Privacy

Who runs DocuChan & where data lives

DocuChan is built by Masterbek (masterbek.uz). This edition is published as “Powered by Bekito”.

This edition keeps encrypted files in its own Hetzner Object Storage bucket in the EU, separate from docuchan.com, with its own database on Hetzner servers. Storage in Japan is not guaranteed.

Questions about privacy or your data: [email protected].

What we store

• Encrypted file contents (ciphertext), until deletion.
• Minimal metadata: an unguessable id, file size, an encrypted filename label we cannot read, your chosen expiry and burn setting, a one-way password verifier (if set), and a download counter.
• A salted, hashed form of the uploader's IP for abuse prevention — never the raw IP.

What we never store

• Your decryption key (it lives only in the link fragment).
• Your password in any recoverable form.
• The plaintext contents of end-to-end encrypted files.
• File contents in logs.

Deletion

Files are deleted on download (burn mode) or at expiry, whichever comes first. Metadata rows are removed once the file is purged.

Beam (device-to-device)

When you use Beam, your files never touch our storage. The two devices connect directly whenever possible, and we relay only the brief, automatically-expiring signalling needed to introduce them — short-lived public keys and connection details, deleted within minutes. When no direct path exists, the encrypted stream passes through a relay that cannot read it. We store no file, no filename, and nothing that would let us reconstruct or read the transfer.

Clipboard (device-to-device)

Clipboard text and images are never uploaded to or relayed through our server. Our server handles only temporary presence and WebRTC connection details so the browsers can find each other; those records expire automatically. Transfers use direct peer-to-peer connections only, are end-to-end encrypted in the browsers, and remain only in the current tab's temporary history.

Rooms (real-time collaboration)

DocuChan never stores Rooms document content or room keys. The server temporarily stores participant presence, room lock and approval state, and WebRTC SDP/ICE signalling, which can contain IP addresses and other network connection details; those records expire automatically (presence within seconds, room sessions about 30 minutes after the last activity). So that only the original host can reclaim host controls, a one-way hash of the host key is kept for up to 30 days after its last use. Display names, cursors, comments, and host status are session metadata and do not authenticate anyone’s legal identity. Document changes and comments travel over application-encrypted WebRTC. Browsers prefer a direct path using public STUN services; when that fails, DocuChan's configured TURN service may relay encrypted packets. STUN/TURN can observe connection metadata and encrypted traffic volume, but not document content or the room key. Direct peers can see one another's network addresses. Your browser keeps a local working copy in IndexedDB and the complete resume credential, including the fragment key and any host capability, in this browser's site storage so Recent documents can reopen it. Remove or Clear all deletes that browser-local recovery data. Any approved participant can retain or export content they receive.

PDF tools

The PDF tools work inside your browser tab. The documents you open there are not uploaded to or stored by DocuChan, and the tool pages block other network connections while you work. Closing the tab clears the working copy.

Text recognition (OCR) runs in the tab too. When you start it, your browser downloads the recognition engine (about 1.5 MB) and the language model you picked (0.8–3.1 MB; about 2.5–4.5 MB in all) from DocuChan’s own server, just as it downloads the page. Only those files are requested; your document, its pages and the recognized text are not sent anywhere.

No ads, no data sales

We do not show ads, we do not sell data, and this site runs no analytics at all. The service is designed to know as little about your files as technically possible.

Services that see limited data

• Hetzner hosts our servers and stores the encrypted files — ciphertext only, never your keys.
• Cloudflare Turnstile runs an anti-abuse check on anonymous uploads and public forms; Cloudflare sees your IP address and browser signals for that check.
• Cloudflare also carries this edition's web traffic, so it sees connection data such as your IP address and the requests your browser makes. It never receives the # part of a link, and files go straight to storage, not through Cloudflare.
• When you use Beam, Clipboard or Rooms, your browser asks Google's public STUN servers for its public network address, so Google sees your IP address — never what you send.
• If two devices can't connect directly, Beam and Rooms traffic passes through a TURN relay we run ourselves; it only ever carries encrypted data. Clipboard never uses it.
• Our email provider delivers verification, sign-in and notification emails, so it sees your address and those messages.