Privacy policy

Last updated October 2026.

Wovn (wovn.org) is operated by Connor Chevli. This describes what Wovn stores and who it is shared with.

What we store

The email you sign in with, and with Google also your name and the tokens Google issues at sign-in, which we use for nothing but signing you in; your subdomain; your bucket's endpoint, name, region and access key id, and its secret key encrypted at rest. Each sign-in keeps a session with the IP address and browser it came from for up to 30 days, and sign-in requests are counted per address for a minute or so to stop abuse. A code emailed to sign you in, and a code shown by the CLI, each live a few minutes. Tokens you create for the CLI are stored hashed, with the name you gave them and when they were last used; we cannot read them back. For each file in your bucket we keep an index of its key, size, type, visibility, share list and upload details. Guests who open a shared file give us the email they prove. Each share email you send is recorded: the recipient, the file, your subdomain and the time, so we can answer a recipient who asks why they got it.

Where it goes

Account data is stored in Neon (Postgres). Emails are sent through Resend. Google is the sign-in provider for account owners. The service runs on Cloudflare. File bytes pass through our servers between your bucket and the reader and are not stored by us.

What we do not do

We do not sell data, run ads, or read your files except to serve them.

Deleting

Deleting your org removes the org, its bucket link, its tokens and its index, and retires your subdomain. Your sign-in record (email and name) stays so you can sign in again, and the record of share emails you sent stays as that audit trail; email us to have either deleted. Your bucket is yours and is not touched.

Contact

privacy@wovn.org for questions about your data; abuse@wovn.org to report abuse.