Privacy Policy

Last updated 14 June 2026

Who we are

This site and the classified tool (classified.mainly.art) are operated by MAIN OÜ, an Estonian private limited company (registry code 11272196), registered at Soosepa tee 46-2, Pärnamäe küla, Viimsi vald, Harju maakond, 74020, Estonia. MAIN OÜ is the data controller. For privacy questions, contact us via the address revealed on our home page.

What classified does

classified lets you share end-to-end encrypted notes and files that self-destruct after a single view or download. It can be used without an account on a free allowance; an optional free or paid account raises your monthly sharing limit. This policy explains the limited data we process to run it.

Zero-knowledge by design

classified is built so that we cannot read your notes or files:

• Your note or file is encrypted in your browser before anything is uploaded. Our servers only ever receive an encrypted blob and an opaque identifier.
• The decryption key never reaches our servers. It lives in the share link's URL fragment (the part after #), which by web standards is never sent in HTTP requests — or, in password mode, it is derived from your password inside your browser.
• Shares are ephemeral: destroyed on first view/download and automatically purged at the expiry you set.
• There is no content logging and we never receive your file names — there is nothing readable for us to log.

Accounts and sign-in

You can create an account to raise your sharing allowance. For accounts we process:

• Email address and an optional display name.
• A password, stored only as a salted hash (we never store it in plain text), or — if you choose "Continue with Google" — your Google account's email and identifier, received from Google to authenticate you.
• An email-verification status. We send verification and password-reset emails through Cloudflare's email service.

To prevent abuse of the free allowance, we treat plus-aliased addresses (for example [email protected]) as the same address as [email protected] when deciding whether an account already exists.

Billing and payment data

Paid plans are sold and processed by Paddle (Paddle.com Market Ltd), which acts as the Merchant of Record for the transaction. When you subscribe:

• The billing details you enter — name or company name, VAT/Tax ID (optional), and billing address — are sent to Paddle so it can charge the correct tax and issue your invoice. These details also appear on that invoice.
• Your card or payment details are entered into, and held by, Paddle — we never receive or store them.
• We store, on your account, your subscription status, plan, billing period, and the billing details above so we can show your plan and your invoice history. Paddle notifies our server of subscription changes via secure webhooks.

See Paddle's Buyer Privacy Notice for how it handles payment data.

Usage data

For accounts we keep a small amount of usage information to enforce plan limits and show your history:

• The number of shares and total bytes you have created in the current period.
• A share audit log recording each share's size, creation/expiry/download time, and status — never the file name or any content.

Technical data we process

Like any website, requests carry standard metadata such as IP address, timestamp, and user-agent. This is handled transiently at the Cloudflare edge to serve the site and protect it from abuse. We also read the coarse country signal Cloudflare provides to choose your display currency and the correct consent experience. We do not use this to build profiles, and we do not link it to your encrypted content (which we cannot read).

Cookies and advertising

The free classified experience is ad-supported; paid subscribers see no ads. Ads are served by Google AdSense, which may set and read third-party cookies or similar identifiers to deliver and measure ads. For visitors in the EU, UK, and Switzerland we show a Google-certified consent banner (CMP) so you can grant or refuse ad-related cookies; where consent is not given, ads are limited to non-personalized serving. You can review and adjust your choices at any time, and learn more from Google's "How Google uses information from sites or apps that use our services" and your Google Ads Settings. We also use a strictly-necessary cookie to keep you signed in. The corporate home page at mainly.art itself shows no ads.

Third parties and sub-processors

• Cloudflare — hosting, CDN, encrypted-blob storage (KV and R2), the accounts database, transactional email delivery, and the Turnstile widget used to protect the contact-email reveal on our home page.
• Google — AdSense advertising and the certified consent platform on classified.mainly.art, and "Continue with Google" sign-in for those who choose it.
• Paddle — payment processing, billing, tax handling, and invoicing as Merchant of Record.

Data retention

Notes and files are ephemeral: deleted on first view/download and otherwise auto-expired at the chosen TTL; we keep no long-term store of your content. Account data (email, name, plan, usage counts, and the share audit log described above) is kept while your account exists and deleted when you delete your account. Billing and invoice records are retained by Paddle and by us for as long as accounting and tax law requires. Transient edge request logs are retained only briefly for security and abuse-prevention.

Your rights

Under the EU General Data Protection Regulation and Estonian law you may request access to, correction of, or erasure of personal data we hold, request a copy of your data, or object to or restrict certain processing, and you may lodge a complaint with a supervisory authority (in Estonia, the Data Protection Inspectorate / Andmekaitse Inspektsioon). You can delete your account at any time. To exercise any right, contact us via our home page.

Changes

We may update this policy as the service evolves; the "last updated" date above reflects the current version.