider | What they do |
|---|---|
| Cloudflare | Encrypted file storage, content delivery and network security |
| Abacus.AI | Application hosting and database |
| Stripe | Payments and subscriptions |
| Resend | Sending emails |
| Twilio | Sending SMS and WhatsApp messages |
| Browser push services (e.g. Google, Apple, Mozilla) | Delivering push notifications, if you turn them on |
We may also share data where the law requires it, to protect people from harm, or as part of a sale or restructuring of our business (in which case this policy would continue to apply). We do not sell or rent your data.
Some of our providers process data outside the UK, including in the United States and the European Economic Area. When data leaves the UK we make sure it is protected by an adequacy decision (such as the UK Extension to the EU-US Data Privacy Framework, where the provider is certified) or by the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. You can ask us for more detail.
Under UK data protection law you have the right to:
You can export your data and delete your account yourself from your account settings. For anything else, email [email protected]. We will reply within one month. This is free in most cases, and we may need to confirm your identity first.
Please contact us first so we can try to put things right. You also have the right to complain to the Information Commissioner’s Office (ICO), the UK data protection regulator, at ico.org.uk or on 0303 123 1113.
Skypost is not intended for children. You must be at least 16 to use it and 18 to buy a paid plan. If you think a child has given us personal data, contact us and we will delete it.
We only use cookies and similar storage that are strictly necessary or that remember choices you make. See our Cookie Policy.
We may update this policy from time to time. We will change the “Last updated” date, and if a change is significant we will tell account holders by email or in the app before it takes effect.