Privacy policy

Shako is a file transfer service operated by Shako from England and Wales. This notice explains what personal data we collect when you use https://shako.life, why we collect it, how long we keep it, and the rights you have over it.

For the purposes of UK GDPR we are the data controller for account data and service logs. When you upload files and choose who receives them, you decide what those files contain and who sees them — we process them on your instruction.

• Account data: your email address, display name and profile picture if you sign in with Google, your plan tier, your referral code and any referral link you used.
• Transfer metadata: file names, file sizes, MIME types, the transfer title and message you write, recipient email addresses you enter, the share link, the expiry you choose and the number of downloads.
• File content: the files you upload, stored encrypted at rest by our storage provider until they expire or you delete them.
• Usage counters: transfers sent in the current month, bonus credits earned from short expiries, deletions and referrals.
• Technical logs: IP address, user agent and timestamps for security events such as sign-in attempts and access to the private testing gate.

We do not scan, index or read the contents of your files, we do not sell personal data, and we do not use your files to train machine learning models.

• To deliver the service you asked for — storing files, generating share links, emailing recipients, counting downloads and expiring transfers on schedule. Legal basis: performance of a contract.
• To operate your account and plan — quota tracking, credits, referral bonuses and billing where a paid tier applies. Legal basis: performance of a contract.
• To keep the service secure — rate limiting, abuse prevention, audit logs of failed access attempts. Legal basis: legitimate interests.
• To comply with law — responding to lawful requests and retaining records where required. Legal basis: legal obligation.
• To send service messages about your transfers or important changes. Legal basis: performance of a contract or legitimate interests. Marketing email, if we ever send any, is consent-based and always unsubscribable.

Anyone who has a transfer link can download the files in that transfer until it expires, so treat links as sensitive. If you enter recipient email addresses, those addresses are used to notify them of the transfer.

We use a small number of processors to run the service:

• Cloud infrastructure and database hosting for accounts and transfer metadata.
• Object storage for the files themselves, written and read through short-lived pre-signed URLs.
• Email delivery for transfer notifications and account email.
• Google, if you choose to sign in with Google — Google confirms your identity and shares your email, name and picture with us.

We may also disclose data where we are legally required to, or to protect the rights and safety of users. We do not otherwise share your data with third parties. Ask us at privacy@shako.life for the current processor list.

• Files: until the expiry you chose (from 1 day up to 30 days depending on your plan), or sooner if you delete the transfer. Expired files are removed from storage and are not recoverable.
• Transfer metadata: kept briefly after expiry so your history and counters stay accurate, then deleted with the transfer.
• Account data: for as long as your account exists. Delete your account and we remove your profile, transfers and files.
• Security logs: a short rolling window, typically no more than 12 months, then deleted.

Our providers may process data outside the UK and EEA. Where that happens we rely on UK adequacy regulations or the International Data Transfer Agreement / Addendum to the EU Standard Contractual Clauses, together with encryption in transit and at rest.

Files are transferred over TLS and stored encrypted at rest by our storage provider. Uploads and downloads use short-lived pre-signed URLs rather than public buckets. Access to production data is limited to accounts that need it, sign-in attempts are rate limited, and repeated failures are temporarily blocked and logged.

No service can promise perfect security. Share links only with people you intend to reach, and use shorter expiry windows for anything sensitive.

We use strictly necessary storage only: a session record so you stay signed in, and — while the site is in private testing — a token proving you entered the access password. We do not run advertising or cross-site tracking cookies.

Under UK GDPR you can ask for a copy of your data, correct it, delete it, restrict or object to processing, and receive it in a portable format. You can also withdraw consent where we rely on it.

Email privacy@shako.life and we will respond within one month. If you are unhappy with our response you can complain to the Information Commissioner's Office at ico.org.uk.

Shako is not intended for children under 13, and we do not knowingly collect their data. Contact us if you believe a child has created an account and we will remove it.

We will update this page when our practices change and revise the date at the top. Material changes affecting how we use your data will be notified by email or in the app. Last updated 7 August 2026.