Privacy Policy
Last updated: 2 July 2026
FileX is built so that your files never reach us. Every operation — encryption, hashing, compression, metadata scrubbing, PDF editing, redaction, steganography — runs entirely inside your browser. We do not receive, store, log, or transmit the contents of your files, their names, or their metadata. This page explains the little data that is involved and how it is handled.
1. Who we are
FileX is a product of CybXSan, served at files.cybxsan.com. For any privacy question, contact privacy@cybxsan.com.
2. Your files never leave your device — except FileX Send
FileX is a static web app. File processing uses your browser's own capabilities (the Web Crypto API, canvas, and self-hosted libraries). Because the work happens locally:
- Your file contents are never uploaded to any server.
- We never see, keep, or transmit your file names, sizes, or metadata.
- Encryption passwords and keys you type are used in-memory in your browser and are never sent to us.
The live activity monitor in the app reflects this: file bytes stay on your device. One tool is a deliberate, clearly-labeled exception — see the next section, "FileX Send," which by its nature stores a file (always encrypted) so a recipient can retrieve it later.
3. FileX Send: what's different
FileX Send is a link-based file transfer tool — the sender gets a link to share with a recipient, who downloads the file later, possibly on a different device at a different time. That is only possible if the file is held somewhere in between, so Send does not follow the "nothing leaves your device" model every other tool here does. We designed it to give up as little as possible in exchange for that:
- Encrypted before it ever leaves your browser. The file is encrypted locally (AES-256-GCM) with a key generated in your browser before any upload begins.
- We never receive the decryption key. It lives only in the link
itself, in the part after
#— a URL fragment, which by design is never sent to any server, including ours. We store and serve only ciphertext we cannot read. - Temporary, not permanent. The encrypted file is deleted once downloaded (Free plan: after the first download) or once its link expires (1 hour on Free, 24 hours on Pro/Lifetime/Team), whichever comes first.
- Team passwords add a second, separate secret. On a Team-tier password-protected link, the decryption key is derived from both the link and the password — we never see the password either, and it should be shared with the recipient through a different channel than the link itself.
This is the one tool in FileX where the in-app monitor and this page intentionally say something different from every other tool — look for its own on-screen notice whenever it's open.
4. What limited data is involved
The only personal data in play relates to running the site and billing:
- Payments (Pro). When you subscribe, checkout and payment are handled by Dodo Payments, our payment provider and merchant of record. Dodo collects and processes your billing and payment details under its own privacy policy. We never receive or store your card details. From Dodo we receive only a license key and its subscription status.
- License key. If you activate Pro, your license key is stored in
your browser's
localStorage. It is sent to our billing endpoint only to check whether it is valid/active, so the app can unlock (or re-lock) Pro. We keep a minimal record mapping a license key to its active/inactive status to make this fast. FileX Send also sends this key when you upload a file, purely to confirm your plan's limits (file size, link expiry) server-side — never to identify what you're sending. - Preferences. Your light/dark theme choice is stored in
localStorageon your device only. - Hosting logs. Our host, Cloudflare, may process standard request information (such as IP address and browser type) to deliver and secure the site, under Cloudflare's privacy policy. Any analytics we use are cookieless and do not identify you.
5. No accounts, no tracking cookies
FileX has no login and no user database. We do not set advertising or
cross-site tracking cookies. The only browser storage we use is the
localStorage described above, on your device.
6. Data location & sharing
The site is served from Cloudflare's global edge network. Billing data is processed by Dodo Payments. We do not sell your data, and we share it only with these providers to the extent needed to run the service.
7. Your rights (GDPR / India DPDP)
Because we hold almost nothing about you — essentially a license key mapped to a subscription status — most requests are simple. You may ask us to access or delete the data we hold by emailing privacy@cybxsan.com. For payment records held by Dodo Payments, you can also contact Dodo directly. We aim to respond within the timeframes required by applicable law.
8. Children
FileX is not directed to children under 13 (or the minimum age in your jurisdiction), and we do not knowingly collect their data.
9. Changes
We may update this policy as the product evolves. Material changes will be reflected here with a new "last updated" date.