Privacy.

Last updated: 6 October 2026.

SVX is a free, non-commercial project run by an independent developer in India ("we" on this page).

This website

• No accounts, sign-up or login.
• No analytics, no advertising and no tracking cookies.
• No files are uploaded to, or handled by, this website.
• Fonts and scripts are served from this site, not from third parties.
• If you switch between light and dark theme, the choice is saved in your browser's local storage, on your device only.

Hosting

This website is hosted on Cloudflare. Like any web host, Cloudflare processes your IP address and request details to deliver pages and protect the site from abuse. We don't add any tracking on top of that.

The SVX app and service

SVX is designed so that the service can't read your files. Files are encrypted on your computer and sent however you choose; the service never receives a file or its name. To make sign-in, approval, one-time limits and revocation work, the SVX service stores:

• Your account: your email address and name (Google accounts give their name in the app after signing up), the sign-in provider's account identifier (Google, or your email address for email accounts), and when the account last used the service. For email accounts, a password hash, never the password itself.
• Public keys for your devices. Private keys stay in your device's keychain, and your backup is encrypted with a password only you know.
• For each file you send: a random file ID, a fingerprint of its header, who it was sent to, and the rules you chose (approval, one-time, expiry, view-only).
• Activity: approval requests and decisions, when a file was opened, revoked or expired, and an audit trail of these events.
• Emails we send you: sign-in codes and approval notices (they name the person asking, never the file), a notice if your account is suspended, restored or deleted, and occasional announcements, for example about a new version. To stop announcements, reply "unsubscribe" or write to support@getsvx.me. We keep a count of emails sent (time and kind, no addresses) for a week, to stay within our mail provider's daily limit.
• Operator log: what the operator did, such as suspending an account or sending an announcement. It names accounts by their random account ID, never by email address.

File names and your sending history are kept only in the app on your computer.

Where it is stored

The SVX service runs on a server in India (Microsoft Azure, Central India). Requests to it pass through Cloudflare, which protects it from attacks. Emails are sent through Google's Gmail. Encrypted copies of the database are kept on the operator's own computer and in an encrypted offline backup.

Company accounts

If you use SVX through your company, your company's identity provider signs you in, and your company's administrators can see the audit trail for its organisation.

How long we keep it

Your account and its records are kept until you ask us to delete your account. Sign-in codes expire after 10 minutes and are removed within a day; we store only a fingerprint of each code, never the code. Request counts used to stop abuse (by network address and account) are kept in memory for at most a day.

When an account is deleted we erase its email address and name, keys, password hash, every file it sent (those files can no longer be opened), its place on other people's files, its requests, the emails sent to it or naming it, and its own activity log. One thing stays: entries in other people's activity logs that mention it, for example that it asked to open a file they sent, because those are part of that sender's own record.

Your choices

You can ask for a copy of your account data or for your account to be deleted at support@getsvx.me. We may suspend an account that is used for abuse.

Contact

Privacy questions and requests: support@getsvx.me.

Security issues: security@getsvx.me. We answer requests within 30 days.