Privacy

Yowling stores your images, temporary files, paste contents, filenames, display labels, folders, tags, short-link destinations, account identifiers, quotas, and creation and activity timestamps.

PNG images may be optimized without losing image quality. JPEG, WebP, GIF, and animated images keep their original bytes. Images may retain embedded metadata.

Keys and sessions

Account keys and tokens are stored as hashes, not readable secrets. Browser sessions use a secure cookie that JavaScript cannot read. You can check device and session activity in your account. Theme preference stays in this browser.

To help you recognize sessions, we save an estimated browser and device name and approximate sign-in location. We do not store raw IP addresses or user-agent strings in session records.

Sharing and deletion

Your galleries and share management require login. Anyone with a public image, unencrypted temporary file, or short link can use it. Encrypted temporary files also require their encryption key. Public and unlisted paste links can be read by anyone with the link; private pastes require the owner's login. Stored images may contain metadata, including location data.

Your admin sets separate expiration policies for images, pastes, and temporary files. Starred images stay protected until unstarred. Deletion hides content immediately; storage cleanup may finish later. Downloaded copies cannot be recalled.

Optional paste encryption happens in your browser. Paste contents are encrypted; share metadata such as visibility remains visible to the service. Paste encryption keys are not sent to the server. Keep the encryption key or the complete link, including its key fragment, to read an encrypted paste again.

Temporary-file encryption happens on the server so uploads and downloads also work with curl. The server receives the file and encryption key over HTTPS, stores the encrypted file, and does not store the key. Recipients need both the link and key. Lost encryption keys cannot be recovered.

Operational records

The service records redacted request outcomes, rate-limit state, and administrative actions. It does not promise anonymity or end-to-end encryption. Contact your inviting administrator with account or privacy questions.