Privacy Policy

Effective date: November 6, 2026 · Last updated: November 6, 2026

Who operates this service?

Joplo Cloud is operated by the individual developer Dai Jianhao ("we", "us"), who is the controller of your personal data. This policy explains data handling for our website, the console at https://cloud.joplo.app, and public shares at https://joplo.app/s/<id>. For privacy questions, contact [email protected]. We have not appointed a data protection officer.

The open-source joplo CLI is licensed under Apache-2.0. Its local commands run on your device without connecting to the cloud; only login, share, whoami, and logout connect to Joplo Cloud. Local work is uploaded only when you publish a share.

What do we collect, and why?

  • Account details: your email address, name, language preference, and, if you use a password, its hash rather than the password itself. Optional two-factor authentication and passkey credentials support your chosen sign-in methods. We use these details to create and protect your account and display the service in your preferred language. Legal basis: performance of our contract with you.
  • Sessions and CLI authorization: Better Auth session records include your IP address and User-Agent for sign-in and session security. The CLI login confirmation page displays the CLI version and a coarse source IP prefix, such as 152.233.47.*, to help you spot unexpected authorization requests. This masked display does not mean session IP records are also masked. Legal basis: performance of contract and our legitimate interest in account security.
  • Share content: when you run share, you upload build artifacts such as HTML, JavaScript, CSS, images, and fonts. Files are stored by content hash in Cloudflare R2; share metadata associates the upload with your account so we can publish, expire, restore, or remove it. Legal basis: performance of contract.
  • Viewing statistics: Cloudflare Analytics Engine records the share ID, visitor country, and referring website's domain. These viewing events do not record IP addresses or the full referrer URL. This limit applies to viewing statistics; account sessions separately record IP addresses as described above. Legal basis: our legitimate interest in understanding share usage and preventing abuse.
  • Payments: payments are processed by Waffo Pancake as Merchant of Record. Card data is handled exclusively by Waffo Pancake and is never stored on our servers; we receive order and subscription status to provide paid access. Legal basis: performance of contract and legal obligations.
  • Service emails: Resend sends registration verification, magic links, password resets, organization invitations, and notification emails from [email protected]. Email addresses and the message content needed for delivery are processed for these purposes. Legal basis: performance of contract.

We do not currently send marketing emails. If we do in the future, we will ask for your consent first and include an unsubscribe link in every message; unsubscribing does not affect required service notices.

We do not sell or rent your personal information, and we do not use it for cross-context behavioral advertising.

Are my shares private?

Shares are public: anyone who obtains the link can open them. A link may be forwarded. Do not upload secrets, private personal information, or content you are not authorized to publish. Share pages run in a browser sandbox; this isolation does not make the content private. Removing a share cannot erase copies already saved by other people.

Which cookies do we use?

We use a login session cookie set only on cloud.joplo.app, the NEXT_LOCALE language cookie, and a cookie that remembers your last sign-in method. They support sign-in and your preferences. Blocking or deleting them may sign you out or reset those preferences. Our website currently has no third-party advertising trackers or enabled third-party analytics scripts.

Who processes the data, and where?

We use the following service providers for the functions described in this policy:

  • Railway: application and database hosting, including account, session, share metadata, and order/subscription status records. Privacy policy
  • Cloudflare: share-page Worker, R2 file storage, DNS, CDN, and Analytics Engine viewing statistics. Privacy policy
  • Resend: delivery of service emails. Privacy policy
  • Waffo Pancake: payment processing as Merchant of Record, including refunds, invoices, and taxes. Its handling of checkout information is subject to the terms and privacy information presented at checkout.

These providers' servers may be located outside your country or region, including outside mainland China. We share only the data each provider needs for its function and rely on safeguards such as their data processing agreements and Standard Contractual Clauses. By using the service, you acknowledge and consent to this cross-border processing.

How long do we keep data?

  • Account details: kept while your account exists. You can delete your account in account settings. We take down all your shares before deleting your account data. Shares belonging to banned accounts are taken down as well.
  • Session records: a session expires when you sign out or after 30 days without renewal. Session records are kept for security auditing while your account exists and are deleted with your account.
  • Shares: free shares expire after 1 hour. Their content is retained for 7 days after expiry, during which upgrading to Pro can restore the original link; after that the share is deleted. Pro shares remain available until you delete them, subject to account deletion, bans, and removal under the Terms of Service. Files are addressed by content hash, so a file still used by another share remains stored for that share.
  • Viewing statistics: kept for about 3 months, then deleted automatically by Cloudflare.
  • Order and subscription status records: kept while your account exists and deleted with your account. Waffo Pancake, as Merchant of Record, separately retains transaction records as required by law.
  • CLI device codes: cleaned up hourly after expiry.

What can I control?

You can manage your profile, language, and security options in the console, delete shares, and delete your account from account settings. For access to, a copy of, correction or deletion of your personal data, to withdraw consent, or for other privacy requests available under applicable law, contact [email protected]; we respond within 15 business days. Account deletion removes access to your shares; it does not remove copies others have already saved or automatically determine a Waffo Pancake refund.

Minors

Joplo Cloud is intended only for users aged 18 or older. We do not knowingly collect personal data from anyone under 18; if we learn that we have, we will delete the account and its data.

Security and breach notification

We protect your data with encryption in transit, password hashing, and access controls. If a personal data breach is likely to affect your rights, we will notify affected users and the relevant authorities as required by applicable law within 72 hours of becoming aware of it.

Changes and contact

Updates will be published on this page with an updated effective date; we will notify you of material changes in advance by email or in the console. Contact Dai Jianhao at [email protected] about this policy or your data. We usually reply within 5 business days.